We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for SYMANTEC_EVENT_EXPORT

Date	Changes
2025-03-06	Enhancement: - Mapped first occurrence of ipv4 or ipv6 from `device_networks` to `intermediary.ip` and all the rest to `principal.asset.ip`.
2025-02-24	Enhancement: - Mapped first IP from `device_networks` to `intermediary.ip` and the rest to `principal.asset.ip`.
2025-02-11	Enhancement: - Mapped first IP from `device_networks` to `principal.asset.ip`.
2025-01-16	Enhancement: - If `id` is in [`1`, `11`], then mapped `security_result.action` to `BLOCK`. Otherwise, if `id` is in [`2`, `3`, `4`, `8`, `13`, `14`, `16`], then mapped `security_result.action` to `ALLOW`. Otherwise, if `id` is in [`5`, `6`, `7`, `15`], then mapped `security_result.action` to `ALLOW_WITH_MODIFICATION`. Otherwise, if `id` is `12`, then mapped `security_result.action` to `QUARANTINE`. Otherwise, if `id` is `0`, then mapped `security_result.action` to `UNKNOWN_ACTION`.
2024-12-04	Enhancement: - Mapped `cybox.path` to `target.file.full_path`. - Mapped `cybox.size` to `target.file.size`. - If `id` is `1` then mapped `security_result.action` to `BLOCK` else if `id` is `2` then mapped `security_result.action` to `ALLOW` else if `id` is in `[`3`,`4`,`5`,`6`,`7`]` then mapped `security_result.action` to `ALLOW_WITH_MODIFICATION` else if `id` is `12` then mapped `security_result.action` to `QUARANTINE`. - Mapped `audit` to `additional.fields`. - If `policy.rulename` has `File and Folder Access Attempts` then mapped `file.name` to `principal.file.names`. - If `device_os_type_id` is `100` then mapped `principal.platform` to `WINDOWS`. - If `device_os_type_id` is `200` then mapped `principal.platform` to `LINUX`. - If `device_os_type_id` is `300` then mapped value `SOLARIS` to `additional.fields` . - If `device_os_type_id` is `301` then mapped value `AIX` to `additional.fields`. - If `device_os_type_id` is `302` then mapped value `HP-UX` to `additional.fields`. - If `device_os_type_id` is `400` then mapped value `MACINTOSH` to `additional.fields`. - If `device_os_type_id` is `500` then mapped `principal.platform` to `IOS`. - If `device_os_type_id` is `501` then mapped `principal.platform` to `ANDROID`. - If `device_os_type_id` is `502` then mapped value `WINDOWS MOBILE` to `additional.fields`. - If `device_os_type_id` is `503` then mapped value `IPADOS` to `additional.fields`. - If `device_os_type_id` is `1001` then mapped value `OTHER` to `additional.fields`. - If `device_os_type_id` is `0` then mapped `principal.platform` to `UNKNOWN`. - Modified the mapping of `product_uid` from `metadata.product_log_id` to `target.process.pid`. - Modified the mapping of `process_id` from `target.process.pid` to `_metadata.product_log_id`.
2024-11-21	Enhancement: - Modified mappings of `severity_id`.
2024-10-25	Enhancement: - Mapped `connection.url.port` to `target.port`. - Mapped `connection.url.host` to `target.hostname` and `target.asset.hostname`. - Mapped `connection.url.domain_name` to `target.administrative_domain`. - Mapped `connection.url.text` to `target.url`. - Mapped `connection.src_name` to `target.application`. - Mapped `parent.file.md5` to `principal.process.parent_process.file.md5`. - Mapped `parent.file.sha1` to `principal.process.parent_process.file.sha1`. - Mapped `parent.file.sha256` to `principal.process.parent_process.file.sha256`. - Mapped `parent.file.folder` to `principal.process.parent_process.file.full_path`. - Mapped `parent.file.product_name`, `parent.file.company_name`, `parent.file.created`, `parent.file.normalized_path`, `parent.file.signature_company_name`, `parent.file.signature_value`, and `parent.file.xattributes.portal` to `principal.resource.attribute.labels`. - Mapped `parent.file.signature_value_ids` to `additional.fields`. - Mapped `parent.file.version` to `network.tls.version`. - Mapped `parent.file.signature_issuer` to `network.tls.server.certificate.issuer`.
2023-11-07	Enhancement: - Added support for SYSLOG format logs. - Added `not null` checks to `parent.cmd_line`, `parent.pid`, `actor.pid`, `actor.cmd_line`, `device_name`, `device_group`, `device_os_name`, `device_group`, `device_domain`, `device_uid` prior mapping to UDM. - Mapped `device_name` to `principal.hostname`. - Mapped `user_name` to `principal.user.user_display_name`. - Mapped `actor.user.name` to `principal.user.user_display_name`. - Mapped `actor.user.domain` to `principal.administrative_domain`. - Mapped `actor.user.sid` to `principal.user.windows_sid`. - Mapped `actor.file.size` to `principal.process.file.size`. - Mapped `device_public_ip` to `principal.ip`. - Mapped `device_networks.ipv6` to `intermediary.ip`. - Mapped `user_email` to `principal.user.email_addresses`.
2022-08-19	Enhancement - Reduced Generic Event percentage. - Mapped `type_id` to event.idm.read_only_udm.metadata.event_type - Parsed logs for type_id = 21