We’re running a hands-on Zeek workshop at Nullcon Berlin 2026 on November 5! This 90-minute session covers how to get started with Zeek, work with its logs, and customize it with packages and your own scripts.
Abstract
Network monitoring is key for understanding your IT infrastructure, whether that’s your home network or a thousand-seat corporate environment. The open-source community offers a range of interesting projects for this task. The Zeek network monitor is a mature, BSD-3-licensed open-source project that turns the packets in your network into actionable log data streams. Highly extensible via its own scripting language and JavaScript, and powered by an open ecosystem of add-on packages, plugins, and protocol parsers, Zeek is used widely across the industry to provide mission-critical network intelligence to incident responders, threat analysts, and network operators.
In this workshop we’ll give an overview of popular open-source projects in the field, explain how Zeek fits into this ecosystem, and show you how to get started. You’ll learn how to run production Zeek clusters, work its logs, and customize it via third-party packages and your own scripts. Whether you’re a technical person curious to learn more about your network, or interested in our decades-long experience with open-source stewardship in network security, this session offers lessons learned for everyone.
To participate in this hands-on workshop, bring your laptop! We require a Linux, Mac, or Windows installation running Docker or Docker Desktop.
What to bring
This is a hands-on workshop, so bring your laptop. You’ll need a Linux, Mac, or Windows installation running Docker or Docker Desktop.
About Nullcon Berlin
Nullcon is a research-led, community-powered cybersecurity platform connecting researchers, hackers, practitioners, and security leaders through conferences, hands-on training, CTFs, and original security research. The Berlin conference runs November 5-6, 2026.
Learn more: Meet Zeek, the scriptable open-source network monitor