From 9eb07d23d294b5739d56c5b8f943abe5f35b804f Mon Sep 17 00:00:00 2001 From: Julian Crowley Date: Fri, 14 Feb 2025 10:54:05 -0700 Subject: [PATCH 1/2] Create 2025-02-14-content.md --- blog-cse/2025-02-14-content.md | 43 ++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 blog-cse/2025-02-14-content.md diff --git a/blog-cse/2025-02-14-content.md b/blog-cse/2025-02-14-content.md new file mode 100644 index 0000000000..2e3c335287 --- /dev/null +++ b/blog-cse/2025-02-14-content.md @@ -0,0 +1,43 @@ +--- +title: February 14th, 2025 - Content Release +image: https://help.sumologic.com/img/sumo-square.png +keywords: + - log mappers + - parsers +hide_table_of_contents: true +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +icon + +This content release includes: +- New and updated mappers and parsers for Carbon Black, Cisco ISE, Cisco Umbrella, PAN Firewall CSV and LEEF, and Signal Science (Fastly) WAF. +- :heart: + +Changes are enumerated below. + +## Log Mappers +- [New] Carbon Black Cloud - alert event +- [Updated] Cisco ISE Radius Diagnostics + - Supports additional Radius Diagnostic messages +- [Updated] Cisco Umbrella DNS Logs + - Adds `dstDevice_ip`, `normalizedAction`, and `user_email` +- [Updated] Cisco Umbrella IP Logs + - Adds alternate value for `dstDevice_ip` and adds `user_email` +- [Updated] Cisco Umbrella Proxy Logs + - Adds `user_email` + +## Parsers +- [Updated] /Parsers/System/VMware/Carbon Black Cloud + - Adds support for alert event event ID +- [Updated] /Parsers/System/Cisco/Cisco ISE + - Adds key value parsing for descriptions +- [Updated] /Parsers/System/Cisco/Cisco Umbrella CSV + - Adds a transform for capturing email addresses +- [Updated] /Parsers/System/Palo Alto/PAN Firewall CSV + - Modifies `parse_system_format_1` regular expression to support additional events +- [Updated] /Parsers/System/Palo Alto/PAN Firewall LEEF + - Normalizes parsing of subtype to have consistent case +- [Updated] /Parsers/System/Signal Science/Signal Science WAF + - Adds additional timestamp handling From 1107d8e189de5007a1810b01774a997c9f1fc4ae Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Fri, 14 Feb 2025 12:09:49 -0600 Subject: [PATCH 2/2] Updates from review --- blog-cse/2025-02-14-content.md | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/blog-cse/2025-02-14-content.md b/blog-cse/2025-02-14-content.md index 2e3c335287..725aa48e65 100644 --- a/blog-cse/2025-02-14-content.md +++ b/blog-cse/2025-02-14-content.md @@ -11,33 +11,33 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; icon -This content release includes: +This content release includes: - New and updated mappers and parsers for Carbon Black, Cisco ISE, Cisco Umbrella, PAN Firewall CSV and LEEF, and Signal Science (Fastly) WAF. - :heart: Changes are enumerated below. -## Log Mappers +### Log Mappers - [New] Carbon Black Cloud - alert event - [Updated] Cisco ISE Radius Diagnostics - - Supports additional Radius Diagnostic messages + - Supports additional Radius Diagnostic messages. - [Updated] Cisco Umbrella DNS Logs - - Adds `dstDevice_ip`, `normalizedAction`, and `user_email` + - Adds `dstDevice_ip`, `normalizedAction`, and `user_email`. - [Updated] Cisco Umbrella IP Logs - - Adds alternate value for `dstDevice_ip` and adds `user_email` + - Adds alternate value for `dstDevice_ip` and adds `user_email`. - [Updated] Cisco Umbrella Proxy Logs - - Adds `user_email` + - Adds `user_email`. -## Parsers +### Parsers - [Updated] /Parsers/System/VMware/Carbon Black Cloud - - Adds support for alert event event ID + - Adds support for alert event event ID. - [Updated] /Parsers/System/Cisco/Cisco ISE - - Adds key value parsing for descriptions + - Adds key value parsing for descriptions. - [Updated] /Parsers/System/Cisco/Cisco Umbrella CSV - - Adds a transform for capturing email addresses + - Adds a transform for capturing email addresses. - [Updated] /Parsers/System/Palo Alto/PAN Firewall CSV - - Modifies `parse_system_format_1` regular expression to support additional events + - Modifies `parse_system_format_1` regular expression to support additional events. - [Updated] /Parsers/System/Palo Alto/PAN Firewall LEEF - - Normalizes parsing of subtype to have consistent case + - Normalizes parsing of subtype to have consistent case. - [Updated] /Parsers/System/Signal Science/Signal Science WAF - - Adds additional timestamp handling + - Adds additional timestamp handling.