Change log for IBM_SVA
| Date | Changes |
|---|---|
| 2025-05-30 | New Parser
- Added grok patterns to parse new pattern of syslog logs. - event.idm.read_only_udm.principal.ip: Newly mapped `principal_ip` raw log field with `event.idm.read_only_udm.principal.ip` UDM field - event.idm.read_only_udm.principal.asset.ip: Newly mapped `principal_ip` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field - event.idm.read_only_udm.target.ip: Newly mapped `target_ip` raw log field with `event.idm.read_only_udm.target.ip` UDM field - event.idm.read_only_udm.target.asset.ip: Newly mapped `target_ip` raw log field with `event.idm.read_only_udm.target.asset.ip` UDM field - event.idm.read_only_udm.intermediary.hostname: Newly mapped `inter_host` raw log field with `event.idm.read_only_udm.intermediary.hostname` UDM field - event.idm.read_only_udm.principal.application: Newly mapped `src_app` raw log field with `event.idm.read_only_udm.principal.application` UDM field - event.idm.read_only_udm.network.http.method: Newly mapped `network_method` raw log field with `event.idm.read_only_udm.network.http.method` UDM field - event.idm.read_only_udm.target.url: Newly mapped `dst_url` raw log field with `event.idm.read_only_udm.target.url` UDM field - event.idm.read_only_udm.additional.fields: Newly mapped `app_protocol`,`authSourceCode`,`accountValid`,`passwordValid`,`hashedPassword`,`passwordResetAllowed`,`nonExpiringPassword`,`customPasswordPolicy`,`authSource` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field - event.idm.read_only_udm.network.http.response_code: Newly mapped `res_code` raw log field with `event.idm.read_only_udm.network.http.response_code` UDM field - event.idm.read_only_udm.network.received_bytes: Newly mapped `rec_bytes` raw log field with `event.idm.read_only_udm.network.received_bytes` UDM field - event.idm.read_only_udm.network.session_duration.seconds: Newly mapped `sess_duration` raw log field with `event.idm.read_only_udm.network.session_duration.seconds` UDM field - event.idm.read_only_udm.network.application_protocol: Newly mapped `app_proto` raw log field with `event.idm.read_only_udm.network.application_protocol` UDM field - event.idm.read_only_udm.target.port: Newly mapped `dst_port` raw log field with `event.idm.read_only_udm.target.port` UDM field - event.idm.read_only_udm.security_result.severity: Newly mapped `level` raw log field with `event.idm.read_only_udm.security_result.severity` UDM field - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `error` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field - event.idm.read_only_udm.metadata.description: Newly mapped `desc` raw log field with `event.idm.read_only_udm.metadata.description` UDM field - event.idm.read_only_udm.security_result.description: Newly mapped `description` raw log field with `event.idm.read_only_udm.security_result.description` UDM field - event.idm.read_only_udm.target.hostname: Newly mapped `dst_host` raw log field with `event.idm.read_only_udm.target.hostname` UDM field - event.idm.read_only_udm.target.asset.hostname: Newly mapped `dst_host` raw log field with `event.idm.read_only_udm.target.asset.hostname` UDM field - event.idm.read_only_udm.security_result.action: Newly mapped `status` raw log field with `event.idm.read_only_udm.security_result.action` UDM field - event.idm.read_only_udm.target.user.attribute.labels: Newly mapped `operation`,`registryDn`,`secUserDn` raw log field with `event.idm.read_only_udm.target.user.attribute.labels` UDM field - event.idm.read_only_udm.target.user.userid: Newly mapped `username` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field - event.idm.read_only_udm.metadata.vendor_name: Newly mapped `IBM` with `event.idm.read_only_udm.metadata.vendor_name` UDM field - event.idm.read_only_udm.metadata.product_name: Newly mapped `Security Verify Access` with `event.idm.read_only_udm.metadata.product_name` UDM field |