We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for FORESCOUT_EYEINSPECT

Date	Changes
2025-12-05	Enhancement: - Added support for JSON format. - event.idm.read_only_udm.intermediary.hostname: Newly mapped `deviceDnsDomain` raw log field to `event.idm.read_only_udm.intermediary.hostname`. - event.idm.read_only_udm.additional.fields: Newly mapped `cnt` raw log field to `event.idm.read_only_udm.additional.fields`. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `time` raw log field to `event.idm.read_only_udm.metadata.event_timestamp`. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `alertId` raw log field to `event.idm.read_only_udm.metadata.product_log_id`. - event.idm.read_only_udm.principal.ip: Newly mapped `srcIp` raw log field to `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`. - event.idm.read_only_udm.principal.mac: Newly mapped `srcMac` raw log field to `event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac`. - event.idm.read_only_udm.principal.hostname: Newly mapped `srcHostName` raw log field to `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname`. - event.idm.read_only_udm.principal.port: Newly mapped `srcPort` raw log field to `event.idm.read_only_udm.principal.port`. - event.idm.read_only_udm.principal.file.sha1: Newly mapped `pcapSha1` raw log field to `event.idm.read_only_udm.principal.file.sha1`. - event.idm.read_only_udm.target.ip: Newly mapped `dstIp` raw log field to `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`. - event.idm.read_only_udm.target.mac: Newly mapped `dstMac` raw log field to `event.idm.read_only_udm.target.mac` and `event.idm.read_only_udm.target.asset.mac`. - event.idm.read_only_udm.target.hostname: Newly mapped `dstHostName` raw log field to `event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname`. - event.idm.read_only_udm.target.port: Newly mapped `dstPort` raw log field to `event.idm.read_only_udm.target.port`. - event.idm.read_only_udm.observer.hostname: Newly mapped `sensorName` raw log field to `event.idm.read_only_udm.observer.hostname`. - event.idm.read_only_udm.network.ip_protocol: Newly mapped `l4Proto` raw log field to `event.idm.read_only_udm.network.ip_protocol`. - event.idm.read_only_udm.network.sent_bytes: Newly mapped `upDataLength` raw log field to `event.idm.read_only_udm.network.sent_bytes`. - event.idm.read_only_udm.network.received_bytes: Newly mapped `downDataLength` raw log field to `event.idm.read_only_udm.network.received_bytes`. - event.idm.read_only_udm.security_result.rule_id: Newly mapped `typeId` raw log field to `event.idm.read_only_udm.security_result.rule_id`. - event.idm.read_only_udm.security_result.rule_name: Newly mapped `name` raw log field to `event.idm.read_only_udm.security_result.rule_name`. - event.idm.read_only_udm.security_result.category_details: Newly mapped `alertCategory` raw log field to `event.idm.read_only_udm.security_result.category_details`. - event.idm.read_only_udm.security_result.attack_details.tactics.name: Newly mapped `mitreTacticsId` raw log field to `event.idm.read_only_udm.security_result.attack_details.tactics.name`. - event.idm.read_only_udm.security_result.attack_details.techniques.name: Newly mapped `mitreTechniquesId` raw log field to `event.idm.read_only_udm.security_result.attack_details.techniques.name`. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `l2Proto`, `l3Proto`, `srcMacVendor`, `dstMacVendor`, `status` raw log fields to `event.idm.read_only_udm.security_result.detection_fields`. - Moved the mapping for `event.idm.read_only_udm.intermediary` to apply to both CEF and JSON formats.
2025-04-23	- Map domain name to `network.dns.questions.name` when application protocol is DNS. - Map answers to `network.dns.answers.data` when application protocol is DNS.
2025-03-12	- Newly created parser. - Mapped `app_protocol_src` to `network.application_protocol`. - Mapped `Source` to `principal.ip` if it is an IP address, otherwise to `principal.hostname`. - Mapped `Target` to `target.ip` if it is an IP address, otherwise to `target.hostname`. - Mapped `user_name` to `principal.user.userid`. - Mapped `type` to `additional.fields` - Mapped `session_id` to `network.session_id`. - Mapped `product` to `metadata.product_name`. - Mapped `pid` to `intermediary.process.pid`. - Mapped `iporhost` to `intermediary.ip` if it is an IP address, otherwise to `intermediary.hostname`. - Mapped `Rule` to `security_result.rule_id`. - Mapped `Match` to `security_result.rule_name`. - Mapped `Category` and `policy_details` to `security_result.description`. - Mapped `Destination` to `target.ip` if it is an IP address, otherwise to `target.hostname`. - Mapped `port` to `target.port`. - Mapped `Host` to `principal.ip` if it is an IP address, otherwise to `principal.hostname`. - Mapped `Target` to `target.ip` if it is an IP address, otherwise to `target.hostname`. - Mapped `Service` to `target.port` and `network.ip_protocol`. - Mapped `Reason` to `security_result.description`. - Mapped `mail_from` to `network.email.from`. - Mapped `mail_to` to `network.email.to`. - Mapped `mail_subject` to `network.email.subject`. - Mapped `event_type` to `security_result.summary`. - Mapped `log_description` to `security_result.summary`. - Mapped `details` to `security_result.description`. - Mapped `CPU_usage`, `Available_memory`, `Used_memory`, `Available_swap`, `Used_swap` to `additional.fields`. - Mapped `application_status`, `Connected_clients`, `EM_connection_status`, `Assigned_hosts`, `Engine_status`, `Installed_Plugins` to `additional.fields`. - Mapped `User` to `principal.user.userid`. - Mapped `Hostname` to `principal.hostname` and `principal.asset.hostname`. - Mapped `MAC` to `principal.mac`. - Mapped `src_ip` to `principal.ip` and `principal.asset.ip`. - Mapped `user_id` to `principal.user.userid`. - Mapped `act` to `security_result.description`. - Mapped `alart_id` to `security_result.rule_id`. - Mapped `src_mac` to `principal.mac`. - Mapped `dest_mac` to `target.mac`. - Mapped `src_port` to `principal.port`. - Mapped `dest_port` to `target.port`. - Mapped `dest_ip` to `target.ip` and `target.asset.ip`. - Mapped `severity` to `security_result.severity_details`. - Mapped `threat` to `security_result.threat_name`. - Mapped `protocol1` to `network.ip_protocol`. - Mapped `protocol2` to `security_result.detection_fields`. - Mapped `resource` to `security_result.about.resource.attribute.labels`. - Mapped `desc` to `metadata.description`.