Change log for TACACS_PLUS
| Date | Changes |
|---|---|
| 2025-03-13 | - Mapped "status to "security_result.action_details".
- Mapped "username" to "principal.user.userid". - Mapped "service" to "target.application". - Mapped "terminal" to "target.resource.name". - Mapped "command" to "target.process.command_line". - Mapped " ResponseDescription" to "security_result.summary" when ResponseDescription is "pcre2" else mapped to "metadata.description". - Mapped "return_code" to "security_result.summary". - Mapped "process_id" to "target.process.pid". - Mapped "session_id" to "network.session_id". - Mapped "hostname" to "principal.hostname" and "principal.asset.hostname". - Mapped "principalIp" to "principal.ip" and "principal.asset.ip". - Mapped "device_ip" to "target.ip" and "target.asset.ip". - Mapped "Deviceip" to "target.asset.ip" and "target.ip". - Mapped "TACACS Plus" Value to "metadata.product_name". - Mapped "TACACS Plus" Value to "metadata.vendor_name". |