Change log for SALESFORCE
| Date | Changes |
|---|---|
| 2024-12-03 | Enhancement:
- Added support for new pattern of "Login" logs. |
| 2024-11-29 | Enhancement:
- Added support for a new format of JSON logs. |
| 2024-10-07 | Enhancement:
- Added "deactivateduser", "PermSetUnassign", and "PermSetAssign" as conditional check. |
| 2024-09-20 | Enhancement:
- Mapped "column9" to "metadata.product_log_id". - Mapped "column5" to "security_result.rule_author". - Mapped "column10" to "security_result.summary". - Mapped "column4" to "security_result.rule_name". |
| 2024-09-16 | Enhancement:
- Mapped "description" to "security_result.description". - Mapped "client_ip" to "principal.ip" and "principal.asset.ip". - Fixed mapping of "target_username" and "tls_protocol". |
| 2024-07-08 | Enhancement:
- Mapped "domain" to "target.administrative_domain". - Mapped "user_display" to "principal.user.userid". - Mapped "section" to "additional.fields". - Fixed the mapping to parse all fields. |
| 2024-06-04 | Enhancement:
- Added support for newly ingested logs. |
| 2024-03-06 | Enhancement:
- Changed mapping of the field "Id" from "metadata.product_log_id" to "principal.user.userid". - Changed mapping of the field "CreatedById" from "principal.user.userid" to "principal.resource.attribute.labels". - Mapped "IsDeleted" to "principal.resource.attribute.labels". - Mapped "LogFileLength" to "principal.resource.attribute.labels". - Mapped "LogFileContentType" to "principal.resource.attribute.labels". - Mapped "ApiVersion" to "principal.resource.attribute.labels". - Mapped "LogFile" to "principal.resource.attribute.labels". |
| 2023-02-24 | Enhancement-
- "security_result.action" mapped to ALLOW instead of BLOCK if the action is "LOGIN_NO_ERROR". - For "Login" events : - "action" mapped to "security_result.action". - "target_user_name" mapped to "target.user.userid". - "tls_protocol" mapped to "network.tls.version_protocol". - "cipher_suite" mapped to "network.tls.cipher". - Added "on_error" check for "OsVersion" and "date" block. |
| 2022-12-13 | Enhancement-
-Mapped "LoginType" to "security_result.description". -Mapped "LoginUrl" to "principal.url". -Added empty check for "ApiType" and "LoginGeo.City". |
| 2022-09-02 | Enhancement-
Migrated the custom parsers into default parser. |
| 2022-07-04 | Enhancement-
- Enhanced the parser to parse the logs having event_type 'LoginHistory'. - Added condition to parse different formats of timestamp. - Added condition for event_type 'USER_UNCATEGORIZED' where 'user_id' or 'UserId' or 'target_user_name' is not null. - Added validation for parsing src_ip. |
| 2022-04-18 | Enhancement-Modified mapping for DOWNLOAD_FORMAT from 'metadata.ingestion_labels' to 'target.resource.attribute.labels'.
|
| 2022-03-30 | Enhancement-Changed event_type for 'LoginEventStream' to USER_LOGIN.
Corrected mapping for the fields DOWNLOAD_FORMAT and ConnectedAppId. Added mappings for certain fields when log is of type LoginEventStream, WaveDownload, ApiEventStream. |