We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for IMPERVA_DB

Date	Changes
2025-02-19	Enhancement: - Added support to parse new logs with SYSLOG+JSON format.
2024-04-09	Enhancement: - Added `gsubs` to handle invalid JSON characters in logs. - Mapped `raw-query` to `security_result.detection_fields`.
2024-01-21	Enhancement: - Added a new Grok pattern to parse unparsed logs of format SYSLOG+JSON. - Mapped `version` to `metadata.product_version`. - Mapped `dest-ip` to `target.ip`. - Mapped `dest-port` to `target.port`. - Mapped `source-ip` to `principal.ip`. - Mapped `source-port` to `principal.port`. - Mapped `db-user` to `principal.user.userid`. - Mapped `os-user` to `principal.user.userid`. - Mapped `protocol` to `network.ip_protocol`. - Mapped `audit-policy` to `security_result.category_details`. - Mapped `server-group`, `service-name`, `user-group`, `raw-query`, `parsed-query`, `bind-variables`, `sql-error`, `db-schema-pair.db-name`, `db-schema-pair.schema-name`, and `objects-list` to `additional.fields`. - Mapped `application-name` to `target.application`. - Mapped `source-application` to `principal.application`. - Mapped `event-id` to `metadata.product_log_id`. - Mapped `event-type` to `metadata.product_event_type`. - Mapped `application-user` to `principal.user.user_display_name`. - Mapped `host-name` to `principal.hostname`. - Mapped `mx-ip`, `gw-ip` to `intermediary.ip`. - Mapped `policy-id` and `user-authenticated` to `security_result.detection_fields`. - If `has_principal` is `true` and `has_target` is `true`, then set `metadata.event_type` as `NETWORK_CONNECTION`. - If `has_principal` is `true`, then set `metadata.event_type` as `STATUS_UPDATE`.
2023-07-17	Bug-Fix - Parsed unparsed raw logs using Grok patterns and `kv` filters. - Mapped `srcPort` to `principal.port`. - Mapped `srcIP` to `principal.ip`. - Mapped `dstIP` to `target.ip`. - Mapped `dstPort` to `target.port`. - Mapped `alertSev` to `security_result.severity`. - Mapped `ruleName` to `security_result.rule_name`. - Mapped `category` to `security_result.category`. - Mapped `group` to `target.user.group_identifiers`. - Mapped `dbName` to `target.resource.name`. - Mapped `policyName` to `security_result.detection_fields`. - Mapped `username` to `principal.user.user_display_name`. - Mapped `evntDesc` to `security_result.description`. - Mapped `action` to `security_result.action_details`.
2023-02-03	Enhancement - Mapped `event_name` to `metadata.product_event_type`.