Zero to Zeek: Build a Network Sensor Fast and Easy w/ Troy Wojewoda

This webcast introduces Zeek, an open-source network security monitoring tool, and demonstrates how to deploy it using Docker for low-barrier entry, even for users with limited Linux experience.

Key Takeaways:
• Zeek provides deep packet inspection and metadata collection, offering a complementary "bird's-eye view" to endpoint telemetry for superior threat detection and audit capabilities 1:40.
• The "Zero to Zeek" approach utilizes a Docker-based deployment script requiring only a few commands to stand up a sensor, bypassing complex source code compilation 2:15.
• Customizations and persistence are managed via specific mount points and autoload directories, ensuring configurations survive container restarts 3:20.
• Upcoming workshops and training classes are announced to help attendees master Zeek log analysis and network traffic analysis fundamentals 0:27.

This session serves as a practical guide for security professionals looking to establish network visibility with minimal infrastructure friction.

Sources:

• 0:00 Introduction to the Black Hills Information Security webcast.
• 0:16 Introduction of speaker Troy Woji and his topic.
• 0:21 Discussion on the utility of introductory content.
• 1:40 Explanation of Zeek's value in network security monitoring.
• 2:15 Overview of the "Zero to Zeek" Docker deployment method.
• 3:20 Details on persistence, customization, and log management.