Change log for ADAUDIT_PLUS

Date	Changes
2024-01-19	Enhancement : - Modified a Grok pattern to parse unparsed logs. - Mapped "IP" to "principal.asset.ip". - Mapped "_PrincipalIP" to "principal.asset.ip". - Mapped "host" to "principal.asset.hostname". - Mapped "principalHost" to "principal.asset.hostname". - Mapped "SOURCE" to "principal.asset.hostname". - Mapped "_TargetIP" to "target.asset.ip". - Mapped "CLIENT_IP_ADDRESS" to "target.asset.hostname". - Mapped "CLIENT_HOST_NAME" to "target.asset.hostname". - Mapped "targetHost" to "target.asset.hostname".
2023-10-17	Bug-Fix : - Added IP check before mapping "IP" to "principal.ip". - Added IP check before mapping "CLIENT_IP_ADDRESS" to "target.ip". - Added validation check for "ACCOUNT_SID" before mapping to "principal.group.windows_sid". - Added validation check for "CALLER_USER_SID" before mapping to "target.group.windows_sid". - When "principal" is present, set "event_type" to "STATUS_UPDATE". - Modified a Grok pattern to parse "file_path" from new pattern of "FORMAT_MESSAGE". - Added a check for "has_target_resource" when "event_type" is "SCHEDULED_TASK_CREATION".
2023-03-17	Enhancement : - Supported CEF format logs and mapped the following fields: - "IP" mapped to "principal.ip". - "LOGIN NAME" mapped to "target.user.userid or target.user.email_addresses or target.user.user_display_name". - "DOMAIN NAME" mapped to "principal.administrative_domain". - "HOST" mapped to "principal.hostname". - "ACCESS_MODE" mapped to "security_result.detection_fields". - "STATUS" mapped to "security_result.summary". - If "STATUS" is "success" then "security_result.action" mapped to "ALLOW" else if "STATUS" is "denied or incorrect" then "security_result.action" mapped to "BLOCK".