Zeek Analysis Tools (ZAT)

The ZAT Python package enables the processing and analysis of Zeek data using Pandas, scikit-learn, Kafka, and Spark. To install the package, use the following commands: - pip install zat - pip install zat[pyspark] (this includes the pyspark library) - pip install zat[all] (this includes pyarrow, yara-python, and tldextract). Examples of using ZAT include: AWS Data Processing and ML Modeling, SageWorks, and installing on Raspberry Pi. Recent improvements in the package include: faster and smaller Pandas DataFrames for handling large log files, enhanced support for converting Pandas DataFrames to matrices (ndarray), scalable conversion from Zeek logs to Parquet format, a significantly improved Spark DataFrame class, updated and enhanced Notebooks, and a new Zeek JSON to DataFrame class. For more information, view the video presentation on Data Analysis and Machine Learning with Zeek.

Why ZAT? Offloading complex tasks from Zeek helps in the efficient processing of high-volume network traffic and enhances data analysis capabilities.