Change log for JUNIPER_MX

Date	Changes
2025-11-18	Enhancement: - event.idm.read_only_udm.target.ip: Newly mapped `destination_address` raw log field with `event.idm.read_only_udm.target.ip` UDM field. - event.idm.read_only_udm.target.asset.ip: Newly mapped `destination_address` raw log field with `event.idm.read_only_udm.target.asset.ip` UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped `source_address` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped `source_address` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - event.idm.read_only_udm.principal.port: Newly mapped `source_port` raw log field with `event.idm.read_only_udm.principal.port` UDM field. - event.idm.read_only_udm.target.port: Newly mapped `destination_port` raw log field with `event.idm.read_only_udm.target.port` UDM field. - event.idm.read_only_udm.network.ip_protocol: Newly mapped `ip_protocol_out (derived from ip_protocol)` raw log field with `event.idm.read_only_udm.network.ip_protocol` UDM field. - event.idm.read_only_udm.intermediary.hostname: Newly mapped `intermediary_hostname` raw log field with `event.idm.read_only_udm.intermediary.hostname` UDM field. - event.idm.read_only_udm.security_result.outcomes: Newly mapped `outcome` raw log field with `event.idm.read_only_udm.security_result.outcomes` UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `product_id` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `exe`,`key`,`node`, `permitted`, `router`, `ingress_interface`, `collector_id`, `arch`, `syscall`, `exit`, `a0`, `a1`, `a2`, `a3`, `items`, `auid`, `uid`, `gid`, `euid`, `suid`, `fsuid`, `egid`, `sgid`, `fsgid`, `tty`, `ses`, `old_time`, `new_time` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `subtype`, `type` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - Added `UNIX` to the date match patterns for `date_time` field. - Added a new grok pattern to parse logs and extract fields like `intermediary_hostname` and `kv_data_1`. - Added null conditional check for `host`. - event.idm.read_only_udm.principal.process.parent_pid: Newly mapped `ppid` raw log field(s) with `event.idm.read_only_udm.principal.process.parent_pid` UDM field. - event.idm.read_only_udm.principal.process.command_line: Newly mapped `comm` raw log field(s) with `event.idm.read_only_udm.principal.process.command_line` UDM field. - event.idm.read_only_udm.principal.user.userid: Newly mapped `user` raw log field(s) with `event.idm.read_only_udm.principal.user.userid` UDM field.
2025-01-15	Enhancement: - Mapped hostname to "principal.hostname". - Added new Grok patterns to parse a new pattern of syslogs.
2024-10-24	Enhancement: - Added new Grok patterns to parse a new pattern of SYSLOGS.
2024-07-02	Enhancement: - Added new Grok patterns to parse a new pattern of SYSLOGS.
2024-04-15	Enhancement: - Added new Grok patterns to handle a new pattern of SYSLOG logs. - Aligned "target.ip" and "target.asset.ip" mappings. - Aligned "target.hostname" and "target.asset.hostname" mappings. - Aligned "principal.ip" and "principal.asset.ip" mappings. - Aligned "principal.hostname" and "principal.asset.hostname" mappings. - When "metadata.event_type" is "GENERIC_EVENT", and "src_ip" and "dest_ip" is not empty, then set "metadata.event_type" to "NETWORK_CONNECTION". - When "metadata.event_type" is "GENERIC_EVENT", and "src_ip" is not empty, then set "metadata.event_type" to "STATUS_UPDATE".
2023-11-26	Enhancement: - Mapped host sending logs to "intermediary.hostname" instead of "principal.hostname". - Parsed event_type "SSHD_LOGIN_FAILED" and mapped "metadata.event_type" to "USER_LOGIN". - Changed and mapped more appropriate "metadata.event_type' wherever possible.