We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for NETFILTER_IPTABLES

Date	Changes
2025-11-17	Enhancement: - `event.idm.read_only_udm.security_result.rule_name`: Newly mapped `rulename` raw log field with `event.idm.read_only_udm.security_result.rule_name` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `application` raw log field with `event.idm.read_only_udm.additional_fields` UDM field. - Updated the date filter to handle the new pattern of timestamp with `yyyy-MM-ddTHH:mm:ssZZ` format.
2023-10-12	Enhancement: - Added a Grok pattern to parse SYSLOG type logs. - Mapped `OUT` to `target.resource.attribute.labels`. - Mapped `IN` to `principal.resource.attribute.labels`.
2022-10-12	Enhancement: - Added new grok to parse unparsed logs(logs with header format <133> Sep 29 01:38:26). - Mapped security_result.action to Block where action is reject.
2022-10-04	Enhancement: - Remapped `src_host` to `intermediary.hostname` instead of `principal.hostname`.
2022-06-21	Enhancement: - Mapped `TOS` with `tos_label` to `event.idm.read_only_udm.additional.fields`. - Mapped `LEN` with `len_label` to `event.idm.read_only_udm.additional.fields`. - Mapped `URGP` with `urgp_label` to `event.idm.read_only_udm.additional.fields`. - Mapped `PREC` with `prec_label` to `event.idm.read_only_udm.additional.fields`. - Mapped `SPI` with `spi_label` to `event.idm.read_only_udm.additional.fields`. - Mapped `CODE` with `code_label` to `event.idm.read_only_udm.additional.fields`. - Mapped `DF` with `df_label` to `event.idm.read_only_udm.additional.fields`. - If `action` is `DROP` then `security_result.action` is assigned with `BLOCK`.