We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for THYCOTIC

Date	Changes
2024-10-08	Enhancement: - Defined the `msg` field in a mutate replace filter.
2024-06-04	Enhancement: - Added a Grok block to parse unparsed logs. - Mapped `Host` and `server` to `principal.hostname` and `principal.asset.hostname`. - Mapped `Container_Id` to `principal.asset.asset_id`. - Mapped `Container_name` to `principal.resource.name`.
2023-09-22	Enhancement: - Modified the Grok pattern to parse unparsed logs. - Added `on_error` check for fields `rt` and `ts`.
2023-06-12	Enhancement - - Modified the Grok pattern to parse new log format. - Mapped `fname` to `additional.fields`. - Mapped `cs2` to `additional.fields`. - Mapped `details` to `additional.fields` and `security_result.summary`.
2022-08-01	Enhancement - Mapped the following fields for logs in JSON format : - `device_version` to `metadata.product_version`. - `agent.id` to `observer.asset_id`. - `agent.version` to `observer.platform_version`. - `agent.hostname` to `observer.hostname`. - `agent.type` to `observer.application`. - `agent.name` to `observer.user.userid`. - `agent.ephemeral_id` to `observer.labels`. - `log.source.address` to `principal.ip`. - `host.hostname` to `principal.hostname`. - `host.id` to `principal.asset.asset_id`. - `host.os.kernel` to `principal.platform_patch_level`. - `host.os.version` to `principal.platform_version`. - `host.os.platform` to `principal.platform`. - `host.architecture` to `principal.asset.hardware.cpu_platform`. - `syslog_severity` to `security_result.severity`. - Parsed logs with type `SECRET - SECRETPASSWORDCHANGEFAILURE`.