Change log for RUCKUS_WIRELESS
| Date | Changes |
|---|---|
| 2025-10-31 |
- Added new Grok patterns to parse the unparsed logs. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped sequenceId raw log field with event.idm.read_only_udm.metadata.product_log_id UDM field.- event.idm.read_only_udm.metadata.product_event_type: Newly mapped type raw log field with event.idm.read_only_udm.metadata.product_event_type UDM field.- event.idm.read_only_udm.principal.user.userid: Newly mapped uid, p_user, prin_user, user raw log fields with event.idm.read_only_udm.principal.user.userid UDM field.- event.idm.read_only_udm.principal.user.attribute.labels: Newly mapped auid, subj, p_uid raw log fields with event.idm.read_only_udm.principal.user.attribute.labels UDM field.- event.idm.read_only_udm.principal.process.file.full_path: Newly mapped cwd raw log field with event.idm.read_only_udm.principal.process.file.full_path UDM field.- event.idm.read_only_udm.target.user.userid: Newly mapped acct, t_user, user raw log fields with event.idm.read_only_udm.target.user.userid UDM field.- event.idm.read_only_udm.target.user.attribute.labels: Newly mapped t_uid raw log field with event.idm.read_only_udm.target.user.attribute.labels UDM field.- event.idm.read_only_udm.target.process.command_line: Newly mapped cmd, cmd_line raw log fields with event.idm.read_only_udm.target.process.command_line UDM field.- event.idm.read_only_udm.target.process.file.full_path: Newly mapped exe raw log field with event.idm.read_only_udm.target.process.file.full_path UDM field.- event.idm.read_only_udm.network.session_id: Newly mapped session_id raw log field with event.idm.read_only_udm.network.session_id UDM field.- event.idm.read_only_udm.extensions.auth.auth_details: Newly mapped grantors, auth_method raw log fields with event.idm.read_only_udm.extensions.auth.auth_details UDM field.- event.idm.read_only_udm.security_result.action: Statically mapped to ALLOW or BLOCK based on the value of the res field.- event.idm.read_only_udm.extensions.auth.type: Statically mapped to AUTHTYPE_UNSPECIFIED for certain event types and messages.- event.idm.read_only_udm.security_result.description: Mapped from pam_msg or audit_msg based on parsing success and description field.- event.idm.read_only_udm.security_result.action_details: Mapped from the op field.
|
| 2024-07-02 |
- Added new Grok patterns to parse the unparsed logs. - Mapped summary to security_result.description.
|
| 2023-01-06 | Added new grok patterns to parse the unparsed logs. |
| 2022-09-12 | Newly created parser. |