Change log for TANIUM_AUDIT
| Date | Changes |
|---|---|
| 2024-05-16 | Enhancement:
- Added support for JSON logs. - Mapped "object_id" to "target.resource.product_object_id". - Mapped "object_name" to "target.resource.name". - Mapped "audit_name" to "metadata.description". - Mapped "creation_time" to "target.resource.attribute.creation_time". - Mapped "modification_time" to "target.resource.attribute.last_update_time". - Mapped "last_modified_by" and "modifier_user_id" to "principal.resource.attribute.labels". - Mapped "User" to "principal.user.userid". - Mapped "session_id" to "network.session_id". - Mapped "authentication_type" to "principal.user.attribute.labels". - Mapped "ip_address" to "principal.ip" and "principal.asset.ip". - Mapped "audit_row_id", "type", and "audit_type" to "additional.fields". - Mapped "type_name" to "metadata.product_event_type". - Mapped "object_type_name" to "target.resource.attribute.labels". |
| 2023-09-26 | Enhancement:
- Added "on_error" check for date filter. - Added a Grok pattern to support new log format. - Mapped "Issuer", "ActionName", "PackageName", "StartTime", "Expiration", "InsertTime" and "DistributeOver" to "additional.fields". |
| 2022-06-08 |