We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for TRELLIX_HX_AUDIT

Date	Changes
2026-02-20	Enhancement: - Mapped `applianceId` itemList attribute to `metadata.product_deployment_id`.
2026-02-18	Enhancement: - Mapped target.process.file to target.file for PROCESS_MODULE_LOAD events.
2025-11-14	Enhancement: - Fixed bug where values of the `Registry value base64` label from one event in a list of XML audits may bleed into another. - Added mappings to `network` from same values used in `target.network`. - Removed dropping of events from loops.
2025-09-18	Enhancement: - Added mapping to `target.registry.registry_value_type` for registry audits. - Added mapping to `target.hostname` for dnsLookupEvent audits. - Fixed parsing of `principal.process.parent_process.pid`. - Fixed parsing of `Writes`, `Number of Bytes Seen Written`, `Lowest File Offset Seen` `Closed`, and `Open Duration` target labels for FILE_MODIFICATION events. - Fixed parsing of `process.file.full_path`.
2025-07-21	Enhancement: - Added mapping to `target.process.parent_process` to `processEvent` events.
2025-07-19	Enhancement: - Correctly map target.port for urlMonitorEvent events. - Remove hostname from target.url for urlMonitorEvent events. The hostname is already present in target.hostname and may give the impression that the URL is fully qualified.
2025-05-06	Populate target.labels `Device Path` for imageLoadEvent events.
2025-02-10	Newly created parser. `ipv4NetworkEvent` mapped.