Stay organized with collections
Save and categorize content based on your preferences.
Change log for UBIQUITI_SWITCH
Date
Changes
2023-11-21
Enhancement:
- Added support for new pattern of SYSLOGS.
- Added null check for "SRC", "DST", "SPT" before mapping to UDM fields.
- Added new GROK patterns to extract "mac", "principal_ip" from "description".
- Added "principal_present" check before setting "metadata.event_type" to "STATUS_SHUTDOWN", "STATUS_STARTUP".
- Mapped "source_port" to "principal.port".
- Mapped "query_1" to "target.administrative_domain".
- Mapped "query_server_1" to "target.ip".
- Mapped "satisfaction_now", "anomalies", "event_type", "assoc_status", "radio" to "security_result.detection_fields".
- Mapped "mac", "sta", "bssid" to "principal.mac".
- Mapped "principal_ip" to "principal.ip".
- Mapped "asset_id" to "observer.asset.product_object_id".
- Mapped "asset_version" to "observer.asset.software.version".
- Mapped "application" to "observer.application".
- Mapped "process_id" to "observer.process.pid".
- Mapped "vap" to "metadata.ingestion_labels".
2022-08-26
Added Mapping for unparsed log. SRC mapped to principal.ip.
DST mapped to target.ip.
SPT mapped to target.port.
SPT mapped to principal.port.
PROTO mapped to network.ip_protocol.
TTL mapped to additional.fields.
ID mapped to additional.fields.
IN mapped to additional.fields.
MAC mapped to principal.mac.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-06 UTC."],[[["The change log documents updates for UBIQUITI_SWITCH, including enhancements and mapping adjustments."],["New support for SYSLOG patterns and null checks for specific fields like \"SRC,\" \"DST,\" and \"SPT\" have been introduced."],["Several fields, such as \"source_port,\" \"query_1,\" \"query_server_1,\" and more, have been remapped to align with different data structures."],["Grok patterns have been added to extract information like \"mac\" and \"principal_ip\" from descriptions."],["Mapping has been added for unparsed logs, including fields such as \"SRC,\" \"DST,\" \"SPT,\" \"PROTO,\" and \"MAC,\" and how they correlate with different structures."]]],[]]
