Change log for FORCEPOINT_DLP
| Date | Changes |
|---|---|
| 2025-03-06 | Enhancement:
- Mapped "inter_host" to "intermediary.hostname". |
| 2025-02-19 | Enhancement:
- Mapped "violationTriggers.*" fields to "additional.fields". |
| 2025-01-03 | Enhancement:
- Mapped "violationTriggers.VZ CPNI" and "violationTriggers.Controlled Unclassified Information: Portion Marking" to "additional.fields". |
| 2024-11-19 | Enhancement:
- Added support for new CEF format logs. |
| 2024-08-05 | Enhancement:
- When "act" is "Quarantined", then mapped "act" to "security_result.action_details" and "security_result.action" to "ALLOW". - Mapped "caseDescription" to "metadata.description". - Mapped "eventIDs" to "metadata.product_event_type". - When "sourceServiceName" is a valid application_protocol, then mapped "sourceServiceName" to "network.application_protocol". - Mapped "productVersion" to "metadata.product_version". - Mapped "riskScore" to "additional.fields". |
| 2024-05-20 | Enhancement:
- Mapped "fname" to "target.file.full_path". - Mapped "destinationHosts" to "target.hostname" and "target.asset.hostname". - Mapped "productVersion" and "analyzedBy" to "additional.fields". |
| 2024-03-25 | Bug-fix:
- Added support for new format logs. - Mapped "timeStamp" to "metadata.event_timestamp". - Mapped "act" to "security_result.description". - Mapped "cat" to "security_result.category_details". - Mapped "severityType" to "security_result.severity". - Mapped "msg" to "metadata.description". - Mapped "eventId" to "metadata.product_log_id". - Mapped "sourceServiceName" to "principal.application". - Mapped "sourceHost" to "principal.hostname" and "principal.asset.hostname". - Mapped "sourceIp" to "principal.ip" and "principal.asset.ip". - Mapped "suser" to "principal.user.userid". - Mapped "loginName" to "principal.user.user_display_name". |
| 2022-11-07 | - Newly Created Parser.
|