ZeekWeek 2022 - Filtering Logs Like a Pro - Justin Azoff
By Justin Azoff, Principal Staff Engineer, Corelight
Zeek logs can often be overwhelming. Fortunately the zeek logging framework provides a ton of ways to reduce the amount of data being logged. You can route uninteresting log lines to different files, or drop them entirely. You can create separate log streams containing a small subset of particularly interesting logs. You can exclude individual fields in large logs if you don’t make use of them. You can do all of this dynamically using all the capabilities of the Zeek scripting language.