Zui
Zui is a desktop application for exploring, querying, and debugging data in Zed lakes.
What Zui is
Zui is a desktop application for exploring, querying, and debugging data in Zed lakes. It runs on Linux, macOS, and Windows, and provides drag-and-drop ingest, schema inference, named queries, filters, and pivots. Users can preview and shape data as it is loaded; imported data is stored locally in a Zed lake under the Zui data directory. For packet capture analysis, bundled Brimcap produces Zeek and Suricata summary logs, while Zui can extract packet flows and correlate Zeek events with Suricata alerts. Right-click actions can launch VirusTotal or whois queries. Suricata uses Emerging Threats Open rules by default and updates them when Zui launches with an internet connection. Zui can connect to a remote Zed lake. Brim Data says releases are signed to show the installer came from the maker and has not been altered since it was built. The company continues publishing Zed and Zui releases and documentation while developing SuperDB.
Good
- Free to download and use.
- Supports Linux, macOS, and Windows.
- Previews and shapes data during loading.
- Correlates Zeek events with Suricata alerts.
- Supports local and remote Zed lakes.
Watch out
- Linux updates require manual uninstalling and reinstalling.
- Recommended operating systems have minimum versions.
Who it suits
Zui suits people who need a graphical way to inspect Zed lake data or analyze packet captures. It is available on Linux, macOS, and Windows, though Linux updates require manual uninstalling and reinstalling.
Verdict
Zui brings data exploration and packet capture analysis into a desktop interface, with local and remote Zed lake support. Linux users should note the manual update process and check the recommended operating system versions before installing.
Plans and prices
From Zui's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Zui | Free | Free to download and use |
The facts
Each one read from Zui's own pages, with the date it was checked.
What it does
- Data exploration
- Zui is a graphical interface for exploring data in Zed lakes.checked 4 Oct 2026
- Ingest and query features
- The product page lists drag-and-drop ingest, schema inference, named queries, and filters and pivots.checked 4 Oct 2026
- Local storage
- Imported data is stored in a local Zed lake under the user's Zui data directory.checked 4 Oct 2026
- Notable limitation
- The maker says Linux updates require manual uninstalling and reinstalling.checked 4 Oct 2026
- Packet capture analysis
- Bundled Brimcap generates Zeek and Suricata summary logs from packet captures, and Zui can extract packet flows.checked 4 Oct 2026
- Preview and shape data
- Zui lets users preview and shape data while loading it into a Zed lake.checked 4 Oct 2026
- Purpose
- Zui is a desktop application for querying and debugging Zed lakes.checked 4 Oct 2026
- Remote lake support
- Zui can connect to a remote Zed lake, whose service uses TCP port 9867 in the documented setup.checked 4 Oct 2026
- Security
- The maker says Zui releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been tampered with since it was built.checked 4 Oct 2026
- Security integrations
- Packet capture views can correlate Zeek events with Suricata alerts, and right-click options can query VirusTotal or whois.checked 4 Oct 2026
- Support
- The installation guide directs users who need help to troubleshooting documentation and the public Slack community.checked 4 Oct 2026
- Threat rules
- By default, bundled Suricata applies Emerging Threats Open rules, which are updated when Zui launches while connected to the internet.checked 4 Oct 2026
The company
- Headquarters
- South San Francisco, California, United Stateschecked 28 Sep 2026
- Maker status
- Brim Data says it is currently developing SuperDB while continuing to publish legacy Zed and Zui releases and documentation.checked 4 Oct 2026
Where it runs
- Platform requirements
- The maker recommends Windows 10 or newer, macOS Ventura 13.7 or newer, Ubuntu 20.04 or newer, Debian 11 or newer, Fedora 31 or newer, or Rocky 9 or newer.checked 4 Oct 2026
Alternatives to Zui
- 1
NETCAP
Free planOpen sourceWebAPILinuxmacOS8.1From €49 a month - 2
A-Packets
Free planWebAPILinuxSelf-hosted7.5From $99 a year - 3
Wireshark
Free planOpen sourceAPILinuxmacOSSelf-hosted7.5Free plan - 4
Colasoft Capsa
Free planWindows7.4$295 one-time - 5
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 6
OpenGrep
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan