We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for NETSKOPE_ALERT

Date	Changes
2024-08-14	Enhancement: - Added support for new log format.
2024-06-04	Enhancement: - Mapped `matched_username` to `principal.user.email_addresses`. - When `action` is `bypass` or `alert`, then mapped `action` to `security_result.action_details` and set `security_result.action` to `QUARANTINE`. - When `alert_type` is `DLP`, then mapped `dlp_rule_severity` to `security_result.severity`.
2024-02-19	Enhancement: - Changed the mapping of `client_bytes` from `network.received_bytes` to `network.sent_bytes`. - Changed the mapping of `server_bytes` from `network.sent_bytes` to `network.received_bytes`.
2024-02-08	Enhancement: - Mapped `useragent` and `user_agent` to `network.http.user_agent` and `network.http.parsed_user_agent`.
2023-11-10	Enhancement: - Added Grok pattern, to check whether `srcip` is a valid IP pattern. - Mapped `instance_id` to `principal.hostname`. - Mapped `traffic_type` to `security_result.detection_fields`. - Mapped `app_activity` to `additional.fields`. - Mapped `count` to `additional.fields`. - Mapped `site` to `additional.fields`. - Mapped `device` to `principal.resource.resource_sub_type`. - Mapped `type` to `security_result.detection_fields`. - Changed the mapping of `hostname` using `replace` instead of `rename`. - Changed `cci` mapping from `additional.fields` to `security_result.detection_fields`. - Changed `ccl` mapping from `additional.fields` to `security_result.confidence_details`. - Populated `security_result.confidence` according to the value in `ccl`.
2023-07-14	Bug-Fix - - Extracted value for `browser_session_id`,`app_session_id` using Grok pattern before mapping. - Added condition check to validate email before mapping the field `to_user`.
2023-07-06	Enhancement - - Modified Grok pattern to identify whether `dsthost` is an IP address or not. If `dsthost` is an IP address, then mapped to `target.ip`, else mapped to `target.hostname`.
2023-06-06	Enhancement - - Mapped `domain` to `target.hostname`. - Mapped `app_session_id` to `target.resource.attribute.labels`. - Mapped `malware_severity` to `security_result.severity`. - Mapped `malware_type` to `security_result.detection_fields`. - Mapped `threat_match_field` to `security_result.detection_fields`. - Mapped `ja3` to `network.tls.client.ja3`. - Mapped `ja3s` to `network.tls.server.ja3s`. - Mapped `cci`, `ccl` to `additional.fields`. - Mapped `access_method` to `extensions.auth.auth_details`. - Mapped `browser_version` to `network.http.parsed_user_agent.browser_version`. - Mapped `dlp_profile` to `security_result.rule_type`. - Mapped `dlp_rule` to `security_result.rule_name`. - Mapped `netskope_pop` to `observer.hostname`. - Mapped `page` to `network.http.referral_url`. - Mapped `to_user` to `target.user.email_addresses`. - Mapped `to_user_category` to `target.resource.attribute.labels`.
2023-03-23	Enhancement - - Mapped `security_result.alert_state` to `ALERTING` if `alert` is equal to `yes`. - Mapped `security_result.alert_state` to `NOT_ALERTING` if `alert` is equal to `no`. - Mapped `security_result.alert_state` to `UNSPECIFIED` if `alert` is null.
2022-07-23	Enhancement: - Removed unnecessary mapping for `metadata.description`.
2022-07-01	Enhancement: - The field `os` mapped to `principal.platform`. - The field `dsthost` mapped to `target.ip` if `dsthost` is an IP, else mapped to `target.hostname`. - The field `dstport` mapped to `target.port`. - The field `srcport` mapped to `principal.port`. - The field `user` mapped to `principal.user.email_addresses`, if `user` is a valid email address. - The field `src_latitude` mapped to `principal.location.region_latitude`. - The field `src_longitude` mapped to `principal.location.region_longitude`. - The field `ip_protocol` mapped to `network.ip_protocol`. - The field `client_bytes` mapped to `network.received_bytes`. - The field `server_bytes` mapped to `network.sent_bytes`. - The field `browser_session_id` mapped to `network.session_id`. - The field `network_session_id` mapped to `network.session_id`. - The field `appcategory` mapped to `security_result.category_details`. - The field `publisher_cn` mapped to `additional.fields[n]`. - The field `publisher_name` mapped to `additional.fields[n]`. - The field `tunnel_id` mapped to `additional.fields[n]`. - The field `tunnel_type` mapped to `additional.fields[n]`. - Changed mapping for the field `shared_with` from `intermediary.user.email_addresses` to `network.email.to`. - Changed mapping for the field `network.email.to` from `principal.user.email_addresses` to `network.email.from`. - Added conditional checks for field `_severity`, `shared_with`, `from_user`, `protocol`. - Modified `metadata.event_type` for the following cases: - `GENERIC_EVENT` to `NETWORK_HTTP` where `principal.ip or principal.hostname` and `target.ip or target.hostname` are not null. - `GENERIC_EVENT` to `STATUS_UPDATE` where `principal.ip or principal.hostname` is not null. - `GENERIC_EVENT` to `USER_UNCATEGORIZED` where `principal.user.userid` is not null.
2022-06-17	Bug-Fix: - Added conditinal check for `md5` == `not available`.