tweaks for idaholab#419, testing ja4+ merge

mmguero-dev · Jun 25, 2024 · d44b353 · d44b353
1 parent b0bf7e7
commit d44b353
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/logstash/pipelines/zeek/13_zeek_normalize.conf b/logstash/pipelines/zeek/13_zeek_normalize.conf
@@ -1369,7 +1369,7 @@ filter {
                                                           merge => { "[related][hash]" => "[zeek][files][sha1]" } } }
   if ([zeek][files][sha256]) {                   mutate { id => "mutate_merge_field_related_hash_files_sha256"
                                                           merge => { "[related][hash]" => "[zeek][files][sha256]" } } }
-  if ([zeek][http][ja4]h) {                      mutate { id => "mutate_merge_field_related_hash_http_ja4h"
+  if ([zeek][http][ja4h]) {                      mutate { id => "mutate_merge_field_related_hash_http_ja4h"
                                                          merge => { "[related][hash]" => "[zeek][http][ja4h]" } } }
   if ([zeek][ssh][hassh]) {                      mutate { id => "mutate_merge_field_related_hash_ssh_hassh"
                                                           merge => { "[related][hash]" => "[zeek][ssh][hassh]" } } }