Stay organized with collections
Save and categorize content based on your preferences.
Change log for BEYONDTRUST_ENDPOINT
Date
Changes
2024-12-12
Enhancement:
- Added support to handle SYSLOG + KV logs.
2024-11-21
Enhancement:
- Mapped "user.DomainIdentifier", "user.DomainNetBIOSName", "user.name", and "user.domain" to "additional.fields".
2024-09-05
Enhancement:
- Added support for a new pattern of SYSLOG logs.
2024-08-28
Enhancement:
- Added support for new log pattern.
2024-06-10
Enhancement:
- Enhanced the parser to handle the new logs.
- Mapped "Processes.process_exec" to "additional.fields".
- Mapped "Processes.action" to "security_result.action".
- Mapped "Processes.description" to "metadata.description".
- Mapped "Processes.dest" to "target.hostname".
- Mapped "Processes.process_id" to "principal.process.pid".
- Mapped "Processes.user" to "principal.user.userid".
- Mapped "Processes.process" to "principal.application".
- Mapped "Processes.user_id" to "principal.user.windows_sid".
- Mapped "Processes.parent_process_id" to "principal.process.parent_process.pid".
- Mapped "Processes.process_hash", "Processes.process_name", "Processes.parent_process", "Processes.parent_process_exec" to "additional.fields".
- Mapped "Processes.process_path" to "principal.process.parent_process.file.full_path".
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-13 UTC."],[[["The BEYONDTRUST_ENDPOINT parser has been newly created as of March 20, 2024."],["Support for various log patterns, including SYSLOG and KV logs, has been added to the parser as of December 12, 2024."],["Multiple fields from \"Processes\" logs have been mapped to more standardized fields, like mapping \"Processes.process_exec\" to \"additional.fields\", or mapping \"Processes.action\" to \"security_result.action\"."],["User-related fields such as \"user.DomainIdentifier\", \"user.DomainNetBIOSName\", \"user.name\", and \"user.domain\" are now mapped to the \"additional.fields\" section."]]],[]]
