Cybersecurity

Zeek Workshop Berkeley 2026

This workshop brings together Zeek developers, core contributors, and practitioners from across the community for two days of technical talks, hands-on training, and conversations about Zeek in real-world applications. Attendees include those running Zeek in production, professionals in incident response and network security monitoring, and newcomers seeking…

Visit the official site
11Speakers
1Sponsors
96On the bill · sessions
9Companies · in total
§I

Speakers

Programmed at Zeek, in alphabetical order.
Aaron J. Scantlin
Zeek Geek · National Energy Research Scientific Computing Center
Aaron Scantlin
Resident Zeek Geek at NERSC · NERSC
Aashish Sharma
Member of the Cyber Security Team · Lawrence Berkeley National Laboratory
Arne Welzel
Software Engineer on Open Source team at Corelight · Corelight
Christian Kreibich
Technical Lead of Zeek project and engineer at Corelight · Corelight
Evan Typanski
Software Engineer at Corelight · Corelight
Fatema Bannat Wala
Security Engineer · ESnet/Lawrence Berkeley National Laboratory
Mark Overholser
Threat Hunter in Black Hat Conference NOC · Black Hat NOC
Michelle Pathe
Community Liaison for the Zeek Project · Zeek Project
Vern Paxson
Co-founder and chief scientist at Corelight; Professor of Computer Science at University of California, Berkeley · Corelight / University of California, Berkeley
Zach Chadwick
Software Engineer at QA Cafe · QA Cafe
§II

Sponsors

The houses behind the program. Tiers as disclosed.
Corelight
§III

Agenda

Selected from 96 sessions on the bill.
  • 10:15 AM

    Speaker and topic to be announced soon!

  • 10:45 AM

    Beyond conn.log: What We Learned Feeding Zeek Logs to an LLM

  • 10:45 AM

    Break

    Training
  • 10:45 AM

    Speaker and topic to be announced soon!

  • 11:00 AM

    Introduction to Running Zeek cont’d

    Training
  • 11:15 AM

    From Packets to Practice: Running Zeek Operationally at NERSC

  • 12:00 PM

    Lunch

    Lunch (offsite, 90 minutes)

  • 12:15 PM

    Lunch

    Lunch (offsite)

    Training
  • 1:30 PM

    Hands-on Scripting

    An in-depth exploration of the Zeek scripting language. Designed for users who want to go beyond a standard deployment, this session focuses on developing custom Zeek scripts to ex…

    Training
Intermission
Part the Second · For the Buyer

What does it mean when 9 companies show up, and 1 bet on three roles at once?

Nine companies. one are betting more than once.

The numbers below are derived from the speakers, sponsors, and exhibitors on this page, cross-referenced into one ledger. They are the only thing here that 10times.com cannot tell you.

Who's in the room
1All threespeak · spons · exh
0Sponsoringsponsor only
8Companies Speakingspeaker only

The Triple-Threat

Corelight

Speakers by seniority

9% of the speakers carry senior titles: C-suite, Founder, VP, or Director-level.

  • C-suite19%
  • Manager / Lead19%
  • Engineer · IC436%
  • Other roles545%

Of 11 on the bill · classified by free-text title

Most-represented companies
  1. 01CorelightSp3V
  2. 02Black Hat NOC1V
  3. 03Corelight / University of California, Berkeley1V
  4. 04ESnet / Lawrence Berkeley National Laboratory1V
  5. 05Lawrence Berkeley National Laboratory1V
  6. 06National Energy Research Scientific Computing Center1V
  7. 07NERSC1V
  8. 08QA Cafe1V
  9. 09Zeek Project1V
Sponsors by tier
unspecified1
100% of 1