We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for CSV_CUSTOM_IOC

Date	Changes
2025-08-01	Enhancement: - Added grok patterns to parse unparsed logs. - event.idm.entity.metadata.threat.first_discovered_time: Newly mapped first_discovered_str raw log field to event.idm.entity.metadata.threat.first_discovered_time. - event.idm.entity.metadata.threat.category_details: Newly mapped threat_summary raw log field to event.idm.entity.metadata.threat.category_details. - event.idm.entity.metadata.threat.last_updated_time: Newly mapped last_updated_str raw log field to event.idm.entity.metadata.threat.last_updated_time. - event.idm.entity.metadata.interval.start_time: Newly mapped date_added raw log field to event.idm.entity.metadata.interval.start_time. - event.idm.entity.entity.file.sha256: if indicator_value matches `^[a-fA-F0-9]{64}$` then map indicator_value to event.idm.entity.entity.file.sha256. - event.idm.entity.entity.file.sha1: if indicator_value matches `^[a-fA-F0-9]{40}$` then map indicator_value to event.idm.entity.entity.file.sha1. - if indicator_type is set to URL then set event.idm.entity.metadata.entity_type to URL. - if indicator_type is set to HASH then set event.idm.entity.metadata.entity_type to FILE. - if indicator_type is set to IP then set event.idm.entity.metadata.entity_type to IP_ADDRESS. - Set event.idm.entity.metadata.product_name to Proofpoint Threat Intelligence. - Set event.idm.entity.metadata.vendor_name to Proofpoint. - Set event.ioc.confidence_score to HIGH. - event.ioc.description: Newly mapped campaign raw log field to event.ioc.description. - event.idm.entity.metadata.threat.description: Newly mapped campaign raw log field to event.idm.entity.metadata.threat.description. - event.idm.entity.entity.hostname: Newly mapped hostname raw log field to event.idm.entity.entity.hostname. - event.ioc.domain_and_ports.domain: Newly mapped hostname raw log field to event.ioc.domain_and_ports.domain.
2024-02-15	Enhancement: - When `itype` is `md5` and `value` is sha256 format, then mapped `value` to `entity.entity.file.sha256`. - When `itype` is `md5` and `value` is sha1 format, then mapped `value` to `entity.entity.file.sha1`.
2024-02-12	Enhancement: - Added support for domain, URL, md5, file and email type logs. - Mapped `email` to `entity.entity.user.email_addresses`.
2024-02-02	Enhancement: - Added support to new format logs. - Mapped `srcip` to `entity.entity.ip` and `ioc.ip_and_ports.ip_address`. - Mapped `classification` to `threat.category_details`. - Mapped `confidence` to `threat.confidence_score`. - Mapped `resource_uri` to `threat.url_back_to_product`. - Mapped `country` to `entity.entity.location.country_or_region`. - Mapped `lat` to `entity.entity.location.region_latitude`. - Mapped `lon` to `entity.entity.location.region_longitude`. - Mapped `md5` to `entity.entity.file.md5`. - Mapped `domain` to `entity.entity.hostname`. - Mapped `date_first` to `threat.first_discovered_time`. - Mapped `date_last` to `threat.last_updated_time`. - Mapped `id` to `entity.metadata.product_entity_id`. - Mapped `detail2` to `threat.description`. - Mapped `detail` to `threat.summary`. - Mapped `asn`, `import_session_id`, `itype`, `maltype`, `media`, `media_type`, `org`, `source`, `source_feed_id`, `state`, `trusted_circle_ids` and `update_id` to `threat.detection_fields`.
2023-09-11	- Added support for file type logs and mapped them as ENTITY data.
2022-05-20	Enhancement: - Added support for storing ENTITY data. - Added support for IOC domains, IPs, and URLs in Custom IOC (CSV).