Change log for SALESFORCE

Date	Changes
2025-01-15	Enhancement: - Mapped "Name" to "principal.user.user_display_name". - Mapped "Email" to "principal.user.email_addresses". - Mapped "FederationIdentifier" to "additional.fields". - Mapped "CreatedBy.Email" to "principal.user.email_addresses". - Mapped "CreatedBy.Name" to "principal.user.user_display_name". - Mapped "CreatedBy.FederationIdentifier" to "additional.fields". - Mapped "Section" to "additional.fields". - Mapped "DelegateUser" to "additional.fields". - Mapped "ResponsibleNamespacePrefix" to "additional.fields". - Mapped "CreatedByContext" to "additional.fields". - Mapped "CreatedByIssuer" to "additional.fields". - Mapped "Browser" to "additional.fields". - When "Platform" is nearly equal to "Windows", then mapped "principal.platform" to "WINDOWS". - When "Platform" is nearly equal to "Linux", then mapped "principal.platform" to "LINUX". - When "Platform" is nearly equal to "Mac", then mapped "principal.platform" to "MAC". - Mapped "Status" to "security_result.action_details". - Mapped "CountryIso" to "additional.fields".
2025-01-10	Enhancement: - Added support for new pattern of "Login" and "LoginAs" logs.
2025-01-09	Enhancement: - Mapped "payload.PreviousPageUrl" to "metadata.url_back_to_product". - Mapped "payload.OsVersion" to "principal.platform_version". - Mapped "payload.PreviousPageEntityId", "payload.SdkVersion", "payload.Operation", "payload.PageUrl", "HasEffectivePageTimeDeviation_label", "payload.EffectivePageTime", "payload.EffectivePageTimeDeviationReason", "payload.DeviceSessionId", "payload.PreviousPageAppName", and "payload.PreviousPageEntityType" to "additional.fields". - Mapped "payload.SessionKey" to "network.session_id". - Mapped "payload.UserAgent" to "network.http.user_agent". - Mapped "payload.RecordId" to "target.resource.id". - Mapped "payload.EventIdentifier" to "metadata.product_log_id". - Mapped "payload.OsName" to "principal.platform".
2024-12-10	Enhancement: - Mapped "user_permission" to "principal.user.attribute.labels".
2024-12-03	Enhancement: - Added support for new pattern of "Login" logs.
2024-11-29	Enhancement: - Added support for a new format of JSON logs.
2024-10-07	Enhancement: - Added "deactivateduser", "PermSetUnassign", and "PermSetAssign" as conditional check.
2024-09-20	Enhancement: - Mapped "column9" to "metadata.product_log_id". - Mapped "column5" to "security_result.rule_author". - Mapped "column10" to "security_result.summary". - Mapped "column4" to "security_result.rule_name".
2024-09-16	Enhancement: - Mapped "description" to "security_result.description". - Mapped "client_ip" to "principal.ip" and "principal.asset.ip". - Fixed mapping of "target_username" and "tls_protocol".
2024-07-08	Enhancement: - Mapped "domain" to "target.administrative_domain". - Mapped "user_display" to "principal.user.userid". - Mapped "section" to "additional.fields". - Fixed the mapping to parse all fields.
2024-06-04	Enhancement: - Added support for newly ingested logs.
2024-03-06	Enhancement: - Changed mapping of the field "Id" from "metadata.product_log_id" to "principal.user.userid". - Changed mapping of the field "CreatedById" from "principal.user.userid" to "principal.resource.attribute.labels". - Mapped "IsDeleted" to "principal.resource.attribute.labels". - Mapped "LogFileLength" to "principal.resource.attribute.labels". - Mapped "LogFileContentType" to "principal.resource.attribute.labels". - Mapped "ApiVersion" to "principal.resource.attribute.labels". - Mapped "LogFile" to "principal.resource.attribute.labels".
2023-02-24	Enhancement- - "security_result.action" mapped to ALLOW instead of BLOCK if the action is "LOGIN_NO_ERROR". - For "Login" events : - "action" mapped to "security_result.action". - "target_user_name" mapped to "target.user.userid". - "tls_protocol" mapped to "network.tls.version_protocol". - "cipher_suite" mapped to "network.tls.cipher". - Added "on_error" check for "OsVersion" and "date" block.
2022-12-13	Enhancement- -Mapped "LoginType" to "security_result.description". -Mapped "LoginUrl" to "principal.url". -Added empty check for "ApiType" and "LoginGeo.City".
2022-09-02	Enhancement- Migrated the custom parsers into default parser.
2022-07-04	Enhancement- - Enhanced the parser to parse the logs having event_type 'LoginHistory'. - Added condition to parse different formats of timestamp. - Added condition for event_type 'USER_UNCATEGORIZED' where 'user_id' or 'UserId' or 'target_user_name' is not null. - Added validation for parsing src_ip.
2022-04-18	Enhancement-Modified mapping for DOWNLOAD_FORMAT from 'metadata.ingestion_labels' to 'target.resource.attribute.labels'.
2022-03-30	Enhancement-Changed event_type for 'LoginEventStream' to USER_LOGIN. Corrected mapping for the fields DOWNLOAD_FORMAT and ConnectedAppId. Added mappings for certain fields when log is of type LoginEventStream, WaveDownload, ApiEventStream.