We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for TANIUM_TH

Date	Changes
2023-12-18	Enhancement- - Mapped `network.direction` JSON field to `network.direction` UDM field.
2023-09-20	Enhancement- - Mapped `metadata.description` JSON field to `metadata.description` UDM field.
2022-12-12	Enhancement- - Mapped `metadata.event_type` to `USER_LOGIN` when `additional.event_id` is `4625`, `4624`, `4648`, or `4627`. - Mapped `metadata.event_type` to `USER_LOGOUT` when `additional.event_id` is `4634` or `4647`. - Mapped `metadata.event_type` to `USER_CHANGE_PERMISSIONS` when `additional.event_id` is `4670`, `4672`, `4673`, `4674`, `4703`, `4704`, `4705`. - Mapped `metadata.event_type` to `PROCESS_LAUNCH` when `additional.event_id` = `4688`. - Mapped `metadata.event_type` to `PROCESS_TERMINATION` when `additional.event_id` = `4689`. - Mapped `metadata.event_type` to `PROCESS_UNCATEGORIZED` when `additional.event_id` = `4799`. - Mapped `metadata.event_type` to `SCHEDULED_TASK_MODIFICATION` when `additional.event_id` = `4702`. - Mapped `metadata.event_type` to `SCHEDULED_TASK_DISABLE` when `additional.event_id` = `4701`. - Mapped `metadata.event_type` to `SCHEDULED_TASK_ENABLE` when `additional.event_id` = `4700`. - Mapped `metadata.event_type` to `SCHEDULED_TASK_DELETION` when `additional.event_id` = `4699`. - Mapped `metadata.event_type` to `SCHEDULED_TASK_CREATION` when `additional.event_id` = `4698`. - Modified `metadata.event_type` from `USER_UNCATEGORIZED` to `STATUS_UPDATE` for all other event types not handled specifically.
2022-09-16	Enhancement- - Added error check for `principal.process.file.fullPath`,`principal.process.file.md5`,`target.file.md5`. - Set `event_type` to `STATUS_UPDATE` when field `logType` is equal to `PROCESS_MODULE_LOAD` and `target.file.md5` is null.
2022-08-10	Enhancement- - Modified mapping for the field `additional.event_id` from `metadata.product_log_id` to `security_result.rule_name`. - Modified mapping for `metadata.event_type` from `GENERIC_EVENT` to `USER_LOGIN` where `additional.event_id` == `4625`. - Modified mapping for `additional.event__AuthenticationPackageName` from `target.resource.name` to `security_result.about.resource.name` where `additional.event_id` == `4625`and `4624`. - Mapped the field `additional.event__LogonType` to `extensions.auth.mechanism`. - Mapped `security_result.category` to `AUTH_VIOLATION` where `additional.event_id` == `4625`.
2022-06-01	Enhancement- For logs with logType `GENERIC_EVENT_LOG`, changed `metadata.event_type` from `GENERIC_EVENT` to `USER_UNCATEGORIZED`. Enhanced the parser to correct the parsing of the field `additional.query` so as to accordingly map it to target.ip or target.hostname based upon the value present in the log.
2022-05-12	Bug-Fix - Added condition check on field additional.query so as to map it to target.ip or target.hostname based upon the value present in the log.
2022-03-30	Enhancement to map following raw logs elements to UDM elements: Mapped field `additional.event__TargetSid` and `additional.event__TargetUserSid` to `target.user.windows_sid`. Mapped field `additional.event__SubjectUserName` to `principal.user.user_display_name`. Mapped field `additional.event__CallerProcessId` and `additional.event__ClientProcessId` to `principal.process.pid`. Mapped field `additional.event__CallerProcessName` to `principal.process.file.full_path`. Mapped filed `additional.event__FQDN` to `principal.hostname`. Mapped field `additional.event__ParentProcessName` to `principal.process.parent_process.file.full_path`. Mapped field `additional.event__CommandLine` to `target.process.command_line`. Mapped field `additional.event__NewProcessId` to `target.process.pid`. Mapped field `additional.event__NewProcessName` to `target.process.file.full_path`. Mapped field `additional.event__ParentProcessId` to `principal.process.parent_process.pid`. Mapped field `additional.event__ObjectServer` to `security_result.category_details`. Mapped field `additional.event__Service` to `security_result.description`. Mapped field `additional.event__PrivilegeList` to `principal.user.attribute.permissions`. Mapped field `additional.event__TransmittedServices`, `additional.event__LmPackageName`, `additional.event__TokenElevationType`, `additional.event__MandatoryLabel`, `additional.event__AlgorithmName`, `additional.event__KeyName`, `additional.event__KeyType`, `additional.event__Operation`, `additional.event__ProviderName`, `additional.event__ReturnCode`, `additional.event__RpcCallClientLocality`, `additional.event__ClientProcessStartKey`, `additional.event__TaskContentNew`, `additional.event__TaskName`, `additional.event__Status`, `additional.event__FailureReason`, `additional.event__SubStatus`, `additional.event__KeyLength`, `additional.event__RestrictedAdminMode`, `additional.event__TargetLinkedLogonId`, `additional.event__TargetOutboundUserName`, `additional.event__TargetOutboundDomainName` to `additional.fields`. Changed mapping for `additional.event__VirtualAccount`, `additional.event__ElevatedToken`, `additional.event__ImpersonationLevel`, `additional.event__TargetLogonId`, `additional.event__SubjectLogonId` from `about.labels` to `additional.fields`.