Stay organized with collections
Save and categorize content based on your preferences.
Change log for ARBOR_SIGHTLINE
Date
Changes
2022-12-16
- Mapped "Active/Cleared" to "security_result.threat_status".
2022-11-16
Enhancement:
- Added "timezone"="Europe/London" to match the date to BST format.
2022-11-04
- Added grok pattern to parse syslog log.
- Mapped "intem_host" to "target.group.product_object_id".
- Mapped "alert_id","parent_managed_object" to "security_result.detection_fields".
- When "message" is equal to "Host Detection" then mapped "metadata.product_event_type" to "Host Detection".
- When "message" is equal to "started" then mapped "metadata.product_event_type" to "TMS Mitigation started".
- When "message" is equal to "stopped" then mapped "metadata.product_event_type" to "TMS Mitigation stopped".
