Change log for VMWARE_NSX

Date Changes
2024-09-25 Enhancement :
- When "action" is "DROP" then set "security_result.action" to "BLOCK".
- When "action" is not null then mapped "action" to "security_result.action_details".
2024-07-09 Enhancement :
- Added "gsub" to replace "\\r\\n" from the message.
2024-06-17 Enhancement :
- Added Grok patterns to parse newly ingested logs.
- Mapped "type" to "metadata.product_event_type".
- Mapped "protocol" to "network.ip_protocol".
- Mapped "rule_id" to "security_result.rule_id".
- When "direction" is "IN", then mapped "network.direction" to "INBOUND".
- When "action" is "PASS", then mapped "security_result.action_details" to "ALLOW".
- When "action" is "FAIL", then mapped "security_result.action_details" to "BLOCK".
- When "src_ip" and "dst_ip" are not null, then mapped "metadata.event_type" to "NETWORK_CONNECTION".
2024-06-10 Enhancement :
- Added a new Grok pattern to parse a new format of SYSLOG logs.
2023-11-15 Enhancement :
- From "Old Value" field:
- Mapped "unique_id" to "principal.resource.product_object_id".
- Mapped "resource_type" to "principal.resource.sub_type".
- Mapped "_create_user","_last_modified_user" to "principal.user.email_addresses".
- Mapped "action" to "security_result.action".
- Mapped "rule_id" to "security_result.rule_id".
- Mapped "display_name" to "principal.resource.name".
- Mapped "_last_modified_time" to "principal.resource.attribute.last_update_time".
- Mapped "_create_time" to "principal.resource.attribute.creation_time".
- Mapped "parent_path" to "principal.resource.parent".
- Mapped "path" to "principal.process.file.full_path".
- Mapped "id" to "principal.resource.id".
- From New Value field:
- Mapped "resource_type" to "target.resource.sub_type".
- Mapped "unique_id" to "target.resource.product_object_id".
- Mapped "path" to "target.process.file.full_path".
- Mapped "display_name" to "target.resource.name".
- Mapped "id" to "target.resource.id".
- Mapped "vmw_host" to "target_details.hostname or target_details.ip" based on value in vmw_host.
- Mapped "vmw_product" to "target.application".
- Mapped "vmw_vcenter" to "target.cloud.availability_zone".
- Mapped "vmw_cluster" to "target.resource.name".
- Mapped "vmw_object_id" to "target.resource.product_object_id".
- Mapped "vmw_datacenter" to "target.resource.attribute.labels".
- Mapped "vmw_vcenter_id" to "target.resource.attribute.labels".
- Mapped "vmw_vr_ops_logtype" to "intermediary.resource.attribute.labels".
- Mapped "vmw_vr_ops_appname" to "intermediary.application".
- Mapped "vmw_vr_ops_hostname" to "intermediary.hostname".
- Mapped "vmw_vr_ops_nodename" to "intermediary.resource.attribute.labels".
- Mapped "vmw_vr_ops_clustername" to "intermediary.resource.name".
- Mapped "vmw_vr_ops_clusterrole" to "intermediary.resource.attribute.labels.roles.name".
- Mapped "vmw_vr_ops_id" to "intermediary.resource.product_object_id".
2023-10-13 Enhancement :
- Modified a Grok pattern to parse "sourceIp" with ports.
- Mapped "vmw_host","vmw_product","vmw_vcenter","vmw_cluster","vmw_vr_ops_id","vmw_object_id","vmw_datacenter","vmw_vcenter_id","vmw_vr_ops_logtype","vmw_vr_ops_appname","vmw_vr_ops_hostname","vmw_vr_ops_nodename","vmw_vr_ops_clustername","vmw_vr_ops_clusterrole","managedExternally","update","filepath","eventType","resourceId" to "principal.resource.attribute.labels".
- Mapped fields in "payload" to "principal.resource.attribute.labels".
- Mapped "client" to "principal.ip"
- Mapped fields in "new_value" to "target.resource.attribute.labels".
2023-10-03 Enhancement :
- Added a Grok pattern to check if "sourceIp" is a valid IP address or not prior mapping it to UDM field.
2023-09-12 Enhancement :
- Added support for syslog logs that have "New value" and "Old value" fields.
2023-06-26 Enhancement:
- Mapped values in "PASS", "DROP", "REJECT", "NAT", "NONAT", "RDR", "NORDR", "PUNT", "REDIRECT", and "COPY" to "additional.fields" key as "Network_Status".
2023-03-07 Enhancement:
- Mapped "errorCode" to "security_result.detection_fields".
- Mapped "app_type" to "principal.application".
- Mapped "tname", "s2comp", "node" to "principal.resource.attribute.labels".
- Mapped "exe" to "target.process.file.full_path".
- Mapped "dst_ip" to "target.ip".
- Mapped "ses" to "network.session_id".
- Mapped "hostname" to "principal.ip".
- Mapped "direction" to "network.direction".
- Mapped "reqId" to "metadata.product_log_id".
2022-06-10 Newly created parser