We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for SYMANTEC_CASB

Date	Changes
2024-10-25	Enhancement: - Added support for JSON logs.
2024-03-19	Enhancement: - Mapped `content_checks.dlp.updated_timestamp` to `additional.fields`. - Mapped `content_checks.vk_encryption` to `security_result.detection_fields`. - Mapped `user`, `user_mail`, and `user_uid` to `principal.user.email_addresses`. - Mapped `user_email`, `mailbox_owner`, `product_data.target`, and `user_uid` to `target.user.email_addresses`.
2024-02-19	Enhancement: - Added support to parse JSON logs coming in single quotations. - Mapped `severity` to `security_result.severity_details`.
2024-02-16	- Resolved flakiness issue by replacing `instance.0` with `instance` when it is not an array.
2024-02-11	Enhancement: - Added support for logs of format JSON. - Mapped `_id` to `metadata.product_log_id`. - Mapped `__event_timestamp` to `metadata.event_timestamp`. - Mapped `_elastic_timestamp`, `created_timestamp`, `inserted_timestamp`, `updated_timestamp`, `responsible_logs` and `sub_feature` to `additional.fields`. - Mapped `threat_score`, `locations`, `transaction_id`, `content_checks.dlp.raw_response.requestid`, `content_checks.dlp.raw_response.responseaction`, `org_unit`, `policy_type`, `content_checks.vk_pci`, `content_checks.vk_vba_macros`, `content_checks.vk_glba`, `content_checks.vk_source_code`, `content_checks.vk_pii`, `content_checks.vk_virus`, `content_checks.vk_hipaa`, `content_checks.violations`, `object_name`, `multi_user`, `risks`, `name`, `_latency`, `content_checks.dlp.raw_response.warning`, `content_checks.dlp.raw_response.violation`, `content_checks.dlp.raw_response.contentdetails`, `content_checks.vk_dlp_policy_violations`, `content_checks.risktype_list`, `content_checks.vk_content_iq_violations`, `actions_taken`, `__detect_source`, `multi_facility`, `content_checks.vba_macros.expressions` and `policy_violated` to `security_result.detection_fields`. - Mapped `severity` to `security_result.severity`. - Mapped `host` to `principal.hostname`. - Mapped `file_size` to `product_data.file_size`. - Mapped `source` to `principal.resource.attribute.labels`. - Mapped `resource_id` to `target.resource.id`. - Mapped `policy_action` to `security_result.action_details`. - Mapped `object_type` to `target.resource.name`. - Mapped `ioi_code` to `security_result.summary`. - Mapped `user` to `principal.user.userid`. - Mapped `content_checks.filename` to `target.file.full_path`. - Mapped `content_checks.mimetype` to `target.file.mime_type`. - Mapped `activity_type` to `metadata.product_event_type`. - Mapped `service` to `target.application`. - Mapped `_domain` to `target.hostname`. - Mapped `hosts` to `principal.ip`. - If `has_principal` is `true` then set `metadata.event_type` as `STATUS_UPDATE`. - If `has_principal_user` is `true`, `has_target` is `true` and `has_principal` is `false`, then set `metadata.event_type` as `USER_UNCATEGORIZED`. - If `has_principal_user` is `true`, `has_target` is `true` and `has_principal` is `true`, then set `metadata.event_type` as `USER_LOGIN`.