Change log for ISLAND_BROWSER
| Date | Changes |
|---|---|
| 2025-04-09 | Enhancement:
- event.idm.read_only_udm.principal.user.userid: Newly mapped `user_id` to `event.idm.read_only_udm.principal.user.userid`. - event.idm.read_only_udm.principal.user.user_display_name: Newly mapped `user_name` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field. - event.idm.read_only_udm.principal.asset.attribute.labels: Newly mapped `device_id` raw log field with `event.idm.read_only_udm.principal.asset.attribute.labels` UDM field. - event.idm.read_only_udm.principal.hostname, event.idm.read_only_udm.principal.asset.hostname: Newly mapped `machine_name` raw log field with `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname` UDM fields. - event.idm.read_only_udm.principal.asset.platform_software.platform: Newly mapped `os_platform` raw log field with `event.idm.read_only_udm.principal.asset.platform_software.platform` UDM field. - event.idm.read_only_udm.principal.location.country_or_region: Newly mapped `country` raw log field with `event.idm.read_only_udm.principal.location.country_or_region` UDM field. - event.idm.read_only_udm.principal.user.attribute.labels: Newly mapped `os_user_name` raw log field with `event.idm.read_only_udm.principal.user.attribute.labels` UDM field. - event.idm.read_only_udm.target.url: Newly mapped `top_level_url` raw log field with `event.idm.read_only_udm.target.url` UDM field. - event.idm.read_only_udm.security_result.rule_id: Newly mapped `rule_id` raw log field with `event.idm.read_only_udm.security_result.rule_id` UDM field. - event.idm.read_only_udm.security_result.rule_name: Newly mapped `rule_name` raw log field with `event.idm.read_only_udm.security_result.rule_name` UDM field. - event.idm.read_only_udm.network.session_id: Newly mapped `client_event_id` raw log field with `event.idm.read_only_udm.network.session_id` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `country_code` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `tenant_id` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `tab_id` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `signature` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `source` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.principal.ip, event.idm.read_only_udm.principal.asset.ip: Newly mapped `public_ip` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM fields. - event.idm.read_only_udm.principal.ip, event.idm.read_only_udm.principal.asset.ip: Newly mapped `source_ip` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM fields. - event.idm.read_only_udm.additional.fields: Newly mapped `processed_date` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.principal.group.group_display_name: Newly mapped `matched_user_group` raw log field with `event.idm.read_only_udm.principal.group.group_display_name` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `frame_url` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `url_web_categories` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `client_sending_date` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `matched_device_posture.anti_malware_product.name` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `matched_device_posture.anti_malware_product.enabled` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `matched_device_posture.anti_malware_product.signatures_are_up_to_date` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `matched_device_posture.anti_malware_product.signatures_last_updated` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `matched_device_posture.client_certificates.issuer` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `matched_device_posture.client_certificates.subject` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `matched_device_posture.client_certificates.thumbprint` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.principal.domain.name: Newly mapped `matched_device_posture.domain` raw log field with `event.idm.read_only_udm.principal.domain.name` UDM field. - event.idm.read_only_udm.principal.asset.platform_software.platform_version: Newly mapped `matched_device_posture.os_code_name` raw log field with `event.idm.read_only_udm.principal.asset.platform_software.platform_version` UDM field. - event.idm.read_only_udm.target.hostname, event.idm.read_only_udm.target.asset.hostname: Newly mapped `matched_device_posture.machine_name` raw log field with `event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname` UDM fields. - event.idm.read_only_udm.additional.fields: Newly mapped `matched_device_posture.disk_encryption` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `matched_device_posture.is_virtual_machine` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. -event.idm.read_only_udm.principal.file.full_path,event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `matched_device_posture.processes` raw log field with `event.idm.read_only_udm.principal.file.full_path` UDM field, and `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `origin` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.security_result.confidence_score: Newly mapped `url_web_reputation` raw log field with `event.idm.read_only_udm.security_result.confidence_score` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `is_island_private_access` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.principal.resource.id: Newly mapped `window_id` raw log field with `event.idm.read_only_udm.principal.resource.id` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `compatibility_mode` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.metadata.product_version: Newly mapped `version` raw log field with `event.idm.read_only_udm.metadata.product_version` UDM field. - event.idm.read_only_udm.metadata.event_type: Set `event.idm.read_only_udm.metadata.event_type` to `event.idm.read_only_udm.network_UNCATEGORIZED` if `has_event.idm.read_only_udm.network`, `has_ event.idm.read_only_udm.principal_user`, and `has_ event.idm.read_only_udm.target_hostname` are true; otherwise, set it to `USER_UNCATEGORIZED` if `has_ event.idm.read_only_udm.principal_user` is true. |
| 2024-05-20 | Enhancement:
- Initialized "RuleName" to null. - Mapped "userId" to "principal.user.userid". - Mapped "email" to "principal.user.email_addresses". - Mapped "type" to "metadata.product_event_type". - Mapped "hostname" to "principal.hostname" and "principal.asset.hostname". - Mapped "topLevelUrl" to "network.http.referral_url". - Mapped "ruleId" to "security_result.rule_id". - Mapped "ruleName" to "security_result.rule_name". - Mapped "Verdict" and "verdict" to "security_result.action_details". - Mapped "sourceIp" and "publicIp" to "principal.ip" and "principal.asset.ip". - Mapped "verdictReason" to "security_result.description". - Mapped "tabId", "urlWebReputation", "updatedDate", "processedDate", "service", "id", "deviceId", "frameUrl", "urlWebCategories", "isIslandPrivateAccess", "tenantId", "saasApplicationCategory", "saasApplicationName", "machineName", "details.navigationDetails.isIframe", "details.navigationDetails.is_iframe", "navigation_details.is_iframe", "matchedDevicePosture.domain", "matchedDevicePosture.workgroup", and "incognito" to "additional.fields". |
| 2023-09-04 | Newly created parser. |