Workshop Schedule

Speaker: Aashish Sharma is a member of the cyber security team at the Lawrence Berkeley National Lab. He is also a member of the Zeek Leadership Team.

This training is intended to build and enhance your understanding and proficiency in utilizing the Spicy parser generator. The material targets primarily a technical audience, but is open to anyone.

Topics:

• Basics of programming and parsing with Spicy
• Working with the Spicy documentation
• Using Spicy to create Zeek analyzers

Prerequisites:

• Familiarity with a programming/scripting language
• Basic familiarity with Zeek and its event model

Speaker: Benjamin Bannier works as a Senior Open Source Developer at Corelight where he spends most of his time maintaining and evolving Spicy and its integration into the Zeek ecosystem.

Bringing Situational Awareness into Zeek

Zeek is known for generating a wealth of valuable data, and one of its less commonly explored features, the Input Framework, enables the collection of real-time insights. This talk delves into the Input Framework, highlighting how various types of data can be seamlessly integrated into Zeek to enhance its analytical capabilities.

Containers, systemd, Prometheus: Running Zeek in 2026

This is a great talk for Zeek operators and system builders to get insight about modern appliance style Zeek deployments using systemd. No more Zeekctl cronjob to restart crashed Zeek processes or dealing with runaway Zeek processes. Straightforward resource controls and process confinement.

Plugin Development with Rust

Zeek is designed to be extensible with custom Zeek scripts or with plugins written against Zeek’s C++ API. In this talk I will speak about my journey implementing a custom Zeek serializer component with Rust, touching on everything from how I exposed Zeek’s C++ API to Rust, integration of Rust with Zeek’s plugin build system, to idiomatic mapping of Zeek C++ types to Rust.

The Road to 9.0: a Zeek Development Update

This talk gives an overview of the themes and priorities that have shaped recent Zeek releases, and looks ahead at the roadmap toward Zeek 9, our next long-term support release.