Zeek (formerly Bro) does not focus on alerts like a traditional IDS, but instead produces context-rich structured protocol logs (connection, DNS, HTTP, SSL, etc.) — well suited for threat hunting and deep investigation, and it includes its own scripting language for custom detection.