Change log for AZURE_FIREWALL
| Date | Changes |
|---|---|
| 2025-02-17 | Enhancement:
- Added support to parse the unparsed logs. - Mapped "SourcePort" to "principal.port". - Mapped "DestinationPort" to "target.port". - Mapped "SourceIp" tp "principal.ip". - Mapped "Fqdn" to "principal.hostname". - Mapped "ActionReason" to "security_result.summary". - Mapped "IsTlsInspected" , "Policy" , "RuleCollection" , "Rule" and "IsExplicitProxyRequest" to "additional.fields". - Mapped "_ItemId" to "metadata.product_log_id". - Mapped "_ResourceId" to "principal.resource.id". - Mapped "Type" to "metadata.product_event_type". - Mapped "TenantId" to "principal.user.product_object_id". - Mapped "_Internal_WorkspaceResourceId" to "principal.resource.attribute.labels". - Mapped "TargetUrl" to "target.url". - Mapped "RuleCollectionGroup" to "observer.group.group_display_name". |
| 2024-12-26 | Bug fix:
- When the logs contain the keyword "Alert", mapped "security_result.action" to "ALLOW". |
| 2024-11-13 | Enhancement:
- Mapped "Action" to "security_result.detection_fields". - Mapped "Signature" to "security_result.detection_fields". - Mapped "IDS" to "security_result.detection_fields". - Mapped "Priority" to "security_result.priority_details". - Mapped "Classification" to "security_result.detection_fields". |
| 2024-09-04 | Enhancement:
- Mapped "from_ip" to "dns.questions.name" for DNS events. |
| 2024-07-02 | Enhancement:
- Added support to handle a new format of timestamp. |
| 2024-04-29 | Enhancement
- Added support to handle a new format of ingested logs. |
| 2024-02-07 | Enhancement
- Mapped "ICMP type" to "additional.fields". - Mapped "Action" and "properties.Action" to "security_result.action_details". |
| 2023-06-01 | Enhancement
- Newly ingested JSON logs of category "AZFWDnsQuery" are parsed. - Mapped "properties.msg" in newly ingested JSON logs of category "AzureFirewallNetworkRule". |
| 2022-04-29 | Bug fix - Newly ingested JSON logs are parsed to increase the overall parsing percentage.
- operationName mapped to metadata.product_event_type. - resourceId mapped to metadata.product_log_id. |