deployment/roles/metron_streaming/files/source/bro-config.json

{
  "index": "bro",
  "batchSize": 5,
  "enrichmentFieldMap":
  {
    "geo": ["ip_dst_addr", "ip_src_addr"],
    "host": ["host"]
  },
  "threatIntelFieldMap":
  {
    "ip": ["ip_dst_addr", "ip_src_addr"]
  }
}