Zeek (Bro) Workshop Europe 2019

Session

Workshop presentations

9 Apr 2019, 13:00

31/3-004 - IT Amphitheatre (CERN)

1. Opening remarks

Frederic Hemmer (CERN)

09/04/2019, 13:00

2. Keynote: Finding the balance between academic freedom, operations and security

Stefan Lueders (CERN)

09/04/2019, 13:10

3. How did we get here?

Prof. Vern Paxson (UC Berkeley / Corelight / ICSI)

09/04/2019, 14:00

4. Real time ingestion of MISP threat intel into Zeek coupled with historical SIEM threat hunting

Liviu Valsan (CERN), Dr Matthias Vallentin (Tenzir)

09/04/2019, 14:30

5. Looking Forward: On Supervisors, Packages, and Sandboxes

Robin Sommer (Corelight / ICSI / LBNL)

09/04/2019, 15:45

6. Email security auditing and alert triage with Zeek

Mr Barry Weymes

09/04/2019, 16:15

7. Running Zeek on the WAN: Experiences and solutions for large scale flow asymmetry

Scott Campbell (Unknown), Sam Oehlert

10/04/2019, 10:15

8. DNSSEC protocol parser - A case study

Ms Fatema Bannat Wala (University of Delaware)

10/04/2019, 10:45

9. The new Zeek Configuration Framework

Ms Amann Johanna (ICSI/Corelight/LBL)

10/04/2019, 11:15

11. Selective Packet Capture at High Speed Rates

Dr Jordi Ros-Giralt

10/04/2019, 13:15

10. Network Cartography Using Passive Traffic Analysis

Vivien Venuti

10/04/2019, 13:45

12. A deep dive into the Zeek logging framework

Christian Kreibich (Corelight)

10/04/2019, 14:15

13. DHCP Overhaul

Mr Seth Hall (Corelight)

10/04/2019, 15:30

14. JA3 and Windows hosts

Mr Jeff Atkinson (Verizon Media)

10/04/2019, 16:00

15. Using Zeek Endpoint Event Logs when Fishing within a Data Lake

Mr Tim Larson

10/04/2019, 16:30

16. Without “U” there is no CommUnity: Nurturing and growing an active and contributing community

Ms Amber Graner (Corelight)

11/04/2019, 09:00

17. Threat hunting @ Mozilla

Mr Michal Purzynski (Mozilla Corporation)

11/04/2019, 09:30

18. Q&A Session with the Zeek Team

11/04/2019, 10:00

19. Workshop Wrap up