Sidecar app for Corelight's TA for Zeek https://splunkbase.splunk.com/app/5466
2025/10/7 - props.conf
- adding FIELDALIAS to account for modern data coming in with a dot instead of underscore, ie id.orig_h vs id_orig_h
Sidecar app for Corelight's TA for Zeek https://splunkbase.splunk.com/app/5466
2025/10/7 - props.conf