An Introduction to Threat Hunting With Zeek (Bro)

An introductory overview of the threat hunting capabilities of the Zeek Network Security Monitor (formerly known as Bro), with demos of sample threat hunting queries in Elastic and guidance on how to get started with Zeek in your own environment, The panelists on this webcast, Richard Chitamitre, Jonathon Hall, and Andrew Pease, are all elite threat hunters with years of military service fighting on the cyberwarfare frontlines and using Zeek to hunt down attackers. Presented by Corelight and Perched.

Corelight makes powerful network security monitoring (NSM) solutions that transform network traffic into rich logs, extracted files, and security insights, helping security teams achieve more effective incident response, threat hunting, and forensics. Corelight Sensors run on Zeek (formerly called “Bro”), the open-source NSM tool used by thousands of organizations worldwide. Corelight’s family of network sensors dramatically simplify the deployment and management of Zeek and expand its performance and capabilities. Corelight is based in San Francisco, California and its global customers include Fortune 500 companies, large government agencies, and major research universities.