Package aws/vpcflow Release Notes

Package aws/vpcflow Release Notes Version 1.3.1 (2026-03-25)
  • Added observer.ingress.interface.id field mapping from Vendor.interface-id

  • Updated parser version to 1.3.1

Package aws/vpcflow Release Notes Version 1.3.0 (2026-01-20)
  • Enhanced IP address validation using CIDR function for source and destination fields

  • Added network transport protocol mapping based on IANA numbers

  • Improved event action normalization to lowercase format

  • Updated ECS version to 9.2.0 and CPS version to 1.1.0

  • Enhanced CSV header detection with improved regex pattern

Package aws/vpcflow Release Notes Version 1.2.2 (2025-10-20)
  • Updated timestamp parsing to remove explicit timezone parameter

  • Updated parser version to 1.2.2

Package aws/vpcflow Release Notes Version 1.2.1 (2025-05-20)
  • Updated field mapping to use direct assignment instead of rename function

  • Updated ECS version to 8.17.0

  • Updated parser version to 1.2.1

  • Updated parser to use array:append for array declaration

Package aws/vpcflow Release Notes Version 1.2.0
  • Removes header before parsing in certain cases.

  • Reworks logic to drop events when the only data included is the header.

Package aws/vpcflow Release Notes Version 1.1.0 (2024-09-10)
  • Sets new field cloud.account.

  • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

  • Renames the parser to aws-vpcflow.

    ###1.0.0

  • Normalizes data to CrowdStrike Parsing Standard (CPS) schema.

  • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

  • Improves the field extraction.

  • Removes old queries and dashboards from the package. To keep those, stay on the old version of the package.

  • Bumps minimum LogScale version to 1.120 to support AWS S3 ingest feed.