BSidesSF 2020

Event locked in Sched to limit confusion, see registration to determine current session availability.
Event held offsite, location to be announced (NOT METREON!)
Registration at https://bsidessf.regfox.com/2020 REQUIRED (cannot be reserved with Sched)

During this hands-on workshop we will introduce Zeek and the Elastic Stack and teach you how to use both tools together. We will focus on on Threat Hunting and Incident Response using Kibana and MITRE ATT&CK™. We will conclude with a capstone capture-the-flag exercise where you will be using Kibana and Zeek data to hunt real-world threats in modern APT scenarios. At the conclusion, we’ll review the scenarios, answer questions, and recognize our CTF winners.

Zeek (formerly Bro) is an open-source network security monitoring tool that SOCs use to correlate events and find relevant data. The Elastic SIEM is commonly used by security analysts to aggregate and analyze security events, including network security monitoring data. The integration between Zeek and Elastic allows defenders to easily ingest and analyze events on their network.