<div><div dir="auto">This is great, thanks for sharing. </div></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Oct 19, 2019 at 1:01 PM Brian Dye <<a href="mailto:brian@corelight.com">brian@corelight.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">All,<div><br></div><div>Following up on my brief comments at ZeekWeek, happy to share that we've developed a mapping of Zeek fields to the Elastic Common Schema. It is posted at <a href="https://github.com/corelight/ecs-mapping" target="_blank">https://github.com/corelight/ecs-mapping</a> - looking forward to feedback and of course if there are any issues let us know (big thanks to Richard, cc'd above, for his work as the first deployment!). We'll work to update this as the ECS revs - there are several field they don't have in the schema yet. Happy mapping!</div><div><br></div><div>Best,</div><div><br></div><div>Brian</div></div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div></div>