Change log for TRENDMICRO_APEX_CENTRAL

Date	Changes
2024-12-04	Enhancement: - When "cn2Label" is "Second_Action" and "cn2" is "1" then mapped "var_cn2_label.value" to "N/A". - When "cn2Label" is "Second_Action" and "cn2" is "0" then mapped "var_cn2_label.value" to "Unknown". - When "cn2Label" is "Second_Action" and "cn2" is "2" then mapped "var_cn2_label.value" to "Clean". - When "cn2Label" is "Second_Action" and "cn2" is "3" then mapped "var_cn2_label.value" to "Delete". - When "cn2Label" is "Second_Action" and "cn2" is "4" then mapped "var_cn2_label.value" to "Move". - When "cn2Label" is "Second_Action" and "cn2" is "5" then mapped "var_cn2_label.value" to "Rename". - When "cn2Label" is "Second_Action" and "cn2" is "6" then mapped "var_cn2_label.value" to "Pass/Log". - When "cn2Label" is "Second_Action" and "cn2" is "7" then mapped "var_cn2_label.value" to "Strip". - When "cn2Label" is "Second_Action" and "cn2" is "8" then mapped "var_cn2_label.value" to "Drop". - When "cn2Label" is "Second_Action" and "cn2" is "9" then mapped "var_cn2_label.value" to "Quarantine".
2024-09-23	- Changed the `fileHash` field to lowercase. - Mapped "dntdom" to "target.administrative_domain". - Mapped "event_name" to "security_result.threat_name". - Mapped "dhost" to "principal.hostname". - Mapped "filePath" to "target.file.full_path". - Mapped "duser" to "target.user.userid". - Mapped "cs3" to "metadata.product_version". - Mapped "cs6" to "additional.fields". - Mapped "product_version" to "additional.fields". - Mapped "cat" to "additional.fields". - Mapped "msg" to "additional.fields". - Mapped "TMCMLogDetectedIP" to "additional.fields". - Mapped "dvchost" to "additional.fields". - Mapped "cnt" to "security_result.verdict_info.malicious_count". - Mapped "cs4" to "security_result.category_details".
2024-09-23	- Changed the `fileHash` field to lowercase. - Mapped "dntdom" to "target.administrative_domain". - Mapped "event_name" to "security_result.threat_name". - Mapped "dhost" to "principal.hostname". - Mapped "filePath" to "target.file.full_path". - Mapped "duser" to "target.user.userid". - Mapped "cs3" to "metadata.product_version". - Mapped "cs6" to "additional.fields". - Mapped "product_version" to "additional.fields". - Mapped "cat" to "additional.fields". - Mapped "msg" to "additional.fields". - Mapped "TMCMLogDetectedIP" to "additional.fields". - Mapped "dvchost" to "additional.fields". - Mapped "cnt" to "security_result.verdict_info.malicious_count". - Mapped "cs4" to "security_result.category_details".
2024-08-12	- When "dvchost" is available, then mapped "metadata.event_type" to "STATUS_UPDATE".
2024-04-24	- Added support for new event type "Endpoint Application Control"
2024-04-03	- Added new attributes and support for customer specific new log format (CEF).