Add native log parsing, field mapping, and normalized schema support for Zeek (formerly Bro) Network Security Monitoring telemetry in Huntress Managed SIEM.

Why This Is Important:

Zeek is an industry-standard open-source network monitoring tool heavily relied upon by MSPs and MSSPs for protocol-level network visibility (DNS, HTTP, SSL/TLS, TCP/UDP connection state, JA3 hashes, etc.).

Currently, when Zeek JSON or Syslog events are forwarded to the Huntress Agent/SIEM, they are classified as Syslog-Generic or unparsed raw messages. While the raw logs remain searchable for manual investigations, the lack of native parsing prevents:

Structured field mapping (e.g., source/destination IP, ports, query domains, user-agents, and SSL SNIs).

Automated Huntress SIEM detection rules and anomaly signals from evaluating network layer events.

Efficient log filtering and tenant-based customer segmentation across multi-tenant MSP environments.

Requested Capabilities:

Native Zeek Parsers: Pre-built parser rules for core Zeek log streams:

conn.log (Network connection state & flow data)

dns.log (DNS queries, record types, and responses)

http.log (HTTP requests, hostnames, user-agents)

ssl.log / x509.log (TLS handshake inspection, SNI, JA3/JA4 fingerprints)

Field Mapping & Normalization: Automatically map Zeek JSON keys (id.orig_h, id.resp_h, id.orig_p, id.resp_p, query, host, server_name) into standard Huntress SIEM fields.

Detection Engine Integration: Enable the Huntress SOC/Detection Engine to run automated signal correlations against structured network protocol telemetry.

Impact on Partners:

Native Zeek ingestion will allow MSPs to unify endpoint MDR with network-level visibility inside Huntress, reducing reliance on third-party vendor SOCs while enhancing threat-hunting speed and detection accuracy across managed environments.