WLCG SOC WG Hackathon 2025

15 Sept 2025, 09:00 → 17 Sept 2025, 17:00 Europe/Bucharest

PRECIS Center, 1st floor (University Politehnica of Bucharest)

Overview

The WLCG SOC Hackathon 2025 will run for 2.5 days, with an agenda focused on R&E organisations that will be largely constructed from the needs of the community in general and attendees in specific. However, to support this process we define some ground rules/initial structure.

Location

The Hackathon will take place at University Politehnica of Bucharest / National University of Science and Technology Politehnica Bucharest in their Bucharest campus at Splaiul Independenţei nr. 313, sector 6, Bucharest, Romania, with two breakout rooms available throughout the event.

You must be registered to attend Face to Face as visitor passes will need to be arranged for you.

Dinner

We anticipate organising a self-hosted hackathon dinner on the second night (Tuesday).

Topics

Possible topics include:

• "Intro" stream - getting started with the tools
• MISP development + Advanced usage (APIs etc) + Integrations
• Zeek + Networking
• People and process
• Opensearch + log ingestion pipelines
• Additional tool integrations (conf management, etc)
• Status updates
  
• Documentation

Preparation

Regular SOC WG dev meetings take place every Monday at 13:30 UTC: we will use these to help arrange the agenda over the summer

Monday 15 September

1 Intro

Speakers: Dr David Crooks (UKRI STFC), Liviu Valsan (CERN), Maria-Elena Mihailescu (National University of Science and Technology POLITEHNICA Bucharest (RO))

2 Roundtable and agenda tweaking

3 STFC status

Speakers: Dr David Crooks (UKRI STFC), James Acris (STFC), Liam Atherton

SOC Hackathon Bucharest 2025.pdf

4 CERN update

5 UPB SOC status update

Speaker: Maria-Elena Mihailescu (National University of Science and Technology POLITEHNICA Bucharest (RO))

10:30 Break

6 Recap of reference design, current tools, etc

7 Options for future additions to reference toolset (Suricata, Wazuh,...) and people with experience

Speaker: Dr David Crooks (UKRI STFC)

8 Documentation work

12:30 Lunch

9 MISP, Shuffle and Honeypot infrastructure deployment and configuration

Speaker: Dragos Sanda

10 MISP warning lists

Speaker: Liviu Valsan (CERN)

11 MISP Integrations with commercial tools

Speaker: Dr David Crooks (UKRI STFC)

15:30 Break

12 Lightweight SOC / Unicor

Speaker: Romain Wartel (CERN)

2025 - Unicor intro.pdf

Tuesday 16 September

13 Automatic integration between Cowrie and MISP using Dissect

Speaker: Andreia Ocănoaia (National University of Science and Technology POLITEHNICA Bucharest (RO))

14 Websites scanning using nuclei and automatic incident generation in DFIR-IRIS

Speaker: Darius Mihai (National University of Science and Technology POLITEHNICA Bucharest (RO))

15 Opensearch

10:30 Break

16 Zeek in UPB - PoC

Speaker: Stefan Jumărea (National University of Science and Technology POLITEHNICA Bucharest (RO))

17 Zeek builds, updates and documentation

• Update Zeek builds and current documentation (add feature builds as well?)
• Upgrade cycles for key components
  • When to upgrade Zeek?

Speaker: Liviu Valsan (CERN)

12:30 Lunch

18 Validation tests & exercises

15:30 Break

19 Breakout Room 1

20 Breakout Room 2

21 SOC Employee journey (on-boarding, mentoring, career path, evaluation)

• Document lifecycle of a SOC Analyst

Speaker: Andreea Grama

22 SOC Analysis

• Establish plan to share Zeek scripts (common repo?)
• Users of a SOC service: reporting lines: creating dashboards and interfaces for responders and analysts
  • Including reporting for management and interoperating

19:00 Workshop dinner

10 minutes walk from Izvor or Piața Unirii metro stations.

Wednesday 17 September

23 Breakout Room 2

24 Integrations with FIR/Velociraptor

Speaker: Liviu Valsan (CERN)

25 Performance monitoring and tuning

• OpenSearch
• Zeek
• Data Pipeline

10:30 Break

26 Breakout Room 1

27 Breakout Room 2

28 Wrap Up

12:30 Lunch