Change log for CORTEX_XDR

Date Changes
2024-08-20 Enhancement:
- Mapped "user_name" to "target.user.userid".
2024-08-19 Enhancement:
- Mapped "actor_process_os_pid" to "target.process.pid".
- Changed mapping of "alert_id" from "security_result.rule_id" to "security_result.detection_fields".
- Changed mapping of "endpoint_id" from "target.process.product_specific_process_id" to "principal.asset.asset_id".
- Added support to parse new format of unparsed JSON logs.
2024-07-02 Enhancement:
- Mapped "external_id" to "metadata.product_log_id".
- Mapped "action_pretty" to "security_result.action_details".
2024-06-17 Enhancement:
- When "severity" is less than or equal to 6, then set "security_result.severity" to "LOW".
- when "severity" is greater than 6 and less than or equal to 8, then set "security_result.severity" to "MEDIUM".
- When "severity" is greater than 8, then set "security_result.severity" to "HIGH".
- Mapped "action" to "security_result.action_details".
- Mapped "original_tags" to "additional.fields".
2024-04-17 Enhancement:
- Mapped "action_local_port" to "principal.port".
- Mapped "dst_agent_id" to "principal.ip".
- Mapped "action_remote_ip" to "target.ip".
- Mapped "action_remote_port" to "target.ip".
- Added check if "target_device" is preset prior setting "metadata.event_type" to "NETWORK_CONNECTION".
2024-03-15 Enhancement:
- Added a Grok to retrieve "source" and "sr_summary" from the message header.
- Mapped "sr_summary" to "security_result.summary"
2024-03-11 Enhancement:
- Added support for CEF format logs.
- Mapped "rt" to "metadata.event_timestamp".
- Mapped "category" and "cat" to "security_result.category_details".
- Mapped "cs2Label", "cs2", "tenantname", "tenantCDLid" and "CSPaccountname" to "additional.fields".
- Mapped "shost" to "principal.hostname" and "principal.asset.hostname".
- Mapped "spt" to "principal.port".
- Mapped "src" to "principal.ip" and "principal.asset.ip".
- Mapped "suser" to "principal.user.user_display_name".
- Mapped "dpt" to "target.port".
- Mapped "dst" to "target.ip" and "target.asset.ip".
- Mapped "fileHash" to "target.file.sha256".
- Mapped "filePath" to "target.file.full_path".
- Mapped "request" to "network.http.referral_url".
- Mapped "msg" to "security_result.description".
2024-01-18 Enhancement:
- Changed "action_file_path" mapping from "target.file.full_path" to "target.resource.attribute.labels".
- Mapped "domain" to "target.asset.hostname".
- Mapped "destinationTranslatedAddress" to "target.asset.ip".
- Mapped "host_name" to "principal.asset.hostname".
- Mapped "dvchost" to "principal.asset.hostname".
- Mapped "ip" to "principal.asset.ip".
- Mapped "sourceTranslatedAddress" to "principal.asset.ip".
2023-11-10 Enhancement:
- When "event_type" is "RPC Call", then mapped "metadata.event_type" to "STATUS_UPDATE".
- Mapped "events.action_country" to "security_result.about.location.country_or_region".
- Mapped "events.actor_process_command_line" to "target.process.command_line".
- Mapped "events.actor_process_image_md5" to "target.file.md5".
- Mapped "events.actor_process_image_path" to "target.file.full_path".
- Mapped "events.actor_process_image_sha256" to "target.file.sha256".
- Mapped "events.actor_process_instance_id" to "target.process.pid".
- Mapped "events.os_actor_process_command_line" to "principal.process.command_line".
- Mapped "events.os_actor_process_image_path" to "principal.file.full_path".
- Mapped "events.os_actor_process_image_sha256" to "principal.file.sha256".
- Mapped "events.os_actor_process_instance_id" to "principal.process.pid".
- Mapped "events.causality_actor_process_command_line" to "intermediary.process.command_line".
- Mapped "events.causality_actor_process_image_path" to "intermediary.file.full_path".
- Mapped "events.causality_actor_process_image_sha256" to "intermediary.file.sha256".
- Mapped "events.causality_actor_process_instance_id" to "intermediary.process.pid".
- Mapped "events.causality_actor_process_image_md5" to "intermediary.file.md5".
- Mapped "events.event_type" to "metadata.product_event_type".
- Mapped "events.user_name" to "principal.user.user_display_name".
2023-10-16 Enhancement:
- Mapped "source" to "principal.asset.attribute.labels".
- Set "metadata.event_type" to "NETWORK_CONNECTION" if "event_type" in "Network Connections" or "Network Event".
2022-11-03 Enhancement:
- Mapped "PanOSConfigVersion" to "security_result.detection_fields".
- Mapped "PanOSContentVersion" to "security_result.detection_fields".
- Mapped "PanOSDGHierarchyLevel1" to "security_result.detection_fields".
- Mapped "PanOSDestinationLocation" to "target.location.country_or_region".
- Mapped "PanOSDynamicUserGroupName" to "principal.group.group_display_name".
- Mapped "PanOSSourceLocation" to "principal.location.country_or_region".
- Mapped "PanOSThreatCategory" to "security_result.category_details".
- Mapped "PanOSThreatID" to "security_result.threat_id".
- Mapped "app" to "target.application".
- Mapped "cs1" to "additional.fields".
- Mapped "cs3" to "additional.fields".
- Mapped "cs4" to "additional.fields".
- Mapped "cs5" to "additional.fields".
- Mapped "cs6" to "additional.fields".
- Mapped "cn1" to "additional.fields".
- Mapped "sourceTranslatedPort" to "principal.port".
- Mapped "sourceTranslatedAddress" to "principal.ip".
- Mapped "destinationTranslatedAddress" to "target.ip".
- Mapped "destinationTranslatedPort" to "target.port".
- Mapped "act" to "security_result.action_details".
- Mapped "deviceExternalId" to "security_result.about.asset_id".
- Mapped "dvchost" to "principal.hostname".
- Mapped "proto" to "network.ip_protocol".
- Mapped "fileId" to "target.resource.attribute.labels".