Change log for CISCO_WIRELESS

Date Changes
2024-03-18 Enhancement -
- Added new Grok patterns to support new pattern of syslog logs.
- Mapped "version" to "metadata.product_version".
- Mapped "client_host", and "hostname" to "principal.hostname".
- Mapped "client_ip" to "principal.ip".
- Mapped "client_mac" to "principal.mac".
- Mapped "ap_ip" to "target.ip".
- Mapped "ap_mac" to "target.mac".
- Mapped "messageToProcess" and "description" to "metadata.description".
- Mapped "inter_url" to "intermediary.url".
- Mapped "inter_ip" to "intermediary.ip".
- Mapped "sec_desc" to "security_result.description".
- Mapped "latest_version", "current_version", "certificate", "expiry_date", "clostest_sensor", "ssid", "client", "xid", "failure_reason", "auth_failure_reason", and "interface" to "security_result.detection_fields".
- Aligned mappings for "principal.hostname" and "principal.asset.hostname".
- Aligned mappings for "target.hostname" and "target.asset.hostname".
- Aligned mappings for "principal.ip" and "principal.asset.ip".
- Aligned mappings for "target.ip" and "target.asset.ip".
- Mapped "action_data" to "security_result.acion_details".
- Mapped "username" to "principal.user.userid".
- Mapped "vendor", and "RSSI" to "principal.resource.attribute.labels".
- Mapped "vendor", "security_setting", "channel", "protocol", and "RSSI" to "target.resource.attribute.labels".
2024-01-10 Enhancement -
- Added Grok patterns to parse newly ingested unparsed logs.
- Handled logs when the value of "mnemonic" is not null and the value is "SEC_LOGIN-5-LOGIN_SUCCESS" and "CRL_LDAP_QUERY".
- Mapped "msg1" to "metadata.description".
- Mapped "messageToProcess" to "metadata.description".
2023-02-09 Enhancement -
- Supported new logs which has field "PARSE_ERROR".
- Added grok pattern to support new logs.
2022-09-08 Fix -
- Corrected a typo error: On line 1239 in include file added comment marker '#' proceeding to the word 'security'.
2022-08-22 Enhancement
- Moved customer specific parser changes to default parser
- Added grok patterns to parse the drop logs
- Removed drop tags to enhance the parser
- Changed the field mapping of "event.idm.read_only_udm.metadata.event_type" from "GENERIC_EVENT" to "STATUS_UNCATEGORIZED" and "STATUS_UPDATE"
- Mapped "messageToProcess" field to "event.idm.read_only_udm.metadata.description"
- Mapped "src_ip" field to "event.idm.read_only_udm.principal.ip"
- Mapped "wlc_controller" to "event.idm.read_only_udm.principal.hostname"
- Mapped "event.idm.read_only_udm.metadata.event_type" to "USER_RESOURCE_ACCESS"