[Zeek] Elastic Common Schema mapping
damonrouse at gmail.com
Sat Oct 19 13:08:02 PDT 2019
This is great, thanks for sharing.
On Sat, Oct 19, 2019 at 1:01 PM Brian Dye <brian at corelight.com> wrote:
> Following up on my brief comments at ZeekWeek, happy to share that we've
> developed a mapping of Zeek fields to the Elastic Common Schema. It is
> posted at https://github.com/corelight/ecs-mapping - looking forward to
> feedback and of course if there are any issues let us know (big thanks to
> Richard, cc'd above, for his work as the first deployment!). We'll work to
> update this as the ECS revs - there are several field they don't have in
> the schema yet. Happy mapping!
> Zeek mailing list
> zeek at zeek.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Zeek