Zeek-MCP acts as a friendly bridge between deep network traffic analysis and conversational AI. It allows anyone to "talk" to their network data by connecting the popular Zeek network security monitor to AI assistants like Claude. Instead of manually sifting through complex packet captures or raw data, a user can simply provide a file to their AI and ask questions about what happened on the network, making high-level security auditing much more accessible. For those looking for more control, this tool exposes specific network functions to a Large Language Model (LLM) through the Model Context Protocol. It features two primary capabilities: the `execzeek` tool, which runs Zeek on PCAP files to generate detailed logs, and the `parselogs` tool, which transforms those raw logs into structured data frames. This automation handles the messy work of clearing out old files and organizing new ones, ensuring the AI always has clean, relevant data to interpret. Developers building security-focused AI agents will find this MCP particularly useful because it supports both Standard Input/Output (stdio) and Server-Sent Events (SSE) transport protocols. It integrates smoothly with platforms like Claude Desktop, 5ire, and the Chainlit framework, enabling the creation of custom cybersecurity chatbots. By giving an LLM the direct ability to run diagnostics and parse network logs, it empowers automated systems to perform threat hunting and incident response in a way that is both fast and intuitive.
Category: Data & Analytics
Tags: cybersecurity, network-analysis, pcap, threat-hunting, zeek
PATH. * pip (for Python dependencies). Steps: 1. Clone the repository: bash git clone https://github.com/Gabbo01/Zeek-MCP cd Zeek-MCP 2. Install dependencies: It is recommended to use a virtual environment: bash python -m venv venv source venv/bin/activate # Linux/macOS # OR venv\Scripts\activate # Windows pip install -r requirements.txt Note: If no requirements.txt is present, install directly via pip install pandas mcp. ---claude_desktop_config.json (found at %APPDATA%\Claude\claude_desktop_config.json on Windows or ~/Library/Application Support/Claude/claude_desktop_config.json on macOS) and add the following: json { "mcpServers": { "Zeek-mcp": { "command": "python", "args": [ "/ABSOLUTE_PATH_TO/Bridge_Zeek_MCP.py" ] } } }ZeekMCP 3. Set Name: Zeek-MCP 4. Set Command: python /ABSOLUTE_PATH_TO/Bridge_Zeek_MCP.pybash python Bridge_Zeek_MCP.py --mcp-host 127.0.0.1 --mcp-port 8081 --transport sse ---execzeek(pcap_path: str) -> str: * Description: Deletes existing .log files in the working directory and runs Zeek on the provided PCAP file. * Returns: A string listing the generated .log filenames or "1" on error. * parselogs(logfile: str) -> DataFrame: * Description: Parses a specific Zeek .log file. * Returns: The parsed content of the log file. ---/path/to/capture.pcap and tell me what log files were generated." * "Analyze the conn.log file from my latest Zeek run and summarize the top connection sources." * "Use the execzeek tool on the sample PCAP in the pcaps folder and then parse the http.log to look for suspicious headers."conn.log or dns.log can be time-consuming and requires deep expertise in network protocols. Solution: This MCP allows an analyst to simply provide a PCAP file to a conversational AI. The AI can automatically execute Zeek to extract relevant logs and then use its reasoning capabilities to correlate events, identify suspicious IP addresses, and summarize the attack timeline in plain English. Example: An analyst says, "Analyze suspicious_traffic.pcap and tell me if there is any evidence of data exfiltration." The AI runs execzeek, parses the http.log and conn.log, and replies, "I found an unusually large outbound transfer of 500MB to an external IP in Russia via port 443."ssl.log or known_services.log to identify deprecated protocols or unauthorized services running on the network. Example: A sysadmin asks, "Scan this network capture and list any devices still using TLS 1.0 or 1.1." The AI uses parselogs on ssl.log, filters the version column, and provides a list of specific internal IP addresses that need to be updated.parselogs tool to examine the conn.log (specifically the connection state strings like 'RSTR' or 'S0') to explain exactly why a connection failed. Example: A developer asks, "Why are my API calls to the production server failing in this PCAP?" The AI runs Zeek, parses conn.log, and…Part of MCP Servers