filebeat:
  config:
  zeek_logs_enabled:
    - conn
    - dce_rpc
    - dhcp
    - dnp3
    - dns
    - dpd
    - files
    - ftp
    - http
    - intel
    - irc
    - kerberos
    - modbus
    - mysql
    - notice
    - ntlm
    - pe
    - radius
    - rfb
    - rdp
    - sip
    - smb_files
    - smb_mapping
    - smtp
    - snmp
    - socks
    - ssh
    - ssl
    - tunnel
    - weird
    - x509
    - bacnet
    - bacnet_discovery
    - bacnet_property
    - cip
    - cip_io
    - cip_identity
    - cotp
    - dnp3_objects
    - ecat_registers
    - ecat_log_address
    - ecat_dev_info
    - ecat_aoe_info
    - ecat_coe_info
    - ecat_foe_info
    - ecat_soe_info
    - ecat_arp_info
    - enip
    - modbus_detailed
    - modbus_mask_write_single_register
    - modbus_read_write_multiple_registers
    - opcua
    - opcua_activate_session
    - opcua_activate_session_client_software_cert
    - opcua_activate_session_diagnostic_info
    - opcua_activate_session_locale_id
    - opcua_binary
    - opcua_binary_activate_session
    - opcua_binary_activate_session_client_software_cert
    - opcua_binary_activate_session_diagnostic_info
    - opcua_binary_activate_session_locale_id
    - opcua_binary_browse
    - opcua_binary_browse_description
    - opcua_binary_browse_diagnostic_info
    - opcua_binary_browse_request_continuation_point
    - opcua_binary_browse_response_references
    - opcua_binary_browse_result
    - opcua_binary_create_session
    - opcua_binary_create_session_discovery
    - opcua_binary_create_session_endpoints
    - opcua_binary_create_session_user_token
    - opcua_binary_create_subscription
    - opcua_binary_diag_info_detail
    - opcua_binary_get_endpoints
    - opcua_binary_get_endpoints_description
    - opcua_binary_get_endpoints_discovery
    - opcua_binary_get_endpoints_locale_id
    - opcua_binary_get_endpoints_profile_uri
    - opcua_binary_get_endpoints_user_token
    - opcua_binary_opensecure_channel
    - opcua_binary_read
    - opcua_binary_read_array_dims
    - opcua_binary_read_array_dims_link
    - opcua_binary_read_diagnostic_info
    - opcua_binary_read_extension_object
    - opcua_binary_read_extension_object_link
    - opcua_binary_read_nodes_to_read
    - opcua_binary_read_results
    - opcua_binary_read_results_link
    - opcua_binary_read_status_code
    - opcua_binary_read_variant_data
    - opcua_binary_read_variant_data_link
    - opcua_binary_status_code_detail
    - opcua_browse
    - opcua_browse_description
    - opcua_browse_response_references
    - opcua_browse_result
    - opcua_create_session
    - opcua_create_session_endpoints
    - opcua_create_session_user_token
    - opcua_create_subscription
    - opcua_get_endpoints
    - opcua_get_endpoints_description
    - opcua_get_endpoints_user_token
    - opcua_opensecure_channel
    - opcua_read
    - opcua_read_nodes_to_read
    - opcua_read_results
    - opcua_read_results_link
    - opcua_status_code_detail
    - profinet_dce_rpc
    - profinet
    - profinet_debug
    - s7comm
    - s7comm_read_szl
    - s7comm_upload_download
    - s7comm_plus
    - stun
    - stun_nat
    - tds
    - tds_rpc
    - tds_sql_batch
    - wireguard