add zeek.quic mappings

Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
2025-12-06 09:12:45 +01:00 · 2025-01-08 16:18:53 -06:00
parent 5969e9accc
commit 0e87351a9c
1 changed files with 26 additions and 0 deletions
--- a/salt/elasticsearch/templates/component/ecs/zeek.json
+++ b/salt/elasticsearch/templates/component/ecs/zeek.json
@@ -1172,6 +1172,32 @@
                }
              }
            },
+            "quic": {
+              "type": "object",
+              "properties": {
+                "server_name": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "short"
+                },
+                "client_initial_dcid": {
+                  "type": "keyword"
+                },
+                "client_scid": {
+                  "type": "keyword"
+                },
+                "server_scid": {
+                  "type": "keyword"
+                },
+                "client_protocol": {
+                  "type": "keyword"
+                },
+                "history": {
+                  "type": "keyword"
+                }
+              }
+            },
            "radius": {
              "properties": {
                "connect_info": {