zeek-mcp
ActiveA real investigation means grepping conn, then dns, then http, then ssl by hand, pivoting on a UID you keep pasting between awk one-liners. zeek-mcp hands the whole sensor to your agent: Zeek and Suricata logs queried, correlated, and hunted over stdio, so it follows the pivot for you.
See it workrepresentative session
Representative session. Illustrative values, RFC 5737 addresses. Read-only, and your logs never leave the box.
What it does
Point any MCP client at zeek-mcp and your Zeek and Suricata sensor becomes tools the agent can call: search connection, DNS, HTTP, SSL, files, notice, and SSH logs, follow a connection UID across every log type, and cross-reference Suricata alerts back to the Zeek context that explains them. It exists because network telemetry lives in dense per-protocol log files that are tedious to grep under pressure, and an LLM is good at pivoting across them once you give it structured access. It differs from a generic log-reader MCP by speaking Zeek and Suricata natively: it parses both TSV and JSON, matches CIDR and wildcards with IPv6 support, walks gzipped and date-rotated archives, and ships purpose-built detections (beaconing by interval regularity, DNS tunneling by entropy, JA3 hunting, anomaly and baseline analysis) instead of handing the model raw text. It is read-only against your telemetry and speaks stdio, so there is no new network surface; the only writes are the optional TheHive and MISP tools, and only when you supply credentials.
Capabilities39 tools across the sensor
Protocol queries
11 toolsSearch conn, DNS, HTTP, SSL, files, notice, SSH, and DHCP logs with CIDR, wildcard, and range filters.
Detections & analytics
9 toolsBeaconing, DNS tunneling, JA3 fingerprints and hunt, anomaly and baseline outlier detection, DGA and expired-cert checks.
Cross-log investigation
3 toolsFollow a UID or host across every log type and inventory detected software.
Suricata IDS
4 toolsQuery and summarize eve.json alerts, correlate them back to Zeek context, and read engine stats.
PCAP & sensor
3 toolsList captures, replay a PCAP through Zeek, and check live sensor health and log freshness.
Incident response
6 toolsOpt-in TheHive alerts and cases plus MISP IOC lookups and events, only when you supply credentials.
Setup
npx -y zeek-mcp
Set ZEEK_LOG_DIR, ZEEK_LOG_FORMAT (json or tsv), and SURICATA_EVE_LOG to your sensor paths. Optional MISP_* / THEHIVE_* / PCAP_DIR vars enable IR and replay.
{ "mcpServers": { "zeek": { "command": "npx", "args": ["-y", "zeek-mcp"], "env": { "ZEEK_LOG_DIR": "/opt/zeek/logs/current", "ZEEK_LOG_FORMAT": "tsv", "SURICATA_EVE_LOG": "/opt/suricata/logs/eve.json" } } } }