From 165e69cd11398d351af5a4a0162ce2652fb7e549 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Mon, 23 Mar 2026 07:52:36 -0400
Subject: [PATCH] Add support for websockets

---
 salt/elasticsearch/files/ingest/zeek.websocket | 18 ++++++++++++++++++
 salt/soc/defaults.yaml                         | 12 ++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 salt/elasticsearch/files/ingest/zeek.websocket

diff --git a/salt/elasticsearch/files/ingest/zeek.websocket b/salt/elasticsearch/files/ingest/zeek.websocket
new file mode 100644
index 000000000..3f93f1cc3
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.websocket
@@ -0,0 +1,18 @@
+{
+  "description" : "zeek.websocket",
+  "processors" : [
+    { "set":      { "field": "event.dataset",                           "value": "websocket" } },
+    { "remove":   { "field": ["host"],                                                          "ignore_failure": true    } },
+    { "json":     { "field": "message",                                 "target_field": "message2",                       "ignore_failure": true    } },
+    { "rename": 	{ "field": "message2.host",	                    "target_field": "websocket.host",		              "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.uri",	                    "target_field": "websocket.uri",		              "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.user_agent",	            "target_field": "websocket.user_agent",		          "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.subprotocol",	            "target_field": "websocket.subprotocol",		      "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.client_protocols",	    "target_field": "websocket.client_protocols",	      "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.client_extensions",	    "target_field": "websocket.client_extensions",	      "ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.server_extensions",	    "target_field": "websocket.server_extensions",	      "ignore_missing": true 	} },
+    { "remove":		{ "field": "message2.tags",		                                                                      "ignore_failure": true    } },
+    { "set":      { "field": "network.transport",                       "value": "tcp"  } },
+    { "pipeline":       { "name": "zeek.common" } }
+  ]
+}
diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index fcda86f63..8d01a1d17 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -584,6 +584,18 @@ soc:
         - destination.port
         - event.action
         - tunnel.type
+      '::websocket':
+        - soc_timestamp
+        - event.dataset
+        - source.ip
+        - source.port
+        - destination.ip
+        - destination.port
+        - websocket.host
+        - websocket.uri
+        - websocket.user_agent
+        - log.id.uid
+        - network.community_id
       '::weird':
         - soc_timestamp
         - event.dataset