Stay organized with collections
Save and categorize content based on your preferences.
Change log for PROOFPOINT_TRAP
Date
Changes
2025-02-20
Enhancement:
- Added support for parsing additional fields.
2025-01-29
Enhancement:
- Mapped "mailfrom", "spf", "dkim1", "header_s1", "header_d1", "dkim2", "header_s2", "header_d2", and "dmarc" to "security_result.detection_fields".
- Mapped "send_email" to "network.email.from".
- Mapped "to_email" to "network.email.to".
2025-01-14
Enhancement:
- Defined labels inside the for loop.
2024-12-12
Enhancement:
- Added support for the new pattern of JSON logs.
2024-09-11
Enhancement:
- When "proofpoint_trap_host" is a valid IP then mapped it to "intermediary.ip". Otherwise, mapped it to "intermediary.ip".
- Mapped "users" to "principal.user.userid".
- Mapped "received" to "metadata.event_timestamp".
- Added support for JSON logs.
2024-06-05
Enhancement:
- Added support for JSON logs.
2023-05-26
Added mapping for the following fields:
- "ewsUrl" mapped to "principal.url".
- "username" mapped to "principal.user.user_display_name".
- "exchangeAuthType","exchangeAPI","tenantId","clientId","clientSecret","graphApiEndpoint","alternateGraphApiEndpoint",
"azureAdAuthEndpoint","privateKey" mapped to "additional.fields".
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-13 UTC."],[[["The PROOFPOINT_TRAP parser has undergone multiple enhancements since its creation, with the initial version launched on 2022-08-23."],["The parser now supports parsing various additional fields within the logs as of 2025-02-20."],["Several key email-related fields have been mapped to standardized fields within the \"security_result\", \"network.email\", and \"metadata\" objects since 2025-01-29 and 2024-09-11."],["Support for parsing JSON logs was introduced and improved, with initial support added on 2024-06-05, new patterns of JSON logs supported as of 2024-12-12, and finalized on 2024-09-11."],["In addition to the fields being mapped, there are a variety of other fields that are mapped to standard objects, such as ewsUrl, username, and more, as of 2023-05-26."]]],[]]
