Added comprehensive event categorization based on log types and actions

Enhanced authentication event parsing with improved field extraction

Added support for flow event parsing with proper event type categorization

Improved field normalization to align with ECS standards

Added support for multiple syslog formats and timestamp parsing

Adjusts the field mapping to comply with ECS: rename server.name to server.address , observer.address to observer.hostname , and process.id to process.pid .

Bumps ecs.version to 8.16.0.

Improves the field extraction and performance.

Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

Sets the Vendor.type field based on the event type.

Sets the observer.address , observer.name , event.outcome fields and more.

Renames the parser to paloalto-prisma-sdwan .

Adds new event.module and Cps.version fields

Removes the Product and related.ip fields

Sets following tags: Cps.version , Vendor , ecs.version , event.dataset , event.kind , event.module , event.outcome , observer.type