Package nozomi/ids Release Notes
Package nozomi/ids Release Notes Version 1.2.0
The old parser nozomi-syslog is deprecated, and replaced by the new parser nozomi-ids. While the old parser will remain available during a transition period, all future changes will only go into the new nozomi-ids parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old nozomi-syslog parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.
Duplicated vendor fields dropped in new parserThe old nozomi-syslog parser would duplicate certain fields, which the new nozomi-ids parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp), and as a field mapped to CPS (e.g. source.ip). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:
Vendor.Id
Vendor.Mitre_attack_tactics
Vendor.Mitre_attack_techniques
Vendor.Risk
Vendor.app
Vendor.device.product
Vendor.device.vendor
Vendor.device.version
Vendor.dhost
Vendor.dmac
Vendor.dpt
Vendor.dst
Vendor.dvc
Vendor.dvchost
Vendor.event_class_id
Vendor.label.Name
Vendor.n2os_schema
Vendor.proto
Vendor.severity
Vendor.shost
Vendor.smac
Vendor.src
Vendor.start
Vendor.trigger_id
Vendor.trigger_type
Sets the fields observer.ip, threat.tactic.name and threat.tactic.id as an arrays.
Bug fix: Renamed the field name from observer.address to observer.hostname to ensure compliance with CPS standard.
Package nozomi/ids Release Notes Version 1.1.0
Sets the event categorization fields: event.category, event.type and event.outcome based on the message data coming from the source.
Improves the field extraction and performance.
Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.
Package nozomi/ids Release Notes Version 1.0.0
Adds new event.module and Cps.version fields
Removes the Product field
Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type