Stay organized with collections
Save and categorize content based on your preferences.
Change log for BARRACUDA_WAF
Date
Changes
2025-02-10
Enhancement:
- Mapped "inter_host" to "null" if it is not present in the log.
2025-01-16
Enhancement:
- Added a Grok pattern to support new format of syslog logs.
- Mapped "inter_host" to "intermediary.hostname".
2024-11-19
Enhancement:
- Added support for CEF format logs.
2024-11-18
Enhancement:
- Removed unnecessary drop condition to fix the parsing issue.
2024-09-25
Enhancement:
- Added support for a new pattern of SYSLOG logs.
2024-09-05
Enhancement:
- Added support for a new pattern of SYSLOG logs.
2023-07-19
Bug-Fix:
-Parsed uparsed raw logs using a Grok pattern.
-Mapped 'server' to 'target.ip'.
2022-09-09
Enhancement: Created a default parser and Migrated the custom parsers into default parser.
The following fields are mapped:
- 'duser' mapped to 'target.user.user_display_name'.
- 'suser' mapped to '.principal.user.user_display_name'.
- 'suid' mapped to 'principal.user.userid'.
- 'src' mapped to 'principal.ip'.
- 'dst' mapped to 'target.ip'.
- 'shost' mapped to 'principal.hostname'.
- 'severity' mapped to 'security_result.severity'.
- 'action' mapped to 'security_result.action'.
- 'user_name' mapped to 'target.user.userid'.
- 'domain_name' mapped to 'target.domain.name'.
- 'mac_address' mapped to 'principal.mac'.
- 'direction' mapped to 'network.direction'.
- 'ip_protocol' mapped to 'network.ip_protocol'.
- 'summary' mapped to 'security_result.summary'.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-06 UTC."],[[["Recent updates enhance BARRACUDA_WAF's log parsing capabilities by adding support for new SYSLOG log patterns and the CEF format."],["A default parser has been created, consolidating custom parsers and mapping various fields to standardized names like 'target.user.user_display_name' and 'principal.ip'."],["A Grok pattern was implemented to handle unparsed raw logs, along with mapping the field 'server' to 'target.ip'."],["The 'inter_host' field is now handled by being either mapped to \"intermediary.hostname\" if present or to \"null\" if not present in the log."],["Parsing issues have been resolved by removing unnecessary drop conditions, thus improving the overall performance."]]],[]]
