diff --git a/salt/elasticsearch/files/ingest/suricata.common b/salt/elasticsearch/files/ingest/suricata.common
index 6e956d196..4dea07b8b 100644
--- a/salt/elasticsearch/files/ingest/suricata.common
+++ b/salt/elasticsearch/files/ingest/suricata.common
@@ -1,19 +1,20 @@
 {
   "description" : "suricata.common",
   "processors" : [
-    { "json":           { "field": "message",                   "target_field": "message2",             "ignore_failure": true  } },
-    { "rename":{ "field": "message2.proto",		"target_field": "network.transport",		"ignore_failure": true 	} },
-    { "rename":{ "field": "message2.flow_id",		"target_field": "log.id.uid",		"ignore_failure": true 	} },
-    { "rename":{ "field": "message2.src_ip",       "target_field": "source.ip",  "ignore_failure": true  } },
-    { "rename":{ "field": "message2.src_port",       "target_field": "source.port",  "ignore_failure": true  } },
-    { "rename":{ "field": "message2.dest_ip",       "target_field": "destination.ip",  "ignore_failure": true  } },
-    { "rename":{ "field": "message2.dest_port",       "target_field": "destination.port",  "ignore_failure": true  } },
-    { "rename":         { "field": "message2.community_id",        "target_field": "network.community_id",     "ignore_missing": true  } },
-    { "set":         { "field": "event.dataset",        "value": "{{ message2.event_type }}"  } },
-    { "set":         { "field": "observer.name",        "value": "{{agent.name}}"  } },
-    { "set":         { "field": "event.ingested",        "value": "{{@timestamp}}"  } },
+    { "json":	{ "field": "message",			"target_field": "message2",		"ignore_failure": true  } },
+    { "rename":	{ "field": "message2.proto",		"target_field": "network.transport",	"ignore_failure": true 	} },
+    { "rename":	{ "field": "message2.flow_id",		"target_field": "log.id.uid",		"ignore_failure": true 	} },
+    { "rename":	{ "field": "message2.src_ip",		"target_field": "source.ip",		"ignore_failure": true  } },
+    { "rename":	{ "field": "message2.src_port",		"target_field": "source.port",		"ignore_failure": true  } },
+    { "rename":	{ "field": "message2.dest_ip",		"target_field": "destination.ip",	"ignore_failure": true  } },
+    { "rename":	{ "field": "message2.dest_port",	"target_field": "destination.port",	"ignore_failure": true  } },
+    { "rename":	{ "field": "message2.vlan",		"target_field": "network.vlan.id",	"ignore_failure": true  } },
+    { "rename":	{ "field": "message2.community_id",	"target_field": "network.community_id",	"ignore_missing": true  } },
+    { "set":	{ "field": "event.dataset",		"value": "{{ message2.event_type }}"  				} },
+    { "set":	{ "field": "observer.name",		"value": "{{agent.name}}"  					} },
+    { "set":	{ "field": "event.ingested",		"value": "{{@timestamp}}"  					} },
     { "date": { "field": "message2.timestamp", "target_field": "@timestamp", "formats": ["ISO8601", "UNIX"], "timezone": "UTC", "ignore_failure": true } },
-    { "remove":{ "field": "agent", 						"ignore_failure": true	} },
+    { "remove":{ "field": "agent", 								"ignore_failure": true	} },
     { "pipeline": { "if": "ctx?.event?.dataset != null", "name": "suricata.{{event.dataset}}" } }
   ]
 }
diff --git a/salt/elasticsearch/files/ingest/zeek.conn b/salt/elasticsearch/files/ingest/zeek.conn
index 73ce29c1d..8b458e032 100644
--- a/salt/elasticsearch/files/ingest/zeek.conn
+++ b/salt/elasticsearch/files/ingest/zeek.conn
@@ -2,27 +2,28 @@
   "description" : "zeek.conn",
   "processors" : [
     { "set": { "field": "event.dataset", "value": "conn" } },
-    { "remove":         { "field": ["host"],     "ignore_failure": true                                                              } },
-    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "remove":         { "field": ["host"],     								"ignore_failure": true	} },
+    { "json":		{ "field": "message",			"target_field": "message2",			"ignore_failure": true	} },
     { "rename": 	{ "field": "message2.proto", 		"target_field": "network.transport",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.service", 		"target_field": "network.protocol",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.duration", 	"target_field": "event.duration",		"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.orig_bytes", 	"target_field": "client.bytes",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.resp_bytes", 	"target_field": "server.bytes",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.conn_state", 	"target_field": "connection.state",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.local_orig", 	"target_field": "connection.local.originator",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.orig_bytes", 	"target_field": "client.bytes",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.resp_bytes", 	"target_field": "server.bytes",			"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.conn_state", 	"target_field": "connection.state",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.local_orig", 	"target_field": "connection.local.originator",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.local_resp", 	"target_field": "connection.local.responder",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.missed_bytes", 	"target_field": "connection.bytes.missed",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.missed_bytes", 	"target_field": "connection.bytes.missed",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.history", 		"target_field": "connection.history",		"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.orig_pkts", 	"target_field": "client.packets",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.orig_ip_bytes", 	"target_field": "client.ip_bytes",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.resp_pkts", 	"target_field": "server.packets",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.resp_ip_bytes", 	"target_field": "server.ip_bytes",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.orig_mac_oui", 	"target_field": "client.oui",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.orig_pkts", 	"target_field": "client.packets",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.orig_ip_bytes", 	"target_field": "client.ip_bytes",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.resp_pkts", 	"target_field": "server.packets",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.resp_ip_bytes", 	"target_field": "server.ip_bytes",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.orig_mac_oui", 	"target_field": "client.oui",			"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.tunnel_parents",	"target_field": "log.id.tunnel_parents",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.orig_cc", 		"target_field": "client.country_code","ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.resp_cc", 		"target_field": "server.country_code",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.orig_cc", 		"target_field": "client.country_code",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.resp_cc", 		"target_field": "server.country_code",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.sensorname", 	"target_field": "observer.name",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.vlan", 		"target_field": "network.vlan.id",		"ignore_missing": true 	} },
     { "script":         { "lang": "painless", "source": "ctx.network.bytes = (ctx.client.bytes + ctx.server.bytes)", "ignore_failure": true } },
     { "set": { "if": "ctx.connection?.state == 'S0'",    "field": "connection.state_description", "value": "Connection attempt seen, no reply" } },
     { "set": { "if": "ctx.connection?.state == 'S1'",    "field": "connection.state_description", "value": "Connection established, not terminated" } },
diff --git a/salt/kibana/files/live_query_fixup.sh b/salt/kibana/files/live_query_fixup.sh
index 5026e3a16..9a03683db 100644
--- a/salt/kibana/files/live_query_fixup.sh
+++ b/salt/kibana/files/live_query_fixup.sh
@@ -13,10 +13,10 @@ docker exec so-kibana grep -q "https://{{ GLOBALS.url_base }}" /usr/share/kibana
 if [ $? -eq 0 ]
 then
   #Do Nothing, pattern has been found
-  echo "Pattern found, exiting..."
+  echo "SO Hunt link found, exiting without changes..."
 else
-  echo "Pattern not found..."
-  docker exec so-kibana sed -i 's|href:h|href:"https://{{ GLOBALS.url_base }}/#/hunt?q=action_id%3A%20"+e+"%20%7C%20groupby%20action_id%20action_data.query%20%7C%20groupby%20host.hostname%20%22metadata.input.beats.host.ip%22"|g' /usr/share/kibana/x-pack/plugins/osquery/target/public/osquery.chunk.0.js
+  echo "SO Hunt link not found, adding link and restarting Kibana container..."
+  docker exec so-kibana sed -i 's|href:g|href:"https://{{ GLOBALS.url_base }}/#/hunt?q=action_id%3A%20"+e+"%20%7C%20groupby%20action_id%20action_data.query%20%7C%20groupby%20host.hostname%20%22metadata.input.beats.host.ip%22"|g' /usr/share/kibana/x-pack/plugins/osquery/target/public/osquery.chunk.0.js
   docker exec so-kibana sed -i 's|View in Discover|View in SO - Hunt|g' /usr/share/kibana/x-pack/plugins/osquery/target/public/osquery.chunk.0.js
   docker exec so-kibana rm /usr/share/kibana/x-pack/plugins/osquery/target/public/osquery.chunk.0.js.br
   docker exec so-kibana gzip -kf /usr/share/kibana/x-pack/plugins/osquery/target/public/osquery.chunk.0.js
diff --git a/salt/kibana/init.sls b/salt/kibana/init.sls
index a974dcf48..ba1413c74 100644
--- a/salt/kibana/init.sls
+++ b/salt/kibana/init.sls
@@ -108,6 +108,12 @@ append_so-kibana_so-status.conf:
     - name: /opt/so/conf/so-status/so-status.conf
     - text: so-kibana
 
+osquery_hunt_link:
+  cmd.script:
+    - source: salt://kibana/files/live_query_fixup.sh
+    - cwd: /root
+    - template: jinja
+
 {% else %}
 
 {{sls}}_state_not_allowed:
diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 9a468902c..3fe2f4567 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1555,6 +1555,9 @@ soc:
           - name: Firewall
             description: Firewall logs
             query: 'event.dataset:firewall | groupby -sankey rule.action interface.name | groupby rule.action | groupby interface.name | groupby network.transport | groupby source.ip | groupby destination.ip | groupby destination.port'
+          - name: VLAN
+            description: VLAN (Virtual Local Area Network) tagged logs
+            query: '* AND _exists_:network.vlan.id | groupby network.vlan.id | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby event.dataset | groupby event.module | groupby observer.name | groupby source.geo.country_name | groupby destination.geo.country_name'
       job:
       alerts:
         advanced: false
diff --git a/salt/zeek/defaults.yaml b/salt/zeek/defaults.yaml
index ec3eef3a2..18e8a4d8a 100644
--- a/salt/zeek/defaults.yaml
+++ b/salt/zeek/defaults.yaml
@@ -37,6 +37,7 @@ zeek:
         - protocols/ftp/detect
         - protocols/conn/known-hosts
         - protocols/conn/known-services
+        - protocols/conn/vlan-logging
         - protocols/ssl/known-certs
         - protocols/ssl/validate-certs
         - protocols/ssl/log-hostcerts-only