We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.
Stay organized with collections
Save and categorize content based on your preferences.
Change log for COFENSE_TRIAGE
Date
Changes
2024-06-18
Enhancement: - Retrieved productlogid from field cs3 and mapped it to metadata.product_log_id.
2024-06-11
Enhancement: - Modified gsub to parse KV logs. - Added conditional check for cs4.
2024-03-04
Enhancement: - Mapped event_data to metadata.description. - Mapped cat to security_result.description. - Mapped severity to security_result.rule_id. - Mapped msg, rule_id, start, and rt to additional.fields. - If severity is equal to 8, 10, 11, 12, 13, or 14, then security_result.alert_state is set to ALERTING else set it to NOT_ALERTING".
2023-04-19
Enhancement: - Added Grok pattern to handle new logs. - Mapped ProcessID to principal.process.pid. - Mapped host to principal.hostname. - Mapped descrip to metadata.description. - Mapped user_id to principal.user.userid. - Added conditional check for rule_id, sec_result, ipaddress, security_action.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-09-03 UTC."],[],[]]
