// what it is
Description
Vern Paxson's research-grade NSM platform (renamed from 'Bro' in 2018). Watches traffic and produces dozens of high-signal logs — conn.log, dns.log, ssl.log — that feed SIEMs and threat-hunting workflows.
// use cases
What people use it for
- Network-security monitoring
- Threat hunting via flow logs
// commands
The commands you'll type
Process a pcap
$ zeek -r capture.pcap