Change log for IBM_ZSECURE_ALERT
| Date | Changes |
|---|---|
| 2025-06-19 | - Newly added gsub for `kv_data` to parse the logs.
- Newly added grok pattern to parse the logs which were in `LEEF` format. - Newly added KV filter to parse the logs. - `event.idm.read_only_udm.metadata.event_timestamp` : Newly mapped `device_time` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.principal.user.userid` : Newly mapped `usrName` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.principal.user.user_display_name` : Newly mapped `name` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field. - `event.idm.read_only_udm.target.process.command_line` : Newly mapped `job` raw log field with `event.idm.read_only_udm.target.process.command_line` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels` : Newly mapped `intent`, `class`, `prof`, `res`, `function`, and `owner` raw log fields with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.security_result.detection_fields` : Newly mapped `auth` and ,`logstr` raw log fields with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.security_result.category_details` : Newly mapped `reason` raw log field with `event.idm.read_only_udm.security_result.category_details` UDM field. - `event.idm.read_only_udm.security_result.action_details` : Newly mapped `allow` raw log field with `event.idm.read_only_udm.security_result.action_details` UDM field. - `event.idm.read_only_udm.security_result.summary` : Newly mapped `sum` raw log field with `event.idm.read_only_udm.security_result.summary` UDM field. - `event.idm.read_only_udm.security_result.action` : Nelwy mapped `desc` raw log field with `event.idm.read_only_udm.security_result.action` UDM field. - `event.idm.read_only_udm.additional.fields` : Nelwy mapped `used`, `oGID` and , `oUID` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.target.file.full_path` : Newly mapped `path` raw log field with `event.idm.read_only_udm.target.file.full_path` UDM field. - `event.idm.read_only_udm.principal.user.attribute.labels` : Newly mapped `usrPriv` raw log field with `event.idm.read_only_udm.principal.user.attribute.labels` UDM field. - `event.idm.read_only_udm.metadata.product_version` : Newly mapped `product_version` raw log field with `event.idm.read_only_udm.metadata.product_version` UDM field. - `event.idm.read_only_udm.metadata.product_event_type` : Newly mapped `event.idm.read_only_udm.metadata.event_type` as `USER_RESOURCE_ACCESS` when `has_principal_user` and `has_target_resource` are `true`. |
| 2025-03-14 | Newly created parser.
Supported log format: SYSLOG. Mapped the following fields: - `priority` to `security_result.detection_fields` - `timestamp` to `metadata.event_timestamp` - `hostname` to `principal.hostname` and `principal.asset.hostname` - `app_name` to `target.application` - `parameter` to `target.resource.attribute.labels` - `class` to `target.resource.attribute.labels` - `profile` to `target.resource.attribute.labels` - `uacc` to `target.resource.attribute.labels` - `parm` to `target.resource.attribute.labels` - `action` to `security_result.action_details` - `racf_user` to `target.resource.attribute.labels` - `racf_name` to `target.resource.attribute.labels` - `racfcmd` to `target.resource.attribute.labels` - `dnsname` to `target.resource.attribute.labels` - `volume` to `target.resource.attribute.labels` - `poe` to `target.resource.attribute.labels` - `resource` to `target.resource.attribute.labels` - `granted` to `additional.fields` - `allowed` to `additional.fields` - `intent` to `additional.fields` - `userid` to `principal.user.userid` - `name` to `principal.user.user_display_name` - `jobname` to `additional.fields` - `system` to `additional.fields` - `attempts` to `additional.fields` - `terminal` to `principal.asset.attribute.labels` - `srcip` to `principal.ip` and `principal.asset.ip` - `msg` to `security_result.description` - `mesg` to `security_result.detection_fields` - `wto_msg` to `security_result.detection_fields` - `desc` to `security_result.detection_fields` - `svcno` to `target.resource.attribute.labels` - `esrno` to `target.resource.attribute.labels` - `curr_address` to `target.resource.attribute.labels` - `curr_apf` to `target.resource.attribute.labels` - `unix_path` to `target.file.full_path` - Set `event_type` to `USER_RESOURCE_ACCESS` if principal, target and action are present. - Set `event_type` to `STATUS_UPDATE` if only principal is present. - Set `event_type` to `GENERIC_EVENT` if none of the above conditions are met. |