VAST Demo by Matthias Vallentin
Channel: Zeek
Date: 04/09/2014

Visibility Across Space and Time (VAST) is a platform for large-scale network forensics, especially suitable for interactive incident response. It offers a rich-typed query language to facilitate finding needles in haystacks. VAST has first-class support for Bro: it imports logs natively and can also generate query results as Bro logs in addition to JSON. The current prototype can search hundreds of millions of events with interactive response times on a single machine. This talk first sketches the architecture briefly and then gives a demonstration how to use the system.