Zui review
A free, cross-platform desktop analyzer for PCAP, Zeek, Suricata, and Zed lakes.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Zui is a free desktop application for exploring, querying, and analyzing Zed lakes and packet-capture data. It is aimed at analysts investigating PCAP files with Zeek and Suricata, as well as teams working with local or remote Zed lake data. Zui runs on Windows, macOS, and Linux, and imported PCAP files and flow indexes remain local to the workstation.
Its strongest capability is the bundled PCAP workflow. Brimcap processes captures, generates Zeek and Suricata summary logs, and correlates Zeek events with Suricata alerts. Connection-lifecycle ladder diagrams, flow extraction, and PCAP export help move from broad traffic review to selected evidence. Drag-and-drop ingestion, schema inference, filters, pivots, named queries, and query workflows support repeatable investigation. The ecosystem also includes Zeek, Suricata, VirusTotal, whois, Wireshark, and Zed lakes, while bundled command-line tools include zed, zq, and brimcap.
Zui fits teams that want a no-cost, cross-platform desktop interface combining packet analysis with Zed lake exploration. Its remote-lake capability provides access to remote Zed data, but it is distinct from remote network-interface capture; the published capture model is local. Brim Data describes Zui as a legacy release while focusing development on SuperDB, although Zui documentation and downloads remain published. Choose Zui when its integrated PCAP, Zeek, Suricata, flow, and query workflow matches an existing environment. Choose another option when active remote capture or a product under primary ongoing development is a requirement.
Zui pros and cons
- Where it wins
- Correlates Zeek events with Suricata alerts
- Includes flow diagrams, pivots, queries, and PCAP export
- Runs on Windows, macOS, and Linux at no cost
- Where it doesn't
- Network capture is limited to local data
- The release is described as legacy
- Remote Zed access is not remote interface capture
Zui fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update