Change log for BRO_JSON
| Date | Changes |
|---|---|
| 2026-06-02 |
- principal.ip: Updated the logic to map id.orig_h raw log field with principal.ip UDM field regardless of the value of local_orig raw log field value.- target.ip: Updated the logic to map id.resp_h raw log field with target.ip UDM field regardless of the value of local_orig raw log field value.- principal.port: Updated the logic to map id.orig_p raw log field with principal.port UDM field regardless of the value of local_orig raw log field value.- target.port: Updated the logic to map id.resp_p raw log field with target.port UDM field regardless of the value of local_orig raw log field value.
|
| 2026-03-26 |
- target.url: Updated the logic to check whether the host and 'uri raw log fields have same value, before concatenating them to set the target.url` UDM field for http log type.
|
| 2024-05-01 | Updated the deprecated UDM fields. |
| 2024-01-31 |
Handled the extra spaces in the regex condition while setting the log types.
|
| 2023-11-29 |
Aligned principal/target.hostname and principal/target.asset.hostname mapping.
|
| 2023-10-04 |
Added mapping to network.tls.certificate.md5, network.tls.certificate.sha1 and network.tls.certificate.sha256.
|
| 2023-06-14 |
Updated the parser to include parse_network_http_user_agent to use Parsed User Agent and User Agent.
|
| 2022-09-28 |
Promoted BRO_JSON parser to default. For the field mapping differences, see https://cloud.google.com/chronicle/docs/ingestion/default-parsers/field-maps/zeek-map-changes>field mapping changes |