Zeek (formerly Bro)

Zeek (formerly known globally as Bro) is a profoundly historic, intensely powerful, and wildly ubiquitous Open Source platform. However, it is critical to understand its distinct position: Zeek is not an active IPS (it doesn't drop packets). Zeek is the absolute gold standard for "Network Security Monitoring (NSM)." It is a highly complex, passive engine that generates the deepest, most staggering network metadata on earth. The absolute core differentiator of Zeek is its "Rich Protocol Metadata and Scripting Engine." While Snort looks for a specific bad packet, Zeek quietly watches an entire hour-long network session. It generates beautiful, structured logs (in JSON/TSV) detailing every single HTTP request, every DNS query, and every SSL certificate used. It turns chaotic network traffic into a highly organized database of network history. Furthermore, its Turing-complete scripting language allows security researchers to write incredibly complex logic (e.g., "Alert me if a user connects to a Chinese IP address using an expired Russian SSL certificate"). For elite Security Operations Centers (SOCs), threat hunters, and academic researchers, Zeek is an absolute necessity.