Change log for ARUBA_EDGECONNECT_SDWAN

Date	Changes
2024-06-10	Enhancement: - Added a Grok pattern to parse the new pattern of SYSLOG format logs. - Mapped "summary" to "security_result.summary". - Mapped "userid" to "principal.user.userid". - Mapped "hostname" to "target.hostname" and "target.asset.hostname". - Mapped "command" to "principal.process.command_line". - Mapped "principal_ip" to "principal.asset.ip" and "principal.asset.ip". - When "userid", "hostname" are present, and "description" is nearly equal to "login", then set "metadata.event_type" to "USER_LOGIN". - When "principal_present" is true, then set "metadata.event_type" to "STATUS_UPDATE".
2023-05-03	Newly created parser.

Date

Changes

2024-06-10

Enhancement:
- Added a Grok pattern to parse the new pattern of SYSLOG format logs.
- Mapped "summary" to "security_result.summary".
- Mapped "userid" to "principal.user.userid".
- Mapped "hostname" to "target.hostname" and "target.asset.hostname".
- Mapped "command" to "principal.process.command_line".
- Mapped "principal_ip" to "principal.asset.ip" and "principal.asset.ip".
- When "userid", "hostname" are present, and "description" is nearly equal to "login", then set "metadata.event_type" to "USER_LOGIN".
- When "principal_present" is true, then set "metadata.event_type" to "STATUS_UPDATE".

2023-05-03

Newly created parser.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2024-12-19 UTC.