Change log for GUARDIUM
| Date | Changes |
|---|---|
| 2024-08-05 | Enhancement:
- Added support to handle unparsed LEEF format logs. |
| 2024-06-07 | Enhancement:
- Mapped "query" to "additional.fields". |
| 2024-04-01 | Enhancement:
- Added mapping for "severity" with value "Very-High" to "security_result.severity" - Added gsub function to manage "space" in the "spt" parameter before mapping to "principal.port". |
| 2023-12-15 | Enhancement:
- Added support for LEEF format logs. |
| 2022-10-06 | Added Grok pattern to parse syslog logs. - Changed 'observer.hostname' mapping to 'intermediary.hostname'. - Changed 'observer.ip' mapping to 'intermediary.hostname'. |
| 2022-09-06 | Enhancement:
- Migrated customer-specific parser to default and also removed customer-specific parser. |
| 2022-07-08 | Enhancement:
- Modified mapping for "user_role" from "target.user.role_name" to "target.user.attribute.roles". |
| 2022-06-30 | Enhancement: Added mappings for the following fields:
- Mapped "timestamp" to "metadata.collected_timestamp" - Mapped SQL to "security_result.summary" |
| 2022-05-17 | Enhancement: Modified the parser to support logs that are in "CEF" format.
|
| 2022-03-24 | Enhancement: Added mappings for the following new fields:
"Full SQL ID" field mapped to "event.idm.read_only_udm.target.process.pid". "Session ID" field mapped to "event.idm.read_only_udm.network.session_id". |