ZeekWeek 2022 - Fun and Games with Zeek Metadata - Steve Smoot
Channel: Zeek
Date: 2022-11-17

By Steve Smoot, Vice President – Customer Success, Corelight

Interestingly, the Zeek project not only contains the code to build Zeek, but tools to read the source itself to generate documentation for the project.  This package uses these tools to create site-specific docs, so you can know exactly what your installation/configuration will produce.  Further we can create props.conf and transforms.conf files automatically so that Splunk will better understand the logs.  Next up is to extend this to auto generation of Avro schemas to aid Hadoop (and other) ingest pipelines.

Speaker Bio: Steve Smoot has been in and out of open source since coding for his Computer Science PhD at UC Berkeley in the 1990s and has been working in networking since 2000.  Presently he is Corelight’s VP of Customer Success, where he focuses on building technical teams to enable Customers to achieve their goals with Zeek. Formerly, he played a catalytic role at Riverbed, scaling from 10 to 2600 people, and before that brought the FastForward Networks technology and how-to to Europe for Inktomi. Previously, he developed video compression technology that enables the video streams we all watch every night. Dr. Smoot is a graduate of MIT and holds a PhD in Computer Science from the University of California at Berkeley.