Add additional log types to the Filebeat Zeek Module

[n0othing]

Describe the enhancement:

Today, the Filebeat Zeek module supports the following log types:

• connection
• dns
• files
• https
• notice
• ssl

However, it would be useful to also collect:

• dhcp
• ftp
• irc
• kerberos
• modbus
• mysql
• ntlm
• radius
• rdp
• rfb
• sip
• smb_cmd
• smtp
• snmp
• smb_mapping
• smb_files
• socks
• ssh
• syslog
• intel
• notice_alert
• signatures
• known_certs
• stdout
• stderr

[cwurm]

With the exception of intel and notice_alert all have been added with #14150.

🎉 🎉 🎉

[lucabelluccini]

It would be great to add:

• known_certs
• stdout
• stderr

An exhaustive list of log files is available at https://docs.zeek.org/en/stable/script-reference/log-files.html

[andrewkroh]

intel.log was added in #14404 (targeted for v7.6.0).

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[BobBlank12]

ntp and packet_filter logs?

[111andre111]

I have now opened elastic/integrations#3288 because there are much more kinds of logs missing.

[andrewkroh]

I'm going to close this issue. Most of those have been implemented and we have a fresh list of all the remaining logs in elastic/integrations#3288.

[jamiehynds]

NTP fileset added via #24224

[n0othing]

Closing in favor of elastic/integrations#3288