Mapping changes in Zeek (Bro) parser

This document describes the changes made in the Zeek (Bro) default parser on 2022-09-28.

The Zeek (Bro) default parser update on 2022-09-28 uses the logs as defined in the official Zeek documentation.

The following table lists the field mapping changes between the Zeek (Bro) parser previous versions and Zeek (Bro) default parser version 2022-09-28:

Log type	Fields	Mapping in previous version	Mapping in default parser version 2022-09-28
ssl	server_name	target.hostname	network.tls.client.server_name
	ja3	network.tls.client.ja3	Not mapped.
	ja3s	network.tls.server.ja3s	Not mapped.
		metadata.description is set to "SSL/TLS handshake info"	Not mapped.
ssh	client	network.tls.client.certificate.version	principal.platform_version
	server	network.tls.server.certificate.version	target.platform_version
	host_key	target.labels	about.labels
	host_key_alg	target.labels	about.labels
	kex_alg	target.labels	about.labels
	mac_alg	target.labels	about.labels
	compression_alg	target.labels	about.labels
	cipher_alg	target.labels	about.labels
	auth_attempts	target.labels	about.labels
	auth_success	security_result.action	about.labels
	event_type	metadata.event_type is set to "NETWORK_CONNECTION"	metadata.event_type is set to "NETWORK_UNCATEGORIZED"
http		network.application_protocol is set to "HTTP"	Not mapped.
files	received_bytes	network.received_bytes	target.file.size
dhcp	domain	principal.administrative_domain	target.administrative_domain
	dhcp_info	network.dhcp.type
smb_files	action	metadata.description	metadata.description" is set to "action: %{action} on: %{name}"
		network.application_protocol is set to "SMB"	Not mapped.
kerberos	user_name	principal.user.userid	Not mapped.
	user_email	principal.user.email_addresses	Not mapped.
	event_type	metadata.event_type is set to "GENERIC_EVENT"	metadata.event_type is set to "NETWORK_CONNECTION"
ftp	uid	metadata.product_log_id	Not mapped.
	file_size	principal.file.size	src.file.size
x509	event_type	metadata.event_type is set to "NETWORK_UNCATEGORIZED"	metadata.event_type is set to "GENERIC_EVENT"
	id	metadata.product_log_id	Not mapped.
	_system_name	principal.hostname	Not mapped.
smb_mapping	path	target.resource.name	target.file.full_path
		network.application_protocol is set to "SMB"	Not mapped.
nltm		metadata.description is set to "NTLM"	Not mapped.
dce_rpc		metadata.description is set to "DCE_RPC"	Not mapped.
		network.application_protocol is set to "RPC"	Not mapped.
tunnel		metadata.description is set to "Tunnel"	Not mapped.
	tunnel_type	additional.fields	security_result.description
	action	additional.fields	security_result.description
mysql	event_type	metadata.event_type" is set to "NETWORK_CONNECTION"	metadata.event_type" is set to "NETWORK_UNCATEGORIZED"
		metadata.description is set to "MYSQL"	Not mapped.
	cmd	additional.fields	metadata.description
	arg	additional.fields	principal.process.command_line
	rows	additional.fields	security_result.description
radius		extensions.auth.type is set to "AUTHTYPE_UNSPECIFIED"	Not mapped.