Zeek is a network analysis framework that watches traffic and turns it into structured logs, protocol metadata, and session-level evidence. Rather than relying mainly on signatures, it parses protocols and records what happened on the wire: who talked to whom, which services were used, what files or commands were exposed, and which protocol details looked unusual.
This matters because many attacks are easier to prove than to block. Zeek helps defenders investigate scanning, lateral movement, command-and-control, and data theft by preserving rich context that alerts alone may miss. In practice, it is often deployed as a sensor alongside IDS tools, feeding SIEMs and incident response workflows with searchable evidence. That makes Zeek valuable for triage, hunting, and post-incident reconstruction, especially when analysts need a defensible record of network behavior.