corelight/zeek-endpoint-enrichmentZeek log enrichment tool that adds host information and known entity references to enhance network security monitoring and incident response.
Enrich Zeek logs with host information
To enrich all logs with an id field, use the tag "#.#-all".
To enrich all logs with an id field, and the Known Entities, use the tag "#.#-known-all".
To only enrich the conn.log, use the tag "#.#-conn".
To only enrich the conn.log, and the Known Entities, use the tag "#.#-known-conn".
For detailed documentation, see https://docs.corelight.com
