Workshop Schedule
Presentation materials will be shared with attendees after the event.
Day 1
Talks will take place in the Tamalpais Room. Coffee will be available beginning at 8:00am.
| Time | Topic & Speaker |
|---|---|
| 9:00 AM | Welcome & Opening Remarks Michelle Pathe A brief welcome to Zeek Workshop Berkeley 2026 – who is Zeek community, what to expect from the program, and how to make the most of your time in Berkeley. |
| 9:10 AM | Zeek 9 and Beyond Christian Kreibich With the release of Zeek 9, the Zeek development team’s work to move the cluster to a fully topic-based message routing system based on ZeroMQ is largely behind us, and we’ve embarked on new projects. This talk will recap the new features in Zeek 9 and provide an outline of the road ahead: an overhaul of our package manager and its package layouts, fresh ways to orchestrate your cluster, and more fine-grained control over analyzers parsing network flows, to name a few. You will walk away with an improved understanding of the Zeek team’s current priorities and milestones, recommended for Zeek users of all skill levels. |
| 9:30 AM | A Few Decades of Zeek and Network Monitoring Vern Paxson The evolution of Internet attacks and defenses has been full of surprises going all the way back to the 1990s. During this talk we’ll will survey facets of this landscape, particularly as seen through the lens of Zeek (originally “Bro”). |
| 10:15 AM | Break |
| 10:30 AM | From Packets to Practice: Running Zeek Operationally at NERSC Aaron Scantlin At NERSC, Zeek is not a research toy or a passive log generator. It is part of the daily operational fabric for understanding, defending, and troubleshooting one of the world’s leading scientific computing environments. This talk pulls back the curtain on how NERSC actually runs Zeek in production: where it fits in our visibility stack, what problems it helps us solve, how analysts use its data day to day, and what changes when the network carries massive scientific workflows instead of ordinary enterprise traffic. We’ll cover practical lessons from operating Zeek at scale, including deployment patterns, useful logs, detection workflows, noise management, enrichment, automation, and the gap between “we captured the traffic” and “this helped someone make a decision. Attendees will leave with concrete ideas, hard-earned lessons, and a clearer picture of Zeek as an operational tool for real production environments. |
| 11:00 AM | Driving Rapid Incident Response: Specialized Tooling on top of Zeek Peter Buffon Zeek is the cornerstone of security operations at Lawrence Berkeley National Laboratory, serving as our network flight recorder across multiple vantage points. However, raw Zeek logs alone cannot support incident response at scale—the LBNL Cyber Security team requires answers in seconds, even when searching through months of historical data. This talk explores the specialized tooling we built to augment Zeek: the data pipeline that moves and shapes our logs, ClickHouse and ioc-search for rapid indicator lookups, and Sumo Logic for complex queries and investigative workflows. |
| 11:30 AM | Running Zeek with AI: Is It Helping? Aashish Sharma Over the past year at Berkeley Lab we used LLM assistants in three domains of Zeek work: (i) writing detection scripts, (ii) debugging operational problems and (iii) forensics and incident response. The talk walks through each domain with specific examples. Where AI worked: drafting detection scripts, porting logic from other rule formats, generating hypotheses and instrumentation during a memory-bloat hunt, turning NIC and kernel documentation into an ordered tuning checklist (RSS, ring buffers, offloads, IRQ/NUMA affinity), and writing log queries and timelines during investigations. Where it failed: hallucinated event names and log fields, Bro/2.x-era syntax, invented configuration knobs, wrong root causes, and overconfident incident narratives. For each, we get into the backstory—basically how to get from slop to operations—so you don’t have to learn these lessons the hard way. |
| 12:00 PM | Hardening Zeek Monitors in Research & Education Environments Phuong Cao The attack surface against security monitors is rapidly evolving with new agentic AI and quantum-driven threats. This talk will describe our experience using AI Agent Harness to identify bugs that can affect production deployments of Zeek, which we worked with the Zeek team to fix, as well as analyses of parsers in underlying cryptographic libraries that can impair the visibility of quantum-resistant protocols. Finally, we will describe lessons learned from working with Zeek in testbeds in Research & Education environments, e.g., NCSA and FABRIC, and discuss future directions. |
| 12:30 PM | Lunch (offsite, 90 minutes) |
| 2:00 PM | How To Make Your Zeek Scripts Run Faster Vern Paxson In recent years Zeek has gained some powerful capabilities for improving the speed of its network analysis. I’ll give an overview of these as well as some scripting and other implementation techniques for improving your analysis performance. |
| 2:30 PM | Spicy and a Remote Code Execution Evan Typanski Zeek uses Spicy to simplify protocol parser development. This talk will go over the process of making a Spicy parser end-to-end: from a detection idea to implementation. The primary focus is on how to develop a Spicy protocol parser in order to get relevant security information for YOUR needs. |
| 3:00 PM | Zeek without ZeekControl Arne Welzel This talk will give an overview of the effort to provide a modern and easy to use Zeek deployment model for physical, virtual and containerized environments. Since version 8.1, Zeek includes support to generate systemd unit files for individual Zeek cluster processes. This represents an alternative to ZeekControl managed deployments. With version 9.0, this functionality will be extended to support multiple interfaces and include primitives for deploying multi-host Zeek clusters. There’s one new configuration file involved: zeek.conf. We’ll also sketch ideas for non-systemd environments and provide opportunities for feedback and discussions. |
| 3:30 PM | Break |
| 3:45 PM | Log Schema in Zeek Christian Kreibich Zeek’s logs are the main reason people use Zeek: a highly customizable, extensible way to concisely summarize network activity. Given the importance of logs to Zeek’s operation, it’s natural to ask questions about a given Zeek installation’s log schemas: which logs does Zeek generate? Will the update to the latest LTS release change my logs? What changes does this Zeek package make to my installation’s logs? In this talk I will walk you through Zeek’s logschema package, providing answers to these questions. You’ll learn about the various flavors of schemas the package can produce, how to work with those schemas to better understand your logs, and how to customize schema generation for advanced, site-specific needs. Nearly all of this functionality requires only simple Zeek command-line invocations, with minimal scripting. |
| 4:15 PM | Tales from the Black Hat NOC Mark Overholser This presentation will describe using Zeek and Suricata, two leading open-source NDR tools, to defend the Black Hat conference network globally. Through real-world stories, we will explore the clever strategies and techniques used to uncover threats and secure the network against a diverse set of threats. |
| 4:45 PM | Closing Remarks & Community CTA Michelle Pathe |
| 4:50 PM | Walk to reception |
| 5:00 PM | Reception at Cornerstone Craft Beer & Live Music |
Day 2
Training will take place in the Tamalpais Room. Coffee will be available beginning at 8:30am.
Beginner and Intermediate Zeek Topics
This year’s Zeek training is divided into two complementary sessions.
The first half, Introduction to Running Zeek , provides a practical foundation for deploying and operating Zeek. Participants will learn how to install Zeek, explore the broader Zeek ecosystem, and follow a step-by-step walkthrough of building and bringing a Zeek cluster online.
The second half, Hands-on Scripting , is an in-depth exploration of the Zeek scripting language. Designed for users who want to go beyond a standard deployment, this session focuses on developing custom Zeek scripts to extend Zeek’s capabilities and tailor detections and analysis to their specific environments.
| Time | Session |
|---|---|
| 9:00 AM | Intro & Setup |
| 9:15 AM | Introduction to Running Zeek |
| 10:45 AM | Break |
| 11:00 AM | Introduction to Running Zeek cont’d |
| 12:15 PM | Lunch (offsite) |
| 1:30 PM | Hands-on Scripting |
| 2:45 PM | Wrap-up & Q&A |
| 3:00 PM | End of Workshop |
Speakers
Vern Paxson
A Few Decades of Zeek and Network Monitoring and How To Make Your Zeek Run Faster
Vern Paxson is the creator of Zeek, co-founder and chief scientist at Corelight, and Professor of Computer Science at the University of California, Berkeley. A prolific and internationally-recognized researcher, Vern also leads the Networking and Security Group at the International Computer Science Institute and for decades held a position as a staff scientist at Lawrence Berkeley National Laboratory. His research interests include Internet measurement, high-performance network monitoring, detection algorithms, and combatting cybercrime, censorship, and abusive surveillance.
Christian Kreibich
Zeek 9 and Beyond and Log Schema in Zeek
Christian Kreibich is the Technical Lead of the Zeek project and an engineer at Corelight. He previously headed the networking group at Lastline, and prior to that was a staff research scientist at the International Computer Science Institute in Berkeley. He has served on the advisory board of the Open Information Security Foundation, and holds a PhD from the University of Cambridge’s Systems Research Group.
Aaron J. Scantlin
From Packets to Practice: Running Zeek Operationally at NERSC
Aaron J. Scantlin is the resident Zeek Geek at the National Energy Research Scientific Computing Center, where — together with ESnet and Lawrence Berkeley National Lab — he frequently discusses cluster management, network IOC detection, and more with his peers. With over 10 years in infosec, Aaron has given talks all over the world on various aspects of computer security — almost always informative, and never failing to entertain!
Pete Buffon
Driving Rapid Incident Response: Specialized Tooling on Top of Zeek
Pete Buffon is a member of the Berkeley Lab Cyber Security team, having joined the Lab in 2023. His work spans a wide range of security operations, with a particular focus on vulnerability management, incident response, and cloud security.
Phuong Cao
Hardening Zeek Monitors in Research & Education Environments
Phuong Cao is a Research Scientist at the National Center for Supercomputing Applications (NCSA) at the University of Illinois Urbana-Champaign (UIUC), where he earned his Ph.D. in Electrical and Computer Engineering. His research focuses on securing cyberinfrastructure, measuring post-quantum cryptography adoption, and building resilient AI systems across large-scale facilities (e.g., NCSA and FABRIC). He has worked with Zeek since 2012, focused on measurements, log analyses, and protocol-parsing improvements.
Mark Overholser
Tales from the Black Hat NOC
Mark Overholser is a Silicon Valley tech veteran with over ten years of experience. Since the spring of 2023, he has also been a threat hunter in the Black Hat conference Network Operations Center, participating in three Black Hat conferences globally each year (ten and counting!). His professional background includes roles as a Threat Hunter, Security Engineer, Incident Responder, and Information Security Team Lead for a multi-billion-dollar enterprise.
Evan Typanski
Spicy and a Remote Code Execution
Evan Typanski is a software engineer at Corelight, where he works as a maintainer for the Zeek project. His focus is on compilers and low level networking. Before joining Corelight, Evan worked on static code analysis (SAST) for languages like C/C++, Swift, and Rust. He graduated from the University of Virginia with a BS in Computer Science in 2020.
Arne Welzel
Zeek without ZeekControl
Arne Welzel is a software engineer on the Open Source team at Corelight with over 15 years of experience in network programming and packets. He works in various corners of Zeek’s code base and ecosystem.
Michelle Pathe
Michelle Pathe is the Community Liaison for the Zeek Project, where she works to grow and support the global Zeek open-source community. Based in Southern California, she joined the Zeek team in 2025 and has since organized community events, programs, and resources for security practitioners, network engineers, and researchers around the world.
Training Team
Training will take place on September 11 from 9am to 3pm and will cover beginner to intermediate topics.
Aashish Sharma
Aashish Sharma is a member of the Cyber Security Team at Lawrence Berkeley National Laboratory, where he has worked for the past fifteen years. With nearly 23 years of experience in security and incident response, his work focuses on intrusion detection and incident response. He is a member of the Zeek Leadership Team and has published approximately 19 papers in venues including USENIX and ACM.
Fatema Bannat Wala
Fatema Bannat Wala is a Security Engineer at ESnet/Lawrence Berkeley National Laboratory, where she focuses on network traffic monitoring, threat hunting, and incident response. She holds CISSP certification alongside multiple GIAC certifications and serves on the SANS/GIAC Advisory Board. Fatema is a member of the Zeek Leadership Team and a frequent speaker at FIRST events and the Trusted CI NSF Cybersecurity Summit.