Re: Elastic Common Schema mapping

This is great, thanks for sharing.

On Sat, Oct 19, 2019 at 1:01 PM Brian Dye <[email protected]> wrote:

> All,
>
> Following up on my brief comments at ZeekWeek, happy to share that we've
> developed a mapping of Zeek fields to the Elastic Common Schema.  It is
> posted at https://github.com/corelight/ecs-mapping - looking forward to
> feedback and of course if there are any issues let us know (big thanks to
> Richard, cc'd above, for his work as the first deployment!). We'll work to
> update this as the ECS revs - there are several field they don't have in
> the schema yet. Happy mapping!
>
> Best,
>
> Brian
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek