Skip to content
SPECIFICTION
Get listed

Zui

zui.brimdata.io

Free plan WindowsmacOSLinux
Visit zui.brimdata.io
Spec score 7.3 #27 of 30 in Network Protocol Analyzers

What it is

Zui is a free desktop application for exploring, querying, and debugging data in Zed lakes. It runs on Linux, macOS, and Windows, with drag-and-drop ingest, schema inference, named queries, filters, and pivots. Users can preview and shape data while loading it; imported data is stored locally under the Zui data directory, and the application can also connect to a remote Zed lake.

For packet capture analysis, bundled Brimcap creates Zeek and Suricata summary logs, and Zui can extract packet flows. Packet views can correlate Zeek events with Suricata alerts and offer right-click queries to VirusTotal or whois. Bundled Suricata uses Emerging Threats Open rules by default and updates them when Zui launches while connected to the internet. The maker says releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been changed since it was built. Brim Data continues to publish legacy Zed and Zui releases and documentation while developing SuperDB. Linux updates require manually uninstalling and reinstalling; the installation guide points users to troubleshooting documentation and a public Slack community.

Spec sheet

Purpose
Zui is a desktop application for querying and debugging Zed lakes.Read 4 Oct 2026 · brimdata.io
Security
The maker says Zui releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been tampered with since it was built.Read 4 Oct 2026 · zui.brimdata.io
Support
The installation guide directs users who need help to troubleshooting documentation and the public Slack community.Read 4 Oct 2026 · zui.brimdata.io
Headquarters
South San Francisco, California, United StatesRead 28 Sep 2026 · zui.brimdata.io
Data exploration
Zui is a graphical interface for exploring data in Zed lakes.Read 4 Oct 2026 · zui.brimdata.io
Ingest and query features
The product page lists drag-and-drop ingest, schema inference, named queries, and filters and pivots.Read 4 Oct 2026 · zui.brimdata.io
Local storage
Imported data is stored in a local Zed lake under the user's Zui data directory.Read 4 Oct 2026 · zui.brimdata.io
Maker status
Brim Data says it is currently developing SuperDB while continuing to publish legacy Zed and Zui releases and documentation.Read 4 Oct 2026 · brimdata.io
Notable limitation
The maker says Linux updates require manual uninstalling and reinstalling.Read 4 Oct 2026 · zui.brimdata.io
Packet capture analysis
Bundled Brimcap generates Zeek and Suricata summary logs from packet captures, and Zui can extract packet flows.Read 4 Oct 2026 · zui.brimdata.io
Platform requirements
The maker recommends Windows 10 or newer, macOS Ventura 13.7 or newer, Ubuntu 20.04 or newer, Debian 11 or newer, Fedora 31 or newer, or Rocky 9 or newer.Read 4 Oct 2026 · zui.brimdata.io
Preview and shape data
Zui lets users preview and shape data while loading it into a Zed lake.Read 4 Oct 2026 · zui.brimdata.io
Remote lake support
Zui can connect to a remote Zed lake, whose service uses TCP port 9867 in the documented setup.Read 4 Oct 2026 · zui.brimdata.io
Security integrations
Packet capture views can correlate Zeek events with Suricata alerts, and right-click options can query VirusTotal or whois.Read 4 Oct 2026 · zui.brimdata.io
Threat rules
By default, bundled Suricata applies Emerging Threats Open rules, which are updated when Zui launches while connected to the internet.Read 4 Oct 2026 · zui.brimdata.io

Plans and prices

Zui Free Free to download and use Read 4 Oct 2026 · brimdata.io

Every Zui plan and price →

Strong points and limits

Strong points

  • Free to download and use
  • Runs on Linux, macOS, and Windows
  • Includes packet-flow extraction
  • Correlates Zeek events with Suricata alerts
  • Supports local and remote Zed lakes

Limits

  • Linux updates require manual uninstall and reinstall
  • Linux requirements recommend Ubuntu 20.04 or newer
  • The maker is developing SuperDB while publishing legacy Zui releases

Who it suits

Zui suits people exploring Zed lakes or analyzing packet captures on Linux, macOS, or Windows. It is relevant to users who want local data storage or a connection to a remote Zed lake.

Verdict

Zui combines graphical Zed lake exploration with packet-capture analysis tools. Note the manual Linux update process and the maker’s stated transition toward SuperDB development.

Where Specifiction places it

Alternatives to ZuiAll alternatives →