Change log for SURICATA_EVE

Date	Changes
2024-09-11	Enhancement: - Mapped "discovery" to "additional.fields".
2024-08-22	Enhancement: - When "app_proto" is a valid enum value, then mapped to "network.application_protocol" else mapped it to "additional.fields". - Mapped "dns.rrtype" to "network.dns.questions.type". - Mapped "dns.rrname" to "network.dns.questions.name". - Mapped "dns.id" to "network.dns.id". - Mapped "see_id" to "network.session_id". - Mapped "flow_id" to "additional.fields".
2024-05-16	Enhancement: - Declared fields "direction", "dstnetwork", and "application_port".
2024-04-17	Enhancement: - Mapped "payload_printable" to "additional.fields".
2022-08-17	Enhancement - - Mapped dest_ip to target.ip. - Modified mapping of security_result.severity from critical to high where severity is 1. - Added a grok to parse logs with syslog header.
2022-07-25	Enhancement - - Mapped "process.executable" to "principal.process.file.full_path". - Mapped "process.pid" to "principal.process.pid". - Mapped "process.command_line" to "principal.process.command_line". - Mapped "service.type" to "additional.fields". - Mapped "event.dataset" to "about.labels". - Mapped "event.module" to "about.labels". - Mapped "event.duration" to "about.labels". - Mapped "agent.id" to "metadata.product_log_id". - Mapped "agent.type" to "metadata.product_event_type". - Mapped "agent.version" to "metadata.product_version". - Mapped "agent.hostname" to "principal.hostname". - Mapped "agent.name" to "principal.hostname". - Mapped "agent.ephemeral_id" to "additional.fields". - Mapped "ecs.version" to "principal.asset.attribute.labels". - Mapped "process.args" to "about.file.capabilities_tags".
2022-07-08	Enhancement - Added mappings for following fields : - 'tls.sni' mapped to 'target.hostname'. - 'tls.issuerdn' mapped to 'network.tls.client.certificate.issuer'. - 'tls.subject' mapped to 'network.tls.client.certificate.subject'. - 'tls.serial' mapped to 'network.tls.client.certificate.serial'. - 'tls.fingerprint' mapped to 'network.tls.client.certificate.sha256'. - 'tls.version' mapped to 'network.tls.version'. - 'tls.ja3.hash' mapped to 'network.tls.client.ja3'. - 'tls.ja3s.hash' mapped to 'network.tls.server.ja3s'. - 'tls.notbefore' mapped to 'network.tls.client.certificate.not_before'. - 'tls.notafter' mapped to 'network.tls.client.certificate.not_after'. - 'tls.sni' mapped to 'network.tls.client.server_name'. - Modified the mappings for following fields : - if 'alert.severity' has values 0,1,2 then 'security_result.severity' mapped to CRITICAL. - if 'alert.severity' has values 3,4 then 'security_result.severity' mapped to HIGH. - if 'alert.severity' has values 5,6,7 then 'security_result.severity' mapped to LOW.