Falcon LogScale 1.131.3 LTS (2024-09-24)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.131.3LTS2024-09-24

Cloud

On-Prem

2025-04-30No1.106.01.112.0No

Download: https://repo.humio.com/repository/maven-releases/com/humio/server/1.131.3/server-1.131.3.tar.gz

Hide file hashes

Show file hashes

These notes include entries from the following previous releases: 1.131.1, 1.131.2, 1.131.1, 1.131.2

Bug fixes and updates.

Removed

Items that have been removed as of this release.

GraphQL API

  • The enabledFeatures() query has been removed from GraphQL schema. Use featureFlags() query instead.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • In the GraphQL API, the ChangeTriggersAndAction enum value for both the Permission and ViewAction enum is now deprecated and will be removed in version 1.136 of LogScale.

  • In the GraphQL API, the name argument to the parser field on the Repository datatype has been deprecated and will be removed in version 1.136 of LogScale.

  • We are deprecating the humio/kafka and humio/zookeeper Docker images due to low use. The planned final release for these images will be with LogScale 1.148.0.

    Better alternatives are available going forward. We recommend the following:

    • If your cluster is deployed on Kubernetes: STRIMZI

    • If your cluster is deployed to AWS: MSK

    If you still require humio/kafka or humio/zookeeper for needs that cannot be covered by these alternatives, please contact Support and share your concerns.

  • The QUERY_COORDINATOR environment variable is deprecated. To control whether a node should be allowed to be a query coordinator, use the query node task instead. Node tasks can be assigned and unassigned at runtime using the assignTasks() and unassignTasks() GraphQL mutations respectively, or controlled using the INITIAL_DISABLED_NODE_TASKS environment variable.

    For more information, see INITIAL_DISABLED_NODE_TASKS.

  • The following GraphQL queries and mutations for interacting with parsers are deprecated and scheduled for removal in version 1.142.

    • The deprecated createParser() mutation is replaced by createParserV2() . The differences between the old and new mutation are:

      • testData input field is replaced by testCases, which can contain more data than the old tests could. This includes adding assertions to the output of a test. These assertions are not displayed in the UI yet. To emulate the old API, you can take the old test string and put it in the ParserTestEventInput inside the ParserTestCaseInput, and they will behave the same as before.

      • fieldsToBeRemovedBeforeParsing can now be specified as part of the parser creation.

      • force field is renamed to allowOverwritingExistingParser.

      • sourceCode field is renamed to script.

      • tagFields field is renamed to fieldsToTag.

      • languageVersion is no longer an enum, but a LanguageVersionInputType instead.

      • The mutation returns a Parser, instead of a Parser wrapped in an object.

      • The mutation fails when a parser has more than 2,000 test cases, or the test input in a single test case exceeds 40,000 characters.

    • The deprecated removeParser() mutation is replaced by deleteParser(). The difference between the old and new mutation is:

      • The mutation returns boolean to represent success or failure, instead of a Parser wrapped in an object.

    • The deprecated testParser() mutation is replaced by testParserV2() . The differences between the old and new mutation are:

      • The test cases are now structured types, instead of just being strings. To emulate the old API, take the test string and put it in the ParserTestEventInput inside the ParserTestCaseInput, and they will behave the same as before.

      • The new test cases can contain assertions about the contents of the output.

      • The mutation output is significantly different from before, as it provides more detailed information on how a test case has failed.

      • The mutation now accepts both a language version and list of fields to be removed before parsing.

      • The parserScript field is renamed to script.

      • The tagFields field is renamed to fieldsToTag.

    • The deprecated updateParser() mutation is replaced by updateParserV2() where more extensive test cases can be set. Continuing to use the previous API may result in test information on parsers being lost. To ensure information is not unintentionally erased, please migrate away from the deprecated APIs for both reading and updating parser test cases and use updateParserV2() instead. The differences between the previous and the new mutation are:

      • testData input field is replaced by testCases, which can contain more data than the old tests could. This includes adding assertions to the output of a test. These assertions are not displayed in the UI yet. To emulate the old API, you can take the old test string and put it in the ParserTestEventInput inside the ParserTestCaseInput, and they will behave the same as before.

      • sourceCode field, used to updating the parser script, is changed to the script field, which takes a UpdateParserScriptInput object. This updates the parser script and the language version together.

      • tagFields field is renamed to fieldsToTag.

      • The languageVersion is located inside the UpdateParserScriptInput object, and is no longer an enum, but a LanguageVersionInputType instead.

      • The repositoryName and id fields are now correctly marked as mandatory in the schema. Previously this wasn't the case, even though the mutation would fail without them.

      • The mutation returns a Parser, instead of a Parser wrapped in an object.

      • The old mutation had a bug where it would overwrite the languageVersion with a default value in some cases, which is fixed in the new one.

      • The mutation fails when a parser has more than 2,000 test cases, or the test input in a single test case exceeds 40,000 characters.

    On the Parser type:

    • testData field is deprecated and replaced by testCases.

    • sourceCode field is deprecated and replaced by script.

    • tagFields field is deprecated and replaced by fieldsToTag.

    For more information, see DeleteParserInput , LanguageVersionInputType , createParserV2() , testParserV2() , updateParserV2() , Parser .

  • The assetType GraphQL field on Alert, Dashboard, Parser, SavedQuery and ViewInteraction datatypes has been deprecated and will be removed in version 1.136 of LogScale.

  • The any argument to the type parameter of sort() and table() has been deprecated and will be removed in version 1.142.

    Warnings prompts will be shown in queries that fall into either of these two cases:

    • If you are explicitly supplying an any argument, please either simply remove both the parameter and the argument, for example change sort(..., type=any) to sort(...) or supply the argument for type that corresponds to your data.

    • If you are sorting hexadecimal values by their equivalent numerical values, please change the argument of type parameter to hex e.g. sort(..., type=hex).

    In all other cases, no action is needed.

    The new default value for sort() and table() will be number. Both functions will fall back to lexicographical ordering for values that cannot be understood as the provided argument for type.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Security

    • DNS caches are now invalidated after 60 seconds instead of never. To override this behavior, set the security policy networkaddress.cache.ttl in the security manager of the JRE (see Java Networking Properties).

  • Ingestion

    • It is no longer possible to delete a parser that is being used in an ingest feed. The parser must first be removed from the ingest feed.

      For more information, see Delete an Ingest Feed.

Upgrades

Changes that may occur or be required during an upgrade.

  • Installation and Deployment

    • The minimum required LogScale version to upgrade from has been raised to 1.106, in order to remove some workarounds for compatibility with old versions.

New features and improvements

  • Security

    • Added support for authorizing with an external JWT from an IdP setup in our cloud environment.

    • Added support for Okta federated IdP OIDC extension to identity providers setup in cloud.

    • The audience for dynamic OIDC IdPs in our cloud environments are now logscale-$orgId, where $orgId is the ID of your organization.

  • User Interface

    • Time zone data has been updated to IANA 2024a and has been trimmed to +/- 5 years from the release date of IANA 2024a.

  • Automation and Triggers

    • Throttling and field-based throttling have been introduced as optional functionalities in Filter Alerts. The minimum throttling period is 1 minute.

    • The customizable trigger limit for Filter Alerts is removed. The trigger limit is now automatically determined based on the associated actions. If one or more email actions are associated, the trigger limit will be 15, otherwise, the trigger limit will be 100. Any existing customizable trigger limit of 1 will be treated as a throttling period of 1 minute, all other custom trigger limits will be ignored. This is a non-backwards compatible change to the GraphQL APIs for Filter Alerts, so any automation for these alerts must be updated.

  • GraphQL API

  • Configuration

    • The new dynamic configuration MaxOpenSegmentsOnWorker is implemented to control hard cap on open segment files for the scheduler. The scheduler should in most cases not reach this limit and it only acts as a backstop. Therefore, we recommend that administrators do not modify this setting unless advised to do so by CrowdStrike Support.

    • Authorization attempted via JWT tokens will now only try to grab user information from the user info endpoint if the scope in the access token contains any of the following: profile, email, openid. If no such scope is located in the token, LogScale will try to extract the username from the token and no other user details will be added. We will extract the scope claim based on the new environment variable OIDC_SCOPE_CLAIM, whose default is scope.

  • Ingestion

  • Queries

    • Queries are now allowed to be queued for start by the query coordinator for a maximum of 10 minutes.

      For more information, see Query Coordination.

  • Functions

    • The parseTimestamp() function is now able to parse timestamps with nanosecond precision.

    • The setField() query function is introduced. It takes two expressions, target and value and sets the field named by the result of the target expression to the result of the value expression. This function can be used to manipulate fields whose names are not statically known, but computed at runtime.

      For more information, see setField().

    • The getField() query function is introduced. It takes an expression, source, and sets the field defined by as to the result of the source expression. This function can be used to manipulate fields whose names are not statically known, but computed at runtime.

      For more information, see getField().

  • Other

    • The default IP filter for IdP and RDNS operations is now more restrictive: RDNS now defaults to denying lookups of reserved IP ranges and the filter has been updated to deny additional reserved IP ranges, as specified by the IANA. Self hosted administrators can specify their own filters by using the environment variables IP_FILTER_IDP, IP_FILTER_RDNS, and IP_FILTER_RDNS_SERVER respectively.

    • The split by AWS record setting within ingest feeds will now accept numbers with leading zeros.

    • The missing-cluster-nodes metric will now track the nodes that are missing heartbeat data in addition to the nodes that have outdated heartbeat data. The new missing-cluster-nodes-stateful metric will track the registered nodes with outdated/missing heartbeat data that can write to global.

      For more information, see Node-Level Metrics.

Fixed in this release

  • User Interface

    • Field aliases could not be read on the sandbox repository. This issue is now fixed.

    • CSV files produced by LogScale for sending as attachments from email actions or uploaded through a LogScale Repository action could contain values where part of the text was duplicated. This would only happen for values that needed to be quoted. This issue is now fixed.

  • Automation and Triggers

    • Filter Alerts with field-based throttling could trigger on two events with the same value for the throttle field, if actions were slow. This issue is now fixed.

  • Ingestion

    • Fixed an issue that prevented the creation of Netflow/UDP protocol ingest listeners.

    • Cloning a parser from the UI would not clone the fields to be removed before parsing. This issue is now fixed.

  • Dashboards and Widgets

    • Shared dashboards created on the special humio-search-all view wouldn't load correctly. This issue has now been fixed.

    • A dashboard with fixed shared time as default would not update correctly when selecting a new relative time. This issue is now fixed.

  • Queries

    • Multiple clients might trigger concurrent computation of the result step for a shared query. This issue has been fixed: now only one pending computation is allowed at a time.

  • Functions

  • Other

    • An issue with the IOC Configuration causing the local database to update too often has now been fixed.

  • Packages

    • Uploading a package zip would fail on Windows devices. This issue has been fixed.

    • Updating a package could fail, if one of the assets from the package had been deleted from the view where the package was installed. This issue has been fixed.

    • When attempting to upload a package disguised as a folder, some browsers would get a generic error messages. To fix this issue, only zip files are accepted now.

Early Access

Improvement

  • Storage

    • Moved the work of creating a global snapshot for upload to bucket storage from the thread coordinating segment uploads/downloads to a separate thread. This improves the reliability of uploading and download the global snapshot to/from bucket storage.

    • SegmentChangesJobTrigger has been disabled on nodes configured to not be able to store segments, thus saving some CPU time.

  • Configuration

    • The default maximum limit for groupBy() has been increased from 200,000 to 1,000,000, meaning that this function can now be asked to collect up to a million groups. However, due to stability concerns it will not allow groupBy() to return the full million rows as a result when this function is the last aggregator: this is governed by the QueryResultRowCountLimit dynamic configuration, which remains unchanged. Therefore, this new limit is best utilized when groupBy() is used as a computational tool for creating groups that are then later aggressively filtered and/or aggregated down in size. If you experience resource strain or starvation on your cluster, you can reduce the maximum limit via the GroupMaxLimit dynamic configuration.

    • The default value for AUTOSHARDING_MAX has changed from 128 to 1,024.

    • The default value for AUTOSHARDING_TRIGGER_DELAY_MS has changed from 1 hour to 4 hours.

    • The default memory limit for the query coordinator node has been increased from 400 MB to 4 GB. This new limit allows each query to use up to 1 GB of memory and thus produce more results, at the cost of taking up more resources. This in turn indirectly limits the amount of concurrent queries as the query scheduler may choose not to run a given query before existing queries have completed. If you experience resource strain or starvation on your cluster, you can reduce the memory limit by setting the QueryCoordinatorMemoryLimit dynamic configuration to 400,000,000.

  • Functions

    • Live queries now restart and run with the updated version of a saved query when the saved query changes.

      For more information, see Saved Searches (User Functions).

    • Reduction of memory requirements when processing empty arrays in functions that accept them. This helps reduce the memory required to use these functions with empty arrays.

  • Other

    • Improved handling of segments being replaced due to either merging or event redaction, to address rare cases of event duplication when segments are replaced multiple times shortly after each other.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • cisco/meraki has been updated to v1.2.0.

      • Adds the event.outcome field

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files

      For more information, see Package cisco/meraki Release Notes.

    • rubrik/security-cloud has been updated to v1.0.1.

      • Renames the parser to rubrik-securitycloud.

      For more information, see Package rubrik/security-cloud Release Notes.

    • fortinet/fortigate has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product, related.hosts and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package fortinet/fortigate Release Notes.

    • cisco/umbrella has been updated to v1.1.0.

      • Improves the field extraction and performance.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Adds source.ip, event.action, destination.domain, event.type and rule.uuid fields and more.

      • Renames the fields under the Vendor namespace from the camelcase to snakecase. It's a breaking change so don't update to this version in case your queries rely on the Vendor specific fields

      • Adds support of Firewall logs, Data Loss Prevention (DLP) logs and Intrusion Prevention (IPS) logs.

      • Renames the parser to cisco-umbrella.

      For more information, see Package cisco/umbrella Release Notes.

    • rubrik/security-cloud has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product field

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Bumps parser version to 1.0.0

      For more information, see Package rubrik/security-cloud Release Notes.

    • aws/cloudtrail has been updated to v1.1.0.

      • Improves the field extraction and performance.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Parses a timestamp based on the digestStartTime in case there is no eventTime field.

      • Adds new fields: event.dataset, event.reason, file.name, user.roles, source.ip, host.name and more.

      • Changes a user.name field values to lowercase.

      • Sets event.dataset and observer.type based on the event action.

      • Stops using the csv file to set the event categorization fields.

      • Renames the parser to aws-cloudtrail

      For more information, see Package aws/cloudtrail Release Notes.

    • microsoft/windows-dns-debug has been updated to v1.1.0.

      • Improves the field extraction and performance.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Adds new process.thread.id, event.created, network.transport, network.direction, dns.header_flags fields.

      • Mapps Opcode field to dns.op_code.

      • Updates the event.dataset from windows.dns to windows.dns-debug.

      • Sets the event.id based on XID field.

      For more information, see Package microsoft/windows-dns-debug Release Notes.

    • cisco/duo has been updated to v1.1.0.

      • Adds new parser for Trust Monitor events.

      • Bug fix: Renames the Parser_version to Parser.version

      For more information, see Package cisco/duo Release Notes.

    • aws/s3-server-access has been updated to v1.0.1.

      • Improves the field extraction and performance.

      • Bumps parser version to 1.0.1

      For more information, see Package aws/s3-server-access Release Notes.

    • proofpoint/tap-siem-api has been updated to v1.0.0.

      • Updates the parsers to be compliant with LogScale Parsing Standard.

      • Renames the parsers.

      • Removes dashboards from the package. To keep those, stay on the old version of the package.

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package proofpoint/tap-siem-api Release Notes.

    • zscaler/private-access has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.user, related.hosts and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package zscaler/private-access Release Notes.

    • microsoft/dhcp-client has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product field

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package microsoft/dhcp-client Release Notes.

    • infoblox/nios has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product, related.host and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package infoblox/nios Release Notes.

    • citrix/netscaler has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, msg and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Puts the CEF header fields under the Vendor.* prefix

      For more information, see Package citrix/netscaler Release Notes.

    • palo-alto/prisma-sd-wan has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package palo-alto/prisma-sd-wan Release Notes.

    • haproxy/haproxy has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package haproxy/haproxy Release Notes.

    • zoom/qss has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product field

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package zoom/qss Release Notes.

    • trellix/fireeye-nx has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.hosts and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package trellix/fireeye-nx Release Notes.

    • aws/waf has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Improves the field extraction

      For more information, see Package aws/waf Release Notes.

    • akamai/asec has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package akamai/asec Release Notes.

    • google/chrome-enterprise-security-events has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product field

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Bumps parser version to 1.0.0

      • Renames the url.host to url.domain

      For more information, see Package google/chrome-enterprise-security-events Release Notes.

    • fortinet/fortimail has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.user and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package fortinet/fortimail Release Notes.

    • microsoft/windows-dns-debug has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product, related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package microsoft/windows-dns-debug Release Notes.

    • okta/sso has been updated to v1.1.0.

      • Improves the field extraction and performance.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Adds event.reason field

      • Sets the event.kind and event.category fields for threat events.

      For more information, see Package okta/sso Release Notes.

    • imperva/cloud-waf has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.host and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package imperva/cloud-waf Release Notes.

    • okta/sso has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product related.user and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package okta/sso Release Notes.

    • cisco/duo has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product, related.user and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Removes data_stream fields, since the same information is now standardized in event.dataset

      For more information, see Package cisco/duo Release Notes.

    • zscaler/deception has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package zscaler/deception Release Notes.

    • forcepoint/dlp has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package forcepoint/dlp Release Notes.

    • infoblox/nios has been updated to v1.1.1.

      • Improves event categorization and outcomes via the event.category[] and event.type[] arrays and the event.outcome field.

      For more information, see Package infoblox/nios Release Notes.

    • nozomi/ids has been updated to v1.1.0.

      • Sets the event categorization fields: event.category, event.type and event.outcome based on the message data coming from the source.

      • Improves the field extraction and performance.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      For more information, see Package nozomi/ids Release Notes.

    • aws/cloudtrail has been updated to v1.0.1.

      • Improves the field extraction and performance.

      • Bumps parser version to 1.0.1

      For more information, see Package aws/cloudtrail Release Notes.

    • dell/isilon has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package dell/isilon Release Notes.

    • claroty/ctd has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.host and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package claroty/ctd Release Notes.

    • cisco/ise has been updated to v1.0.0.

      • Removes the Product field

      • Adds new event.module and Cps.version fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Bumps parser version to 1.0.0

      • Adds parsing for several event codes

      • Restructures and optimizes parsing logic

      • Categorization updates

      For more information, see Package cisco/ise Release Notes.

    • paloalto/firewall has been updated to v1.1.0.

      • Adds support for PAN-OS v11.0

      • Improves the field extraction and performance.

      • Renames the fields under the Vendor namespace to pascal case notation. It's a breaking change so don't update to this version in case your queries rely on the Vendor specific fields.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Adds threat.*, event.severity fields and more.

      • Sets the event.action for Authentication events.

      • Sets the event.category to intrusion_detection and malware for Colleration events.

      • Classifies events according to a threat taxonomy as the MITRE ATT&CK framework.

      • Renames the parser to paloalto-ngfw.

      For more information, see Package paloalto/firewall Release Notes.

    • aws/waf has been updated to v1.0.1.

      • Supports CAPTCHA and Challenge logs.

      For more information, see Package aws/waf Release Notes.

    • cisco/firepower has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product field

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Extracts optional priority field from the syslog header

      For more information, see Package cisco/firepower Release Notes.

    • cisco/meraki has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product field

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Rename url.host to url.domain field

      For more information, see Package cisco/meraki Release Notes.

    • cloudflare/zerotrust has been updated to v1.1.0.

      • Improves the field extraction and performance.

      • Bumps the minimum LogScale version to 1.142 to support parser assertions in yaml files.

      • Adds support of Network Analytics, Magic IDS and Zone-scoped HTTP Requests logs.

      • Adds event.reason, message, interface.name, email.from.address, email.sender.address, email.to.address, file.name, file.size, file.sizefile.size, device.id fields and more.

      • Renames the parser to cloudflare-one.

      For more information, see Package cloudflare/zerotrust Release Notes.

    • paloalto/firewall has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.hash, related.user, related.hosts, related.ip and message fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package paloalto/firewall Release Notes.

    • zscaler/internet-access has been updated to v1.1.0.

      • Consolidates dedicated parsers for ZIA feeds into one parser. *This is a breaking change as it forced to rename source fields*. When you install the latest version your search queries which rely on the Vendor specific fields might stop working.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Improves the field extraction and performance.

      • Extends parser to normalize Audit, Cloud Access Security Broker (CASB) and Data Loss Prevention (DLP) events.

      • Adds new fields: event.id, source.geo.name.

      For more information, see Package zscaler/internet-access Release Notes.

    • netgate/pfsense has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package netgate/pfsense Release Notes.

    • aws/vpcflow has been updated to v1.1.0.

      • Sets new field cloud.account.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Renames the parser to aws-vpcflow.

        ###1.0.0

      • Normalizes data to CrowdStrike Parsing Standard (CPS) schema.

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Improves the field extraction.

      • Removes old queries and dashboards from the package. To keep those, stay on the old version of the package.

      • Bumps minimum LogScale version to 1.120 to support AWS S3 ingest feed.

      For more information, see Package aws/vpcflow Release Notes.

    • aws/cloudtrail has been updated to v1.0.0.

      • This version of the package supersedes both the amazon/cloudtrail package as well as previous version of this package.

        • If you are migrating here from the amazon/cloudtrail package, the following changes apply:

      For more information, see Package aws/cloudtrail Release Notes.

    • cloudflare/zerotrust has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.user and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package cloudflare/zerotrust Release Notes.

    • aws/s3-server-access has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.ip and related.user fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Improves the field extraction

      For more information, see Package aws/s3-server-access Release Notes.

    • aruba/clearpass has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package aruba/clearpass Release Notes.

    • island/island has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip and related.user fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Bumps parser version to 1.0.0

      For more information, see Package island/island Release Notes.

    • asimily/iomt has been updated to v1.0.0.

      • Removes the Product and related.ip fields

      • Adds new event.module and Cps.version fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Bumps parser version to 1.0.0

      • Bumps ecs.version to 8.11.0

      For more information, see Package asimily/iomt Release Notes.

    • aws/fsx has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package aws/fsx Release Notes.

    • broadcom/proxysg has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product , related.ip and related.host fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Bug fix: Renames the ecs_version to ecs.version

      For more information, see Package broadcom/proxysg Release Notes.

    • microsoft/sysmon has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product, related.ip, related.user, related.hosts and related.hash fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package microsoft/sysmon Release Notes.

    • infoblox/nios has been updated to v1.1.0.

      • Simplifies parser logic by removing unnecessary rename operations.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Extracts the dns.answer.* and dns.resolved_ip fields.

      • Removes the repeat.message field.

      For more information, see Package infoblox/nios Release Notes.

    • nozomi/ids has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product field

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package nozomi/ids Release Notes.

    • checkpoint/ngfw has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product , related.user, related.hash and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package checkpoint/ngfw Release Notes.

    • zscaler/internet-access has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product, related.ip, related.user and related.host fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Bumps parser version to 1.0.0

      • Bumps ecs.version to 8.11.0

      For more information, see Package zscaler/internet-access Release Notes.

    • cisco/umbrella has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.user and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package cisco/umbrella Release Notes.

    • juniper/srx has been updated to v1.0.0.

      • Adds new event.module, event.dataset and Cps.version fields

      • Removes the Product, related.user, related.host and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package juniper/srx Release Notes.

    • imperva/cloud-waf has been updated to v1.2.0.

      • Sets the event.category and event.type to threat/indicator for events where an attack took place.

      For more information, see Package imperva/cloud-waf Release Notes.

    • aws/guardduty has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.ip, related.host and related.user fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package aws/guardduty Release Notes.

    • cisco/ios has been updated to v1.0.0.

      • Adds new event.module and Cps.version fields

      • Removes the Product, related.user and related.ip fields

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      For more information, see Package cisco/ios Release Notes.

    • fortinet/fortigate has been updated to v1.1.0.

      • Improves the field extraction and performance.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Sets the error.code field.

      • Sets the event.category and rule.description fields based on the event type.

      For more information, see Package fortinet/fortigate Release Notes.