Elastic Common Schema mapping
Brian Dye <[email protected]> Sat, 19 Oct 2019 12:52:32 -0700
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAEC=iOvTurux2ykB+XnWqihWOddGqZWbV2CP5LR_SktE6WAEyA@mail.gmail.com> |
All, Following up on my brief comments at ZeekWeek, happy to share that we've developed a mapping of Zeek fields to the Elastic Common Schema. It is posted at https://github.com/corelight/ecs-mapping - looking forward to feedback and of course if there are any issues let us know (big thanks to Richard, cc'd above, for his work as the first deployment!). We'll work to update this as the ECS revs - there are several field they don't have in the schema yet. Happy mapping! Best, Brian _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek