This session will introduce a new open source tool written by Keith Jones, Sr. Security Researcher from Coreilght Labs, that will take Zeek logs and import them into Elasticsearch. From there, researchers are able to quickly and easily search for security events. Two benefits of zeek2es are a) no user intervention is required when Zeek log formats change, and b) no additional Python libraries are required. Please attend this talk if you are interested in seeing how Elasticsearch was used to solve common researcher tasks of dealing with many TB's of gzipped ASCII Zeek logs.
