Corelight Zeek Parsing Rules

Parsing Rule

Corelight Zeek

Details

IDCorelight_Zeek_ParsingRule
From Version6.10.0

Rules (XQL)

[INGEST:vendor="corelight", product="zeek", target_dataset="corelight_zeek_raw", no_hit=keep]
filter to_string(ts) ~= ".*\d{2}:\d{2}:\d{2}.*"
| alter _time = ts;