ZeekWeek 2022 - Filtering Logs Like a Pro - Justin Azoff
Channel: Zeek
Date: 2022-11-15

By Justin Azoff, Principal Staff Engineer, Corelight

Zeek logs can often be overwhelming.  Fortunately the zeek logging framework provides a ton of ways to reduce the amount of data being logged.  You can route uninteresting log lines to different files, or drop them entirely.  You can create separate log streams containing a small subset of particularly interesting logs.  You can exclude individual fields in large logs if you don’t make use of them.  You can do all of this dynamically using all the capabilities of the Zeek scripting language.