Change log for AZURE_GATEWAY
| Date | Changes |
|---|---|
| 2024-12-05 | Enhancement:
- When "properties_action" is "allowed", then mapped "security_result_action" to "ALLOW". - When "properties_action" is "Blocked", then mapped "security_result_action" to "BLOCK". - When "properties_action" is "Matched", "Detected", then mapped "security_result_action" to "UNKNOWN_ACTION". - Mapped "dest_ip" to "target.ip". - Mapped "hostname" to "target.hostname". |
| 2024-11-05 | Enhancement:
- Mapped "instanceId" to "principal.application". - Mapped "properties.clientPort" to "principal.port". - Mapped "properties.ruleSetType" to "security_result.detection_fields". - Mapped "properties.ruleId" to "security_result.rule_id". - Mapped "properties.message" to "metadata.description". |
| 2024-06-20 | Enhancement:
- Added support for a new pattern of unparsed JSON logs. - Mapped "instanceId" to "principal.application". - Mapped "sslEnabled" and "upstreamSourcePort" to "additional.fields". |
| 2024-04-19 | Enhancement:
- Added support for multiple event JSON logs. |
| 2023-12-22 | Enhancement:
- Mapped "resourceid" to "target.resource.id". - Mapped "properties.operationStatus" to "security_result.category_details". - Mapped "properties.configuration.Name" to "principal.hostname". - Mapped "properties.message" to "metadata.description". - Mapped "properties.configuration.RemoteStie" to "target.hostname". - Mapped "level" to "security_result.severity_details". - Mapped "properties.configuration.Ikeversion" to "principal.resource.attribute.labels". - Mapped "properties.configuration.LocalTunnelEndpoint" to "principal.ip". - Mapped "properties.configuration.RemoteTunnelEndpoint" to "target.ip". - Mapped "properties.configuration.LocalSubnets", "properties.configuration.RemoteSubnets", "properties.configuration.VirtualNetworkRanges", and "properties.configuration.VirtualNetworkSubnets" to "principal.resource.attribute.labels". - Mapped "properties.configuration.VIPAddress" to "principal.ip". - Mapped "properties.configuration.BgpConfiguration.GatewayConfig.PeerAddress" to "targrt.ip". - Mapped "properties.configuration.BgpConfiguration.GatewayConfig.PeerType" and "properties.configuration.BgpConfiguration.GatewayConfig.Asn" to "security_result.detection_fields". |
| 2023-11-16 | - Newly created parser.
|