Change log for PAN_PANORAMA
| Date | Changes |
|---|---|
| 2025-04-03 | Enhancement:
- Added support to parse `event_ts` with date format `MMM d HH:mm:ss` by writing a grok pattern to fetch year from the log. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `event_ts_1` field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. |
| 2025-03-18 | Enhancement:
- Added a Grok pattern to parse "from_ip" to "principal.ip" and "principal.asset.ip" for different log formats. |
| 2025-03-18 | Enhancement:
- Added a Grok pattern to parse "from_ip" to "principal.ip" and "principal.asset.ip" for different log formats. |
| 2025-03-12 | Enhancement:
- Added a Grok pattern to parse "event_ts" and "firewall_name". - Mapped "event_ts" to "metadata.event_timestamp". |
| 2025-02-27 | Enhancement:
- Added a Grok pattern to parse "from_ip" to "principal.ip" and "principal.asset.ip". |
| 2025-01-30 | Enhancement:
- Added a new Grok pattern for "user_description". - Mapped "user_description" to "security_result.description". |
| 2025-01-20 | Enhancement:
- Modified mapping for "firewall_name" from "principal.hostname" to "intermediary.hostname". - Mapped "column53" to "principal.hostname" and "principal.asset.hostname". |
| 2024-12-11 | Enhancement:
- Added support for CSV logs where "type" is equal to "SYSTEM". |
| 2024-12-10 | Enhancement:
- Mapped "firewall_name" to "principal.hostname" and "principal.asset.hostname". - Mapped "column15" to "security_result.summary". |
| 2024-09-10 | Enhancement:
- Removed duplicate mapping for "security_result.detection_fields". - Modified field value for "metadata.product_event_type". |
| 2024-09-02 | Enhancement:
- Mapped "sub_type" to "additional.fields". |
| 2024-07-19 | Enhancement:
- Implemented parsing for 'Threat' subtype and modified existing parsers to accurately populate the corresponding UDM field. - Added support for CSV logs where "type" is equal to "CONFIG". |
| 2024-07-10 | Enhancement:
- Added support for "USERID" CSV logs. |
| 2024-07-09 | Enhancement:
- When "type" is "SYSTEM" then mapped "sub_type" to "security_result.detection_fields". |
| 2024-06-15 | Enhancement:
- When "target_port" is not empty, then mapped "target_port" to "target.port". |
| 2024-01-25 | Enhancement:
- Mapped "characterstic_of_app" to "security_result.summary". - Mapped "pkts_received" to "network.received_packets". - Mapped "pkts_sent" to "network.sent_bytes". - Mapped "md5hash" to "principal.file.md5". - Mapped "sha256hash" to "principal.file.sha256". - Mapped "sha1hash" to "principal.file.sha1". - Mapped "about_file_mime_type" to "principal.file.mime_type". - Mapped "principal_ip" to "principal.asset.ip". - Mapped "principal_ip1" to "principal.asset.ip". - Mapped "principal_ip2" to "principal.asset.ip". - Mapped "principal_ip3" to "principal.asset.ip". - Mapped "principal_hostname" to "principal.asset.hostname". - Mapped "target_ip" to "target.asset.ip". - Mapped "target_ip1" to "target.asset.ip". - Mapped "target_hostname" to "target.asset.hostname". - Mapped "intermediary_hostname" to ""intermediary.asset.hostname". - Mapped "category_of_app" to "security_result.category_details". - Mapped "subcategory_of_app1" to "security_result.category_details". - Mapped "subcategory_of_app" to "security_result.category_details". |
| 2023-08-07 | - Newly created parser.
|