Change log for FORTINET_SANDBOX
| Date | Changes |
|---|---|
| 2026-08-21 |
- event.idm.read_only_udm.metadata.product_event_type: Newly mapped type and subtype raw log fields with event.idm.read_only_udm.metadata.product_event_type UDM field.- event.idm.read_only_udm.network.ip_protocol: Newly mapped proto raw log field with event.idm.read_only_udm.network.ip_protocol UDM field.- event.idm.read_only_udm.network.email.from: Newly mapped emailsndr raw log field with event.idm.read_only_udm.network.email.from UDM field.- event.idm.read_only_udm.network.email.to: Newly mapped emailrcvr raw log field with event.idm.read_only_udm.network.email.to UDM field.- event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip: Newly mapped srcip raw log field with event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip UDM fields.- event.idm.read_only_udm.target.ip and event.idm.read_only_udm.target.asset.ip: Newly mapped dstip raw log field with event.idm.read_only_udm.target.ip and event.idm.read_only_udm.target.asset.ip UDM fields.- event.idm.read_only_udm.principal.port: Newly mapped srcport raw log field with event.idm.read_only_udm.principal.port UDM field.- event.idm.read_only_udm.target.port: Newly mapped dstport raw log field with event.idm.read_only_udm.target.port UDM field.- event.idm.read_only_udm.network.email.subject: Newly mapped subject raw log field with event.idm.read_only_udm.network.email.subject UDM field.- event.idm.read_only_udm.target.file.full_path: Newly mapped fname raw log field with event.idm.read_only_udm.target.file.full_path UDM field.- event.idm.read_only_udm.security_result.rule_name: Newly mapped rsrc raw log field with event.idm.read_only_udm.security_result.rule_name UDM field.- event.idm.read_only_udm.security_result.action: Newly mapped rating and risk raw log fields with event.idm.read_only_udm.security_result.action UDM field.- event.idm.read_only_udm.additional.fields: Newly mapped ftype, jobid, jstatus, scantime, subtime, scanstart, scanend, clientdev, clientname, clientvd, and stype raw log fields with event.idm.read_only_udm.additional.fields UDM field.- event.idm.read_only_udm.about.url: Newly mapped url raw log field with event.idm.read_only_udm.about.url UDM field.- event.idm.read_only_udm.target.user.userid: Newly mapped suser raw log field with event.idm.read_only_udm.target.user.userid UDM field.- event.idm.read_only_udm.security_result.severity: Newly mapped level raw log field with event.idm.read_only_udm.security_result.severity UDM field.- event.idm.read_only_udm.target.file.md5: Newly mapped md5 raw log field with event.idm.read_only_udm.target.file.md5 UDM field.- event.idm.read_only_udm.target.file.sha1: Newly mapped sha1 raw log field with event.idm.read_only_udm.target.file.sha1 UDM field.- event.idm.read_only_udm.target.file.sha256: Newly mapped sha256 raw log field with event.idm.read_only_udm.target.file.sha256 UDM field.- event.idm.read_only_udm.security_result.threat_name: Newly mapped mname raw log field with event.idm.read_only_udm.security_result.threat_name UDM field.- event.idm.read_only_udm.security_result.category_details: Newly mapped mcate raw log field with event.idm.read_only_udm.security_result.category_details UDM field.- event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped date, time, and tz raw log fields with event.idm.read_only_udm.metadata.collected_timestamp UDM field.- event.idm.read_only_udm.security_result.action_details: Newly mapped action raw log field with event.idm.read_only_udm.security_result.action_details UDM field.- event.idm.read_only_udm.security_result.severity_details: Newly mapped rating raw log field with event.idm.read_only_udm.security_result.severity_details UDM field.
|
| 2025-02-26 | - Newly created parser. |