transcript generation relies on tcpflow, however, the version on OpenBSD is quite
from the stone-age and doesn't support IPv6. A quick attempt to update it failed and I haven't yet bothered to look deeper into it.
Note: haven't looked at the ES integration part at all yet.
However, have patches for the security-onion fork of Squert to add IPv6 support there as well.
Work was done on OpenBSD, so I've some unrelated patches in use as well to make it integrate there as best as possible.
sguild server, sguil client, sensor scripts patched to handle IPv6 in addition to IPv4
Note: haven't looked at the ES integration part at all yet. However, have patches for the security-onion fork of Squert to add IPv6 support there as well.