Integrating Zeek With Third-Party Applications#

Christian Kreibich

• Why: Zeek is the other pillar of open NDR; this covers the runtime integration surface that turns it from a log producer into an active component of detection infrastructure.
• What: A tour of Zeek's live integration mechanisms — asynchronous intel ingestion, event exchange with custom services, web-API calls from JavaScript, runtime state load/save, and operational telemetry — with real-world applications including ML models, threat-intel platforms like MISP, and round-tripping network inventory data. (from abstract only)
• How: Walkthrough of each mechanism with relative pros and cons and example integrations.
• Where applicable: Organizations already running (or considering) Zeek; broadly applicable, though the tooling itself is Zeek-specific.