move zeek bpf from zeek pillar to bpf pillar

salt/bpf/defaults.yaml

@@ -1,4 +1,5 @@
 bpf:
-    pcap: []
-    suricata: []
-    zeek: []
+  pcap: []
+  suricata: []
+  zeek:
+    - ip or not ip

salt/bpf/soc_bpf.yaml

@@ -1,10 +1,13 @@
 bpf:
   pcap:
     description: List of BPF filters to apply to PCAP.
+    multiline: True
     helpLink: bpf.html
   suricata:
     description: List of BPF filters to apply to Suricata.
+    multiline: True
     helpLink: bpf.html
   zeek:
     description: List of BPF filters to apply to Zeek.
+    multiline: True
     helpLink: bpf.html

salt/bpf/zeek.map.jinja

@@ -0,0 +1,4 @@
+{% import_yaml 'bpf/defaults.yaml' as BPFDEFAULTS %}
+{% set BPFMERGED = salt['pillar.get']('bpf', BPFDEFAULTS.bpf, merge=True) %}
+
+{% set ZEEKBPF = BPFMERGED.zeek %}