Change log for IMPERVA_DB
Date | Changes |
---|---|
2024-04-09 | Enhancement:
- Added "gsubs" to handle invalid JSON characters in logs. - Mapped "raw-query" to "security_result.detection_fields". |
2024-01-21 | Enhancement:
- Added a new Grok pattern to parse unparsed logs of format SYSLOG+JSON. - Mapped "version" to "metadata.product_version". - Mapped "dest-ip" to "target.ip". - Mapped "dest-port" to "target.port". - Mapped "source-ip" to "principal.ip". - Mapped "source-port" to "principal.port". - Mapped "db-user" to "principal.user.userid". - Mapped "os-user" to "principal.user.userid". - Mapped "protocol" to "network.ip_protocol". - Mapped "audit-policy" to "security_result.category_details". - Mapped "server-group", "service-name", "user-group", "raw-query", "parsed-query", "bind-variables", "sql-error", "db-schema-pair.db-name", "db-schema-pair.schema-name", and "objects-list" to "additional.fields". - Mapped "application-name" to "target.application". - Mapped "source-application" to "principal.application". - Mapped "event-id" to "metadata.product_log_id". - Mapped "event-type" to "metadata.product_event_type". - Mapped "application-user" to "principal.user.user_display_name". - Mapped "host-name" to "principal.hostname". - Mapped "mx-ip", "gw-ip" to "intermediary.ip". - Mapped "policy-id" and "user-authenticated" to "security_result.detection_fields". - If "has_principal" is "true" and "has_target" is "true", then set "metadata.event_type" as "NETWORK_CONNECTION". - If "has_principal" is "true", then set "metadata.event_type" as "STATUS_UPDATE". |
2023-07-17 | Bug-Fix
- Parsed unparsed raw logs using Grok patterns and 'kv' filters. - Mapped "srcPort" to "principal.port". - Mapped "srcIP" to "principal.ip". - Mapped "dstIP" to "target.ip". - Mapped "dstPort" to "target.port". - Mapped "alertSev" to "security_result.severity". - Mapped "ruleName" to "security_result.rule_name". - Mapped "category" to "security_result.category". - Mapped "group" to "target.user.group_identifiers". - Mapped "dbName" to "target.resource.name". - Mapped "policyName" to "security_result.detection_fields". - Mapped "username" to "principal.user.user_display_name". - Mapped "evntDesc" to "security_result.description". - Mapped "action" to "security_result.action_details". |
2023-02-03 | Enhancement
- Mapped "event_name" to "metadata.product_event_type". |