Incident Response & Threat Hunting Using Bro/Zeek Data

Open-source Zeek's network security monitor is a valuable tool for threat hunters and incident responders. This talk will show how to use this data to reduce the time it takes to find attackers in your network. Advanced users can also use Zeek's scripting language, which allows them to create flexible, powerful detection logic that goes above traditional IDS signatures.