Zeek Scripting¶
Presented at NTU — 13 April 2026.
This presentation introduces Zeek Scripting — a domain-specific, event-driven language designed specifically for network security monitoring. It provides capabilities for customizing log modifications, building detection logic, and enabling intelligence and data enrichment.
The demonstration features a practical SSH tracking lab that detects failed login attempts, logs the originating attacker IP addresses, and automatically drops any future connections from those IPs.