Change log for BRO_JSON
| Date | Changes |
|---|---|
| 2026-06-02 | - `principal.ip`: Updated the logic to map `id.orig_h` raw log field with `principal.ip` UDM field regardless of the value of `local_orig` raw log field value.
- `target.ip`: Updated the logic to map `id.resp_h` raw log field with `target.ip` UDM field regardless of the value of `local_orig` raw log field value. - `principal.port`: Updated the logic to map `id.orig_p` raw log field with `principal.port` UDM field regardless of the value of `local_orig` raw log field value. - `target.port`: Updated the logic to map `id.resp_p` raw log field with `target.port` UDM field regardless of the value of `local_orig` raw log field value. |
| 2026-03-26 | - `target.url`: Updated the logic to check whether the `host` and 'uri` raw log fields have same value, before concatenating them to set the `target.url` UDM field for http log type.
|
| 2024-05-01 | Updated the deprecated UDM fields. |
| 2024-01-31 | Handled the extra spaces in the `regex` condition while setting the log types. |
| 2023-11-29 | Aligned 'principal/target.hostname' and 'principal/target.asset.hostname' mapping. |
| 2023-10-04 | Added mapping to "network.tls.certificate.md5", "network.tls.certificate.sha1" and "network.tls.certificate.sha256". |
| 2023-06-14 | Updated the parser to include "parse_network_http_user_agent" to use "Parsed User Agent" and "User Agent". |
| 2022-09-28 | Promoted BRO_JSON parser to default.
For the field mapping differences, see field mapping changes |