We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for TACACS_PLUS

Date Changes

2025-03-13 - Mapped status to security_result.action_details".
- Mapped username to principal.user.userid.
- Mapped service to target.application.
- Mapped terminal to target.resource.name.
- Mapped command to target.process.command_line.
- Mapped ResponseDescription to security_result.summary when ResponseDescription is pcre2 else mapped to metadata.description.
- Mapped return_code to security_result.summary.
- Mapped process_id to target.process.pid.
- Mapped session_id to network.session_id.
- Mapped hostname to principal.hostname and principal.asset.hostname.
- Mapped principalIp to principal.ip and principal.asset.ip.
- Mapped device_ip to target.ip and target.asset.ip.
- Mapped Deviceip to target.asset.ip and target.ip.
- Mapped TACACS Plus Value to metadata.product_name.
- Mapped TACACS Plus Value to metadata.vendor_name.

Date	Changes
2025-03-13	- Mapped `status to` security_result.action_details". - Mapped `username` to `principal.user.userid`. - Mapped `service` to `target.application`. - Mapped `terminal` to `target.resource.name`. - Mapped `command` to `target.process.command_line`. - Mapped `ResponseDescription` to `security_result.summary` when ResponseDescription is `pcre2` else mapped to `metadata.description`. - Mapped `return_code` to `security_result.summary`. - Mapped `process_id` to `target.process.pid`. - Mapped `session_id` to `network.session_id`. - Mapped `hostname` to `principal.hostname` and `principal.asset.hostname`. - Mapped `principalIp` to `principal.ip` and `principal.asset.ip`. - Mapped `device_ip` to `target.ip` and `target.asset.ip`. - Mapped `Deviceip` to `target.asset.ip` and `target.ip`. - Mapped `TACACS Plus` Value to `metadata.product_name`. - Mapped `TACACS Plus` Value to `metadata.vendor_name`.