Skip to content

Commit 5017e37

Browse files
jpipkin1kimsauce
andauthored
Update docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek.md
Co-authored-by: Kim (Sumo Logic) <[email protected]>
1 parent 6e3f974 commit 5017e37

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ After configuring the appropriate source, use one of the methods described below
6363

6464
This configuration step is required to ensure that Cloud SIEM knows how to parse incoming Zeek logs, correctly map the log fields to schema attributes, and create Cloud SIEM records. The most important bit of information is what type of data a particular log contains. Zeek has a variety of log types, for example `conn` for TCP/UDP/ICMP connections, `http` for HTTP requests and replies, and `ftp` for FTP activity.
6565

66-
So, how to determine whether a Zeek log is a `conn`, `http`, `ftp`, or some other log type? Zeek logs don’t contain a key that explicitly holds a value that is only the log type identifier. There are two options for dealing with this:
66+
So, how to determine whether a Zeek log is a `conn`, `http`, `ftp`, or some other log type? Zeek logs do not contain a key that explicitly holds a value that is only the log type identifier. There are two options for dealing with this:
6767

6868
* Use Corelight to add a field to each Zeek log that identifies its log type. See [Use Corelight](#use-corelight) below.
6969
* Use Sumo Logic Field Extraction Rules (FERs) to create fields that provide the log type and other data that enables Cloud SIEM to parse and map the logs. See [Use FERs](#use-fers).

0 commit comments

Comments
 (0)