Change log for THREATLOCKER
| Date | Changes |
|---|---|
| 2023-06-18 | Bug-Fix - Modified Grok pattern to fetch source IP address and destination IP address for "fp" when "at" is "network".
|
| 2023-05-24 | Enhancement - Modified mapping of "security_result.outcomes.key" to "Monitor mode status" and value to "monitor mode on" and "monitor mode off".
- Added mapping "s256" to "target.file.sha256" and "target.process.file.sha256". - When "at" is "network", mapped "metadata.event_type" to "NETWORK_CONNECTION" . Mapped "fp" to "target.hostname", "target.ip" and "target.port". - When "at" is "execute", "install", mapped "metadata.event_type" to "PROCESS_LAUNCH". . Mapped "fp" to "target.process.file.full_path". - When "at" is "newprocess", mapped "metadata.event_type" to "PROCESS_OPEN". . Mapped "fp" to "target.process.file.full_path". - When "at" is "write", mapped "metadata.event_type" to "FILE_MODIFICATION". . Mapped "fp" to "target.file.full_path". - When "at" is "read", mapped "metadata.event_type" to "FILE_READ". . Mapped "fp" to "target.file.full_path". - When "at" is "delete", mapped "metadata.event_type" to "FILE_DELETION". . Mapped "fp" to "target.file.full_path". - When "at" is "move", mapped "metadata.event_type" to "FILE_MODIFICATION". . Mapped "fp" to "target.file.full_path". - When "at" is "registry", mapped "metadata.event_type" to "REGISTRY_UNCATEGORIZED". . Mapped "fp" to "target.registry.registry_key". |
| 2022-12-16 | Newly created parser.
|