Change log for GITHUB

Date Changes
2024-09-18 Enhancement:
- Mapped "pull_request_url" to "target.url".
- Mapped "pull_request_title", "pull_request_id" ,and "previous_visibility" to "additional.fields".
2024-08-26 Enhancement:
- Mapped "explanation" to "additional.fields".
2024-08-13 Enhancement:
- Mapped "invitee_email" and "email" to "additional.fields".
2024-07-02 Enhancement:
- Fixed the mapping of "config_was".
- Changed the mapping of "admin_enforced" from "security_result.action" to "additional.fields".
- Mapped "required_status_checks_enforcement_level", "events_were" and "old_permission" to "additional.fields".
2024-06-13 Enhancement:
- Mapped "name", "manager", "pull_request_reviews_enforcement_level", "hook_id", "events", "config_was", "key", "fingerprint", "permission", and "title" to "additional.fields".
- When "admin_enforced" is "true", then mapped "security_result.action" to "ALLOW".
- When "admin_enforced" is "false", then mapped "security_result.action" to "BLOCK".
2023-12-18 Bug-Fix:
- If "process_type" is "github_production", added a Grok pattern to extract "kv_data".
- If "process_type" is "github_production", mapped "user" to "target.user.user_display_name".
- If "process_type" is "github_production", mapped "user_id" to "target.user.userid".
- Mapped "referrer" to "network.http.referral_url".
- Mapped "user_session_id" to "network.session_id".
- Mapped "ip" to "principal.ip".
- Mapped "from" to "additional.fields".
- Mapped "request_category" to "additional.fields".
- Mapped "device_cookie" to "additional.fields".
- Mapped "operation_type" to "additional.fields".
- Mapped "category_type" to "additional.fields".
- Mapped "note" to "additional.fields".
- Mapped "read" to "additional.fields".
- Mapped "pre_perform_allocation_count" to "additional.fields".
- Mapped "backend" to "additional.fields".
- Mapped "queue" to "additional.fields".
- Mapped "class" to "additional.fields".
- Mapped "success" to "additional.fields".
- Mapped "controller_action" to "security_result.detection_fields".
- Mapped "two_factor" to "security_result.detection_fields".
2023-10-25 Enhancement:
- When "public_repo" is "false", set "target.location.name" to "PRIVATE", else set to "PUBLIC".
2023-10-11 Enhancement:
- Mapped "user_agent" to "network.http.user_agent" and "network.http.parsed_user_agent".
- Mapped "request_method" to "network.http.method".
- Mapped "application_name" to "target.application".
- Mapped "status_code" to "network.http.response_code".
- Mapped "url_path" to "target.url".
- Mapped "user_id" to "target.userid".
- Mapped "transport_protocol_name" to "network.application_protocol".
- Mapped "raw.now" to "metadata.event_timestamp".
- Mapped "raw.ip" to "principal.ip".
- Mapped "raw.request_id" to "metadata.product_log_id".
- Mapped "raw.repo" to "target.url".
- Mapped "raw.action" to "security_result.summary".
- Mapped "raw.protocol" to "network.application_protocol".
- Mapped "raw.message" to "metadata.description".
- Mapped "raw.at" to "security_result.action".
- Mapped "raw.login" to "target.user_display_name".
- Mapped "raw.user_id" to "target.userid".
- Mapped "raw.failure_reason", "raw.failure_type", "raw.raw_login" and "raw.from" to "additional.fields".
- Mapped "programmatic_access_type", "actor_id", "token_id", "token_scopes", "integration", "query_string", "rate_limit_remaining",
"request_body", "route", "business", "org_id", "repo_id", "public_repo", "_document_id", "operation_type", "repository_public" to "additional.fields".
2023-07-31 Bug-Fix -
- Added "on_error" to Grok patterns.
- Mapped "workflow_run.id" to "target.resource.attribute.labels".
- Mapped "workflow_run.event" to "additional.fields".
- Mapped "workflow_run.actor.login" to "principal.user.userid".
- Mapped "workflow_run.head_branch" to "security_result.about.labels".
- Mapped "workflow_run.head_sha" to "target.file.sha256".
- Mapped "enterprise.name" to "additional.fields".
- Mapped "workflow.name" to "security_result.about.labels".
- Mapped "workflow_run.workflow_id" to "security_result.about.labels".
2023-06-22 Enhancement-
- Added support for the "github_auth", "haproxy", "github_access", "github_unicorn", "github_production", "hookshot-go",
"babeld", "github_gitauth", "babeld2hydro", "authzd", "gitrpcd", "agent", "git-daemon",
"github_resqued", "sudo", "systemd" and "github_audit" syslog log formats.
2023-06-09 Enhancement-
- Mapped "external_identity_nameid" to "target.user.email_addresses" if in email format.
- Fetch the username from "external_identity_nameid" and map to "target.user.userid".
2023-01-13 Enhancement-
- Mapped "actor_ip" to" "principal.ip".
- Mapeed "hashed_token" to "network.session_id".
- Mapped "external_identity_nameid" to "target.user.userid "
- Mapped "external_identity_username" to target.user.user_display_name".
2022-11-28 Enhancement - Mapped "config.url" to "target.url".
2022-07-07 Enhancement - The newly ingested JSON format logs having action "git.clone","git.push" and "workflows.prepared_workflow_job" have been handled and parsed.
- 'job_name' mapped to 'target.resource.attribute.labels'.
- 'job_workflow_ref' mapped to 'target.resource.attribute.labels'.
- 'runner_group_id' mapped to 'target.resource.attribute.labels'.
- 'runner_group_name' mapped to 'target.resource.attribute.labels'.
- 'runner_name' mapped to 'target.resource.attribute.labels'.
- 'runner_id' mapped to 'target.resource.attribute.labels'.
- 'workflow_run_id' mapped to 'target.resource.attribute.labels'.
- 'actor_location.country_code' mapped to 'principal.location.country_or_region'.