Zeek Network Telemetry

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/network-zeek/generator.yml \
  --id zeek \
  --live-mode true

Event Types

Realism Features

• Selected Zeek 8.0.0 JSON profile (TS_EPOCH timestamps, unset fields omitted, local_nets 10.0.0.0/8) for completely observed IPv4 traffic: each flow has one DNS transaction, HTTP transaction or TLS handshake and a later connection summary with the same UID and 4-tuple. Native times follow the stream, with TCP summaries after the five-second close timer and DNS summaries after the 10 s dns_session_timeout, as microsecond epoch doubles.
• Records arrive in collector read order: event.created increases from record to record while @timestamp can go backwards across the interleaved streams. A DNS, TLS or HTTP record is read 1 ms-1.9 s after it completed, a connection summary a median 6 s after its close timer (90% within 22 s, up to about 4 minutes at night).
• About 14,500 records a day (up to 10% day to day): about 5,500 around the clock plus 9,000 on an office-hours curve peaking at 12:00-14:00, UTC by default, from about 230 records an hour at night to 1,050 at the peak. Each client has its own activity level (the busiest about six times the quietest) and its own daily rhythm, shifted by up to four and a half hours.
• A client keeps up to three resolved names until their TTL runs out and uses them over TLS or HTTP. All clients query one recursive resolver: cached names are answered in about a millisecond with the remaining TTL counting down, others after about 12 ms with the full zone TTL (1,800, 3,600 or 7,200 s per name). Each client uploads its own share of HTTP requests, from a few percent to about half, 18% overall.
• Watched node names resolve to the watched addresses in ordinary traffic too, so every client resolves them, beacons to them over TLS within minutes, re-resolves them and uploads to them. About 20 sync jobs a day repeat four to six TLS connections, a re-resolution and a POST /upload within about 25 minutes. Uploads to watched names fail with 503 somewhat more often than other uploads, in both modes.
• Negative DNS answers log RA=false with no rtt, answers or TTLs, as the tagged Answer hook implies. HTTP carries Content-Length bodies, fixed ETag representations and bodyless 304s; TLS 1.3 handshakes show history Cs with certificates and next_protocol unset. The TCP packet model, TTLs and traffic rates are synthetic assumptions, not a measured trace.
• Four streams only (no files.log, x509.log or weird.log). Native JSON follows the tagged Zeek schemas, writer and baselines, not a live sensor, and number formatting may differ from the Zeek JSON writer byte for byte. Elastic sample-path coverage is 88.24% conn, 91.07% DNS, 89.09% HTTP and 60.00% SSL; Community ID, network.direction and verified agent status are not emitted, and the Filebeat inventory is synthetic.

Sample Output

{
  "@timestamp": "2026-09-02T10:42:23.506643+00:00",
  "agent": {
    "ephemeral_id": "d2c2e56b-4915-4dc4-8ad9-6112f1d26e43",
    "id": "8aaedfb4-c8a3-4dd8-853f-5c270abfd47a",
    "name": "zeek-sensor-01",
    "type": "filebeat",
    "version": "8.7.1"
  },
  "data_stream": {
    "dataset": "zeek.ssl",
    "namespace": "default",
    "type": "logs"
  },
  "destination": {
    "address": "198.51.100.77",
    "ip": "198.51.100.77",
    "port": 443
  },
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "category": [
      "network"
    ],
    "created": "2026-09-02T10:42:25.323658+00:00",
    "dataset": "zeek.ssl",
    "id": "CVc1wy81OhorikBAZL",
    "ingested": "2026-09-02T10:42:26.674532+00:00",
    "kind": "event",
    "module": "zeek",
    "original": "{\"ts\":1788345743.506643,\"uid\":\"CVc1wy81OhorikBAZL\",\"id.orig_h\":\"10.20.10.14\",\"id.orig_p\":56512,\"id.resp_h\":\"198.51.100.77\",\"id.resp_p\":443,\"version\":\"TLSv13\",\"cipher\":\"TLS_AES_128_GCM_SHA256\",\"curve\":\"x25519\",\"server_name\":\"node-c0ac0423.sync-gw.example.net\",\"resumed\":false,\"established\":true,\"ssl_history\":\"Cs\"}",
    "type": [
      "connection",
      "protocol",
      "info"
    ]
  },
  "host": {
    "name": "zeek-sensor-01"
  },
  "input": {
    "type": "filestream"
  },
  "log": {
    "file": {
      "path": "/opt/zeek/logs/current/ssl.log"
    }
  },
  "message": "{\"ts\":1788345743.506643,\"uid\":\"CVc1wy81OhorikBAZL\",\"id.orig_h\":\"10.20.10.14\",\"id.orig_p\":56512,\"id.resp_h\":\"198.51.100.77\",\"id.resp_p\":443,\"version\":\"TLSv13\",\"cipher\":\"TLS_AES_128_GCM_SHA256\",\"curve\":\"x25519\",\"server_name\":\"node-c0ac0423.sync-gw.example.net\",\"resumed\":false,\"established\":true,\"ssl_history\":\"Cs\"}",
  "network": {
    "protocol": "tls",
    "transport": "tcp"
  },
  "observer": {
    "name": "zeek-sensor-01",
    "product": "Zeek",
    "type": "ids",
    "version": "8.0.0"
  },
  "related": {
    "ip": [
      "10.20.10.14",
      "198.51.100.77"
    ]
  },
  "source": {
    "address": "10.20.10.14",
    "ip": "10.20.10.14",
    "port": 56512
  },
  "tags": [
    "zeek-ssl"
  ],
  "tls": {
    "cipher": "TLS_AES_128_GCM_SHA256",
    "client": {
      "server_name": "node-c0ac0423.sync-gw.example.net"
    },
    "curve": "x25519",
    "established": true,
    "resumed": false,
    "version": "1.3",
    "version_protocol": "tls"
  },
  "zeek": {
    "session_id": "CVc1wy81OhorikBAZL",
    "ssl": {
      "cipher": "TLS_AES_128_GCM_SHA256",
      "curve": "x25519",
      "established": true,
      "resumed": false,
      "server_name": "node-c0ac0423.sync-gw.example.net",
      "ssl_history": "Cs",
      "version": "TLSv13"
    }
  }
}

Parameters