Link
Search

Input / Field / Parser Changes

Review changes by input, including parsed fields, mappings, dashboards, and monitors.

26 inputs 1,129 documented entries Compared with 2.25.2 where noted

26 inputs

Barracuda

27 entries

Brand-New Fields 9

  • barracuda.policy.action
  • barracuda.policy.action_type_code
  • barracuda.policy.format_version
  • barracuda.policy.match_flag
  • barracuda.policy.matched
  • barracuda.policy.source_type
  • barracuda.policy.source_type_code
  • barracuda.policy.time_qualified
  • barracuda.policy.time_qualified_flag

Changed Values and Parsing 4

  • event.dataset — now forced to lowercase.
  • event.outcome — Allowed → allowed; Denied → denied; all other outcome values are also lowercased.
  • related.hosts — moved from 203_extra_parsing to 207_related_hosts.
  • related.hosts — now includes source and destination addresses and IPs, observer IP, URL domain, and other host values.
Dashboard Changes 8

New6

  • All activity
  • Denied traffic
  • Blocked spyware traffic
  • Spyware detected
  • Traffic blocked
  • Virus detected

Unchanged0

None

Changed2

  • High Risk Countries
  • Web traffic → Web and URL activity

Deleted0

None
Monitor Changes 6

New4

  • Blocked spyware traffic
  • Spyware detected
  • Traffic blocked
  • Virus detected

Unchanged0

None

Changed2

  • High-risk connection by source — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Cisco ASA

50 entries

Brand-New Fields 8

  • destination.registered_domain
  • neqter.log_type
  • source.packets
  • source.registered_domain
  • tls.server.issuer
  • tls.server.x509.not_after
  • tls.server.x509.serial_number
  • user.changes.roles

Changed Values and Behavior 14

  • event.action — normalized action.
  • event.outcome — normalized to success or failure.
  • event.category — now populated.
  • event.type — now populated.
  • event.kind — now set to event.
  • event.duration — now stored in nanoseconds.
  • message — now contains the parsed ASA message.
  • observer.vendor — now set to Cisco.
  • observer.product — now set to ASA.
  • network.direction — lowercase.
  • network.protocol — lowercase.
  • network.transport — lowercase.
  • Ports, byte counts, and packet counts — converted to integers.
  • log.syslog.timestamp — now accepts timestamps without a year.

Moved / Renamed 7

  • event.id → event.code
  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • user / source.user.name → user.name
  • sysloghost / host.hostname → observer.name
  • cisco_message → message
  • neqter_log_type → neqter.log_type
Dashboard Changes 12

New9

  • Admin login failure
  • All activity
  • Denied traffic
  • VPN activity
  • VPN failures
  • Configuration and command activity
  • HA failover event
  • VPN login failure
  • VPN login success

Unchanged0

None

Changed3

  • Connection Denied
  • High Risk Country
  • Web traffic → Web activity

Deleted0

None
Monitor Changes 9

New5

  • VPN login failure
  • VPN login success
  • Configuration/command activity
  • Admin login failure
  • HA failover event

Unchanged2

  • Connection denied by source
  • Connection denied by label

Changed2

  • High-risk connection by source — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Cisco Firepower

69 entries

Brand-New Fields 22

  • cisco.firepower.url.reputation
  • destination.registered_domain
  • event.severity_label
  • log.origin.file.line
  • log.origin.file.name
  • log.syslog.msgid
  • log.syslog.version
  • neqter.log_type
  • observer.egress.zone
  • observer.ingress.zone
  • process.command_line
  • process.thread.name
  • related.hash
  • server.domain
  • server.port
  • source.packets
  • tls.server.issuer
  • tls.server.x509.issuer.distinguished_name
  • tls.server.x509.not_after
  • tls.server.x509.serial_number
  • tls.server.x509.subject.distinguished_name
  • url.query

Changed Values and Behavior 19

  • event.action — normalized and lowercased.
  • event.category — standardized categories.
  • event.dataset — now follows cisco_firepower.*.
  • event.duration — now stored in nanoseconds.
  • event.kind — now set to event or alert.
  • event.outcome — normalized to success or failure.
  • event.severity — converted to an integer.
  • event.start — supports additional timestamp sources.
  • event.type — now populated.
  • message — normalized to contain the Firepower payload.
  • observer.vendor — now set to Cisco.
  • observer.product — now set to Firepower or ASA.
  • network.direction — lowercase.
  • network.protocol — normalized and lowercase.
  • network.transport — normalized and lowercase.
  • tls.version_protocol — lowercase.
  • Ports, byte counts, packet counts, and process IDs — converted to integers.
  • URL components — expanded parsing support.
  • JSON, RFC 5424, SFIMS, and appliance-process logs — newly supported.

Moved / Renamed 11

  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • client.user.name → user.name
  • client.user.group.name → user.group.name
  • server.user.name / source.user.name → user.name
  • client.address parsing → client.ip; client.address is still copied back.
  • source.address parsing → source.ip; source.address is still copied back.
  • destination.address parsing → destination.ip; destination.address is still copied back.
  • tls.client.subject → tls.server.subject
  • tls.client.issuer → tls.server.issuer
  • syslog_pri → log.syslog.*
Dashboard Changes 12

New11

  • All activity
  • Blocked connections
  • Error messages
  • Failed authentications
  • File events
  • High-risk connections
  • SSL activity
  • SSL failures
  • System errors
  • Threat and denied traffic
  • VPN activity

Unchanged0

None

Changed1

  • Web traffic → URL traffic

Deleted0

None
Monitor Changes 5

New5

  • High-risk connection by source
  • High-risk connection by country
  • Error messages
  • VPN session failures
  • Failed authentications

Unchanged0

None

Changed0

None

Cisco Meraki

41 entries

Brand-New Declared Fields 3

These fields were previously emitted dynamically but were missing from the 2.25.2 index pattern.
  • log.syslog.version
  • neqter.log_type
  • vpn.connectivity

Changed Values and Behavior 18

  • event.action — now populated and normalized.
  • event.category — standardized to network, web, authentication, or intrusion_detection.
  • event.dataset — now follows cisco_meraki.*.
  • event.kind — now set to event or alert.
  • event.outcome — allow and deny replaced with success and failure.
  • event.provider — now set to meraki.
  • event.severity — converted to an integer.
  • message — now contains the Meraki key/value payload.
  • network.direction — now populated for IDS events.
  • network.transport — lowercase.
  • observer.vendor — now set to Cisco.
  • observer.product — now set to Meraki.
  • rule.id — now populated from IDS signatures.
  • rule.name — now populated from flow patterns.
  • user.name — directory-name parsing corrected.
  • Source, destination, client, and server IP fields — typed .ip values are now created.
  • Source, destination, and NAT ports — converted to integers.
  • Additional firewall, VPN-firewall, IDS, and peer-contact formats — now supported.

Moved / Renamed 9

  • vpn.type → network.vpn.type
  • vpn.connectivity → event.action and event.outcome
  • Event type value → event.action
  • event.category is now normalized separately.
  • client.address → also copied to client.ip
  • server.address → also copied to server.ip
  • source.address → also copied to source.ip
  • destination.address → also copied to destination.ip
  • syslog_pri → log.syslog.*
Dashboard Changes 7

New4

  • All activity
  • Endpoint activity
  • Threat activity
  • VPN activity

Unchanged0

None

Changed3

  • Connection Denied
  • High Risk Country
  • Web traffic → URL activity

Deleted0

None
Monitor Changes 4

New0

None

Unchanged2

  • Connection denied by IP address
  • Connection denied by label

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Cisco Meraki API

17 entries

Brand-New Fields 8

  • client.id
  • client.name
  • event.ingested
  • file.hash.value
  • http.version
  • observer.mac
  • observer.type
  • url.query

Changed Values and Behavior 5

  • message — now uses message, then label, then the complete original event.
  • source.ip — accepts more Meraki source-IP properties and validates the IP.
  • event.category, event.dataset, event.kind, and event.type — additional API, security, and availability values.
  • event.outcome — API requests now produce success or failure; security events can produce blocked.
  • file.hash.* — hash type is automatically detected.
Dashboard Changes 4

New0

None

Unchanged0

None

Changed4

  • All activity
  • Failed wireless connections
  • Network events
  • Organization configuration changes

Deleted0

None
Monitor Changes 0
No monitors in either version.

Cisco Endpoint

18 entries

Brand-New Fields 2

  • event.ingested
  • related.hash

Moved / Changed Values 11

  • Audit action: event.outcome → event.action
  • Audit object type: event.type → event.code
  • Endpoint event type: event.type → event.action and event.code
  • neqter.type: cisco-secure-endpoint-api → cisco-secure-endpoint
  • event.category: audit/events → normalized ECS categories
  • event.type: raw Cisco values → normalized ECS types
  • event.outcome: raw audit action → success / failure
  • event.module: Cisco detection value → cisco_secure_endpoint
  • event.id: audit job_id → original audit_log_id
  • message — now has multiple fallbacks.
  • @timestamp — endpoint-event timestamps now include the UTC Z.
Dashboard Changes 5

New3

  • Audit logs
  • Endpoint events
  • DFC threats

Unchanged1

  • File events

Changed1

  • All activity

Deleted0

None
Monitor Changes 0
No monitors in either version.

CrowdStrike

8 entries

Brand-New Field 1

  • neqter.log_type = syslog

Changed Behavior 3

  • message — retains the original raw log when statusMessage is missing.
  • observer.ip — now comes from TCP metadata or host.ip.
  • related.* — automatically generated from observer, source, and user fields.

Dropped from Field Definitions but Still Written by the Parser 3

  • file.name
  • file.path
  • service.name
Dashboard Changes 1

New0

None

Unchanged0

None

Changed1

  • Activity → All activity

Deleted0

None
Monitor Changes 0
No monitors in either version.

Duo Security

35 entries

Brand-New Fields 6

  • duo.telephony.context
  • duo.telephony.credits
  • duo.telephony.phone_number
  • event.ingested
  • event.name
  • neqter.log_type

Changed Behavior 5

  • Added CEF log parsing.
  • Added Duo telephony log parsing.
  • message — changed from pretty-printed JSON to raw or event-specific text.
  • related.ip and related.user — enrichment moved to the shared pipeline and now includes more values.
  • Geo enrichment now keeps only city, country, location, and region.

Removed Fields 9

  • host.geo.continent_name
  • host.geo.country_iso_code
  • host.geo.name
  • host.geo.region_iso_code
  • host.target.geo.continent_name
  • host.target.geo.country_iso_code
  • host.target.geo.name
  • host.target.geo.region_iso_code
  • Temporary dumpster.* fields are now removed.
Dashboard Changes 8

New0

None

Unchanged6

  • Admin Login
  • Admin Reset Password
  • Failed Authentication
  • High Risk Host Country
  • Integration Created
  • Integration Deleted

Changed2

  • All activity
  • High Risk Host Target Country

Deleted0

None
Monitor Changes 7

New0

None

Unchanged7

  • High-risk access device by country
  • High-risk authentication device by country
  • Admin login
  • Admin password reset
  • Integration created
  • Integration deleted
  • Unsuccessful authentication

Changed0

None

FortiGate

76 entries

Brand-New Fields 27

  • destination.registered_domain
  • event.severity_label
  • neqter.log_type
  • observer.egress.zone
  • observer.ingress.zone
  • source.registered_domain
  • fortigate.endpoint.destination.family
  • fortigate.endpoint.destination.hardware_vendor
  • fortigate.endpoint.destination.master_mac
  • fortigate.endpoint.destination.os_name
  • fortigate.endpoint.destination.server
  • fortigate.endpoint.destination.software_version
  • fortigate.endpoint.destination.type
  • fortigate.endpoint.source.family
  • fortigate.endpoint.source.hardware_vendor
  • fortigate.endpoint.source.hardware_version
  • fortigate.endpoint.source.master_mac
  • fortigate.endpoint.source.name
  • fortigate.endpoint.source.os_name
  • fortigate.endpoint.source.server
  • fortigate.endpoint.source.software_version
  • fortigate.endpoint.source.type
  • fortigate.wireless.ap.name
  • fortigate.wireless.ap.serial_number
  • fortigate.wireless.channel
  • fortigate.wireless.encryption
  • fortigate.wireless.ssid

Moved / Renamed 7

  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • source.os.name → fortigate.endpoint.source.os_name
  • url.original / url.domain → destination.registered_domain
  • Source IP mapping: source.address → source.ip; source.address is then backfilled.
  • Destination IP mapping: destination.address → destination.ip; destination.address is then backfilled.
  • Raw FortiGate action: event.outcome → event.action

Changed Values and Behavior 8

  • event.dataset — now fortigate.<type> and lowercase.
  • event.outcome — normalized to success or failure.
  • event.action, event.category, and network.protocol — lowercase.
  • log.syslog.timestamp — now uses FortiGate date, time, and timezone.
  • source.port and destination.port — converted to integers.
  • message — prefers msg, then logdesc, then the raw log.
  • source.address — can now contain srcname instead of the IP.
  • network.transport — translates protocol numbers to icmp, tcp, or udp.

No Longer Populated 14

  • destination.bytes
  • network.direction
  • source.bytes
  • user.group.name
  • url.category
  • url.domain
  • url.original
  • log.syslog.facility.code
  • log.syslog.facility.name
  • log.syslog.priority
  • log.syslog.severity.code
  • source.geo.* except source.geo.country_name
  • destination.geo.* except destination.geo.country_name
  • Temporary kv.* and dumpster.* fields.
Dashboard Changes 12

New7

  • Admin login failed
  • Admin login successful
  • Configuration changed
  • All activity
  • Denied traffic
  • VPN failures
  • Successful SSL VPN login

Unchanged1

  • VPN Failed Login

Changed3

  • Web traffic
  • High Risk Countries
  • VPN traffic → VPN activity

Deleted1

  • Duplicate old Web traffic search
Monitor Changes 8

New4

  • Configuration changed
  • Admin login failed
  • Admin login successful
  • Successful SSL VPN login

Unchanged2

  • VPN failed login by IP address
  • VPN failed login by user

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by label — window 5 → 1 minute

Google Workspace

29 entries
Dashboard Changes 24

New5

  • Google 2-Step Verification disabled
  • Failed logins from outside the US
  • High-risk connections
  • Suspicious login blocked
  • User account suspended or deleted

Unchanged0

None

Changed19

  • Admin events
  • Delegated admin privileges and roles
  • Passwords changed
  • Users created
  • Users deleted or suspended
  • Documents made accessible outside organization
  • Drive events
  • File downloads
  • File uploads
  • File views
  • Primary Drive events
  • Failed login events
  • Login events
  • Successful login events
  • Suspicious login events
  • Document creations
  • Downloads
  • Events
  • Uploads

Deleted0

None
Monitor Changes 5

New5

  • High-risk connections
  • Failed logins outside the US
  • Suspicious login blocked
  • User suspended/deleted
  • Two-step verification disabled

Unchanged0

None

Changed0

None

Juniper

36 entries

Brand-New Fields 9

  • device.id
  • event.count
  • event.name
  • event.severity_label
  • neqter.log_type
  • network.vpn.gateway.name
  • network.vpn.ike.version
  • process.command_line
  • source.packets

Moved / Renamed 10

  • client.bytes → source.bytes
  • client.packets → source.packets
  • server.bytes → destination.bytes
  • server.packets → destination.packets
  • service.name → network.application
  • process.title → process.name
  • Juniper firewall value in observer.ip → host.ip
  • Direct source.address mapping → source.ip, then source.address is backfilled.
  • Direct destination.address mapping → destination.ip, then destination.address is backfilled.
  • syslog.severity.code → log.syslog.severity.code

Changed Values and Behavior 7

  • event.dataset now uses juniper.<dataset>.
  • event.outcome is normalized to success or failure.
  • event.duration changes from seconds to nanoseconds.
  • Ports, byte counts, packet counts, PIDs, and protocol numbers become integers.
  • network.transport now supports icmp, tcp, udp, gre, esp, and ah.
  • Concatenated Juniper messages are split into separate events.
  • Empty placeholder values such as N/A, UNKNOWN, and -1 are removed.
Dashboard Changes 6

New5

  • All activity
  • Failed authentication
  • Failed login
  • Successful authentication
  • Successful login

Unchanged0

None

Changed0

None

Deleted1

  • Web traffic
Monitor Changes 4

New4

  • Successful login
  • Failed login
  • Successful authentication
  • Failed authentication

Unchanged0

None

Changed0

None

Linksys

11 entries

Brand-New Indexed Field 1

  • neqter.log_type

Moved 1

  • source.interface → observer.ingress.interface.name

Newly Populated Existing Fields 2

  • related.hosts
  • related.user

Changed Values and Behavior 3

  • event.dataset is lowercase.
  • message retains the raw log when no message is parsed.
  • observer.ip uses connection metadata.
Dashboard Changes 2

New0

None

Unchanged1

  • All traffic

Changed1

  • High Risk Countries

Deleted0

None
Monitor Changes 2

New0

None

Unchanged0

None

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

OPNsense

94 entries

Brand-New Populated Fields 85

  • @timestamp
  • client.address
  • client.geo.city_name
  • client.geo.country_name
  • client.geo.location
  • client.geo.region_name
  • client.ip
  • destination.address
  • destination.geo.city_name
  • destination.geo.country_name
  • destination.geo.location
  • destination.geo.region_name
  • destination.ip
  • destination.port
  • event.action
  • event.category
  • event.code
  • event.dataset
  • event.id
  • event.kind
  • event.original
  • event.outcome
  • event.provider
  • event.reason
  • event.sequence
  • event.severity
  • event.type
  • file.path
  • http.request.method
  • http.version
  • log.level
  • log.syslog.facility.code
  • log.syslog.facility.name
  • log.syslog.priority
  • log.syslog.severity.code
  • log.syslog.severity.name
  • log.syslog.structured_data
  • log.syslog.timestamp
  • log.syslog.version
  • message
  • neqter.label
  • neqter.log_type
  • neqter.type
  • network.bytes
  • network.direction
  • network.iana_number
  • network.packets
  • network.protocol
  • network.transport
  • network.type
  • network.vlan.name
  • network.vpn.type
  • observer.egress.interface.name
  • observer.hostname
  • observer.ingress.interface.name
  • observer.ip
  • observer.product
  • observer.vendor
  • process.command_line
  • process.name
  • process.pid
  • related.hosts
  • related.ip
  • related.user
  • rule.category
  • rule.id
  • rule.ruleset
  • rule.uuid
  • server.address
  • server.ip
  • source.address
  • source.domain
  • source.geo.city_name
  • source.geo.country_name
  • source.geo.location
  • source.geo.region_name
  • source.ip
  • source.mac
  • source.port
  • url.domain
  • url.original
  • url.path
  • url.port
  • url.scheme
  • user.name

New Fixed Values 5

  • neqter.type = opnsense
  • event.provider = opnsense
  • event.dataset = opnsense.<process/package>
  • observer.vendor = Deciso
  • observer.product = OPNsense

Populated but Not Indexed 3

  • process.thread.id
  • icmp_unreachport_destination.address
  • icmp_unreach_network.transport
Dashboard Changes 1

New1

  • All activity

Unchanged0

None

Changed0

None

Deleted0

None
Monitor Changes 0
No monitors in either version.

Palo Alto

5 entries

Brand-New Field 1

  • neqter.log_type

Moved 2

  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
Dashboard Changes 2

New1

  • All activity

Unchanged0

None

Changed0

None

Deleted1

  • Web traffic
Monitor Changes 0
No monitors in either version.

pfSense

59 entries

Moved 11

  • event.kind (process name) → process.name
  • log.syslog.procid → process.pid
  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • error.message → event.reason
  • event.outcome (raw action) → event.action
  • dhcp_client_mac → source.mac
  • dhcp_client_hostname → source.domain
  • DHCP client IP → source.ip
  • DHCP VLAN → network.vlan.name
  • OpenVPN client → user.name

Brand-New / Newly Populated 31

  • client.address
  • client.geo.city_name
  • client.geo.country_name
  • client.geo.location
  • client.geo.region_name
  • client.ip
  • event.category
  • event.code
  • event.provider
  • event.reason
  • event.severity
  • file.path
  • http.request.method
  • http.version
  • log.level
  • neqter.log_type
  • network.protocol
  • network.vpn.type
  • observer.product
  • observer.vendor
  • process.command_line
  • rule.category
  • rule.ruleset
  • related.user
  • server.address
  • server.ip
  • url.domain
  • url.original
  • url.path
  • url.port
  • url.scheme

Changed Values and Behavior 8

  • event.kind: process name → event or alert.
  • event.dataset: old Charon descriptions → pfsense.<process/package>.
  • event.outcome: pass / block / reject → success / failure.
  • event.action: now contains the raw pass, block, or reject action.
  • event.type: expanded to connection, protocol, info, and error.
  • network.type: 4 / 6 → ipv4 / ipv6.
  • network.bytes: no longer populated from filterlog packet length; still used for Charon.
  • Ports, sequence, priority, version, byte, and packet fields: string → integer.
Dashboard Changes 7

New5

  • All activity
  • Threat activity
  • Threat and denied traffic
  • VPN activity
  • VPN failures

Unchanged1

  • High Risk Countries

Changed1

  • Web traffic → URL activity

Deleted0

None
Monitor Changes 2

New0

None

Unchanged0

None

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

PreVeil

3 entries

Brand-New / Newly Indexed 2

Possible source typo: log.syslog.timestam may have been intended as log.syslog.timestamp.
  • neqter.log_type
  • log.syslog.timestam
Dashboard Changes 1

New0

None

Unchanged0

None

Changed1

  • Activity → All activity

Deleted0

None
Monitor Changes 0
No monitors in either version.

SentinelOne

6 entries

Brand-New / Newly Indexed 1

  • neqter.log_type

Changed Behavior 4

  • observer.ip — previously included deviceAddress; now only contains the syslog sender IP.
  • server.ip — now contains deviceAddress.
  • server.domain — now contains deviceHostName.
  • observer.name — no longer populated.
Dashboard Changes 1

New0

None

Unchanged0

None

Changed1

  • Activity → All activity

Deleted0

None
Monitor Changes 0
No monitors in either version.

SonicWall

59 entries

Moved 4

  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • kv.rule: rule.id → rule.name
  • rule.id is now populated from sid, ruleid, ruleId, ruleID, or parsed from rule.name.

Brand-New / Newly Populated and Indexed 20

  • destination.packets
  • event.dataset
  • event.duration
  • event.outcome
  • event.provider
  • event.sequence
  • event.severity
  • neqter.log_type
  • network.application
  • network.name
  • network.vpn.name
  • observer.hostname
  • observer.product
  • observer.vendor
  • rule.name
  • rule.ruleset
  • source.packets
  • url.path
  • user.domain
  • user.email

Changed Values and Behavior 9

  • event.kind: SonicWall category description → event.
  • event.category: title-case values → lowercase normalized values.
  • event.type: descriptive values → start, end, or denied.
  • event.action: expanded and normalized mappings.
  • event.outcome: now success / failure.
  • event.duration: converted to nanoseconds.
  • rule.id: no longer populated directly from kv.rule.
  • url.original: rebuilt from url.domain and url.path.
  • Numeric byte, packet, port, sequence, severity, and ICMP values: string → integer.
Dashboard Changes 15

New13

  • Administrative account and user management changes
  • All activity
  • Authentication failures
  • Authentication successes
  • Blocked traffic
  • Firewall and security policy changes
  • Hardware/resource exhaustion/reboots
  • HA failover and cluster problems
  • Security service failures and expired protection
  • Threat detection and active attacks
  • VPN activity
  • VPN failures
  • VPN tunnel failures

Unchanged1

  • High Risk Country

Changed1

  • Web traffic → Web activity

Deleted0

None
Monitor Changes 11

New9

  • Successful authentications
  • Failed authentications
  • Firewall/security policy changes
  • Admin/user-management changes
  • VPN tunnel failure
  • HA/cluster problems
  • Hardware/resource/reboot events
  • Threat/attack events
  • Security-service failures

Unchanged0

None

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Sophos UTM

83 entries

Moved 8

  • kv.action: event.outcome → event.action
  • kv.sys: event.category → event.dataset
  • kv.srcip: source.address → source.ip
  • kv.dstip: destination.address → destination.ip
  • syslog_host → observer.name
  • syslog_program → process.name
  • syslog_pid → process.pid
  • source.address and destination.address are still derived from the IP fields.

Brand-New / Newly Populated 50

  • destination.domain
  • dns.question.name
  • dns.question.type
  • dns.resolved_ip
  • dns.view
  • error.message
  • event.action
  • event.code
  • event.correlation_id
  • event.dataset
  • event.duration
  • event.id
  • event.kind
  • event.provider
  • event.reason
  • event.sequence
  • event.severity
  • event.type
  • http.request.method
  • http.request.referrer
  • http.response.bytes
  • http.response.status_code
  • log.level
  • neqter.log_type
  • network.application
  • network.bytes
  • network.iana_number
  • network.protocol
  • network.tcp.flags
  • network.transport
  • observer.egress.interface.name
  • observer.hostname
  • observer.ingress.interface.name
  • observer.name
  • observer.product
  • observer.vendor
  • process.command_line
  • process.name
  • process.pid
  • rule.category
  • rule.id
  • rule.name
  • rule.ruleset
  • source.domain
  • url.path
  • user.domain
  • user.email
  • user.group.name
  • user.id
  • user_agent.original

Changed Values and Behavior 8

  • event.outcome: raw Sophos action → success / failure.
  • event.action: now contains the raw action and is lowercased.
  • event.category: old sys value → normalized activity category.
  • event.dataset: sophos_utm.<process/dataset>.<category>.
  • event.kind: event, or alert for Snort.
  • network.transport: derived from network.iana_number.
  • user.name containing email: split into user.name, user.email, and user.domain.
  • Numeric duration, byte, port, severity, PID, and status values: string → integer.
Dashboard Changes 10

New8

  • All activity
  • Authentication failures
  • Authentication successes
  • Critical events
  • Emergency events
  • Error events
  • High-risk country
  • Threat and denied traffic

Unchanged0

None

Changed1

  • Web traffic

Deleted1

  • Duplicate old Web traffic search
Monitor Changes 7

New7

  • Authentication failures
  • Authentication successes
  • Critical events
  • Emergency events
  • Error events
  • High-risk connection by country
  • High-risk connection by IP address

Unchanged0

None

Changed0

None

Sophos XG/XGS

45 entries

Moved 4

  • event.action (log_subtype) → event.kind
  • event.risk_score → event.severity
  • network.transport (protocol) → network.protocol
  • network.transport now contains application technology.

Brand-New / Newly Populated and Indexed 17

  • event.id
  • event.reason
  • host.hostname
  • host.ip
  • network.application
  • network.type
  • observer.egress.interface.name
  • observer.egress.zone
  • observer.ingress.interface.name
  • observer.ingress.zone
  • rule.description
  • rule.id
  • rule.name
  • rule.ruleset
  • rule.uuid
  • tls.version
  • neqter.log_type

Changed Values and Behavior 8

  • event.action: log_subtype → con_event / connevent.
  • event.kind: now contains log_subtype.
  • event.severity: now contains app_risk / application_risk.
  • network.protocol: now contains protocol.
  • network.transport: protocol → app_technology / application_technology.
  • destination.bytes: recv_bytes → bytes_received.
  • source.bytes: sent_bytes → bytes_sent.
  • user.group.name: user_gp → user_group / usergroupname.

No Longer Populated 1

  • event.risk_score
Dashboard Changes 9

New6

  • All activity
  • High Risk Countries
  • Authentication failures
  • Authentication successes
  • Threat and denied traffic
  • VPN activity

Unchanged1

  • Sophos XG Authentication

Changed1

  • Web traffic → URL activity

Deleted1

  • Duplicate old Web traffic search
Monitor Changes 6

New4

  • High-risk connection by IP address
  • High-risk connection by label
  • Successful authentications
  • Failed authentications

Unchanged2

  • Failed authentication by IP address
  • Failed authentication by user

Changed0

None

Synology

12 entries
Dashboard Changes 7

New3

  • Authentication activity
  • Authentication failures
  • File deletes

Unchanged1

  • Failed Login

Changed2

  • All traffic → All activity
  • File traffic → File activity

Deleted1

  • System messages
Monitor Changes 5

New3

  • Authentication failures by source
  • File deletes by user
  • File-activity spike by user

Unchanged2

  • Failed login by IP address
  • Failed login by user

Changed0

None

TeraStation

7 entries

Parser Changes 1

  • None

Moved Fields 1

  • None

Changed Values / Types 1

  • None

Brand-New / Newly Indexed 1

  • neqter.log_type
Dashboard Changes 3

New0

None

Unchanged0

None

Changed3

  • All traffic → All activity
  • File traffic → File activity
  • System messages

Deleted0

None
Monitor Changes 0
No monitors in either version.

Ubiquiti UniFi

105 entries

Brand-New / Newly Populated 59

  • client.bytes
  • client.ip
  • client.mac
  • destination.domain
  • destination.ip
  • destination.user.id
  • destination.user.name
  • event.code
  • event.module
  • event.name
  • event.provider
  • event.severity
  • host.hostname
  • log.syslog.severity.code
  • log.syslog.severity.name
  • log.syslog.timestamp
  • network.vlan.id
  • related.ip
  • server.bytes
  • server.domain
  • server.mac
  • source.domain
  • source.ip
  • source.user.id
  • source.user.name
  • ubiquiti.unifi.access_method
  • ubiquiti.unifi.category
  • ubiquiti.unifi.connected_to.device.ip
  • ubiquiti.unifi.connected_to.device.mac
  • ubiquiti.unifi.connected_to.device.model
  • ubiquiti.unifi.connected_to.device.name
  • ubiquiti.unifi.connected_to.device.port
  • ubiquiti.unifi.connected_to.device.version
  • ubiquiti.unifi.duration
  • ubiquiti.unifi.host
  • ubiquiti.unifi.last_connected_to.device.ip
  • ubiquiti.unifi.last_connected_to.device.mac
  • ubiquiti.unifi.last_connected_to.device.model
  • ubiquiti.unifi.last_connected_to.device.name
  • ubiquiti.unifi.last_connected_to.device.port
  • ubiquiti.unifi.last_connected_to.device.version
  • ubiquiti.unifi.last_connected_to.wifi.rssi
  • ubiquiti.unifi.link_speed
  • ubiquiti.unifi.network.subnet
  • ubiquiti.unifi.settings.change_count
  • ubiquiti.unifi.settings.changes
  • ubiquiti.unifi.settings.entry
  • ubiquiti.unifi.settings.section
  • ubiquiti.unifi.site
  • ubiquiti.unifi.sub_category
  • ubiquiti.unifi.usage.down
  • ubiquiti.unifi.usage.up
  • ubiquiti.unifi.wifi.airtime_utilization
  • ubiquiti.unifi.wifi.band
  • ubiquiti.unifi.wifi.channel
  • ubiquiti.unifi.wifi.channel_width
  • ubiquiti.unifi.wifi.interference
  • ubiquiti.unifi.wifi.name
  • ubiquiti.unifi.wifi.rssi

Moved 4

  • observer.ingress.interface.id → observer.ingress.interface.name
  • observer.hostname (BSSID) → observer.mac
  • host.mac / observer.mac (station MAC) → client.mac and source.mac
  • event.kind / event.category raw identifiers → event.code

Existing Fields with Changed Values / Behavior 25

  • event.action
  • event.category
  • event.dataset
  • event.id
  • event.kind
  • event.outcome
  • event.reason
  • event.type
  • host.mac
  • host.name
  • message
  • network.name
  • network.transport
  • observer.ingress.interface.name
  • observer.mac
  • observer.product
  • observer.vendor
  • observer.version
  • process.pid
  • related.hosts
  • server.ip
  • source.mac
  • source.port
  • destination.mac
  • destination.port

No Longer Populated 2

  • observer.ingress.interface.id
  • observer.hostname
Dashboard Changes 9

New1

  • Configuration changes

Unchanged3

  • Attempted Information Leak
  • High Risk Country
  • Miscellaneous Attack

Changed2

  • Admin activity → Admin accessed UniFi network
  • All activity → All traffic

Deleted3

  • Client activity
  • Rule triggers
  • Security detections
Monitor Changes 6

New2

  • Configuration changes
  • Admin accessed UniFi network

Unchanged2

  • High-risk connection by IP address
  • High-risk connection by country

Changed2

  • Attempted information leak — no-grouping value changed from “Do not group by a field” to blank, with the same behavior
  • Miscellaneous attack — no-grouping value changed from “Do not group by a field” to blank, with the same behavior

vCenter

55 entries
vCenter did not exist in version 2.25.2. All listed fields are new.

Unchanged / Moved / Removed 1

  • None

Brand-New Fields 52

  • @timestamp
  • event.action
  • event.category
  • event.code
  • event.correlation_id
  • event.created
  • event.dataset
  • event.id
  • event.kind
  • event.module
  • event.name
  • event.original
  • event.outcome
  • event.provider
  • event.reason
  • event.sequence
  • event.severity
  • event.severity_label
  • event.type
  • event.value.new
  • event.value.old
  • host.name
  • log.level
  • log.syslog.appname
  • log.syslog.facility.code
  • log.syslog.facility.name
  • log.syslog.procid
  • log.syslog.severity.code
  • log.syslog.severity.name
  • log.syslog.timestamp
  • message
  • neqter.label
  • neqter.type
  • observer.name
  • observer.product
  • observer.vendor
  • process.command_line
  • process.name
  • process.pid
  • process.thread.name
  • related.hosts
  • related.user
  • source.address
  • source.ip
  • source.geo.city_name
  • source.geo.country_name
  • source.geo.location
  • source.geo.region_name
  • user_agent.original
  • user.domain
  • user.email
  • user.name

Temporary and Not Indexed / Searchable 1

  • dumpster.vcenter.*
Dashboard Changes 1

New1

  • All activity

Unchanged0

None

Changed0

None

Deleted0

None
Monitor Changes 0
No monitors in either version.

WatchGuard

67 entries

Brand-New / Newly Populated 22

  • event.dataset
  • event.kind
  • event.provider
  • event.risk_score
  • event.sequence
  • http.request.referrer
  • network.application
  • network.direction
  • network.type
  • observer.egress.interface.name
  • observer.ingress.interface.name
  • observer.vendor
  • process.name
  • process.pid
  • related.hash
  • rule.description
  • tls.cipher
  • tls.version
  • tls.version_protocol
  • url.original
  • url.port
  • url.scheme

Moved 4

  • Plain kv.msg: event.type → event.reason
  • Secondary action values: event.action → rule.description
  • Combined interface data → network.name and network.transport
  • Filterlog interface → observer.ingress.interface.name or observer.egress.interface.name

Existing Fields with Changed Values / Behavior 20

  • client.address
  • destination.address
  • destination.bytes
  • destination.port
  • event.action
  • event.category
  • event.duration
  • event.outcome
  • event.reason
  • event.type
  • file.path
  • message
  • network.name
  • network.transport
  • rule.category
  • rule.name
  • source.address
  • source.bytes
  • source.port
  • user.email
Dashboard Changes 11

New9

  • Firewall restart alert
  • Firewall session exhaustion alert
  • Potential attack traffic alert
  • Security protection coverage reduced alert
  • All activity
  • Authentication failures
  • Authentication successes
  • Denied traffic
  • VPN activity

Unchanged1

  • High Risk Country

Changed1

  • Web traffic → URL activity

Deleted0

None
Monitor Changes 10

New8

  • Failed authentication by source IP
  • Failed authentication by user
  • Firewall restart
  • Session exhaustion
  • Attack traffic
  • Reduced security coverage
  • Successful authentication by source IP
  • Successful authentication by user

Unchanged0

None

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Windows

112 entries

New parsed fields 7

  • winlog.event_data.ElevatedToken
  • winlog.event_data.ImpersonationLevel
  • winlog.event_data.RestrictedAdminMode
  • winlog.event_data.TargetLogonId
  • winlog.event_data.TargetUserSid
  • winlog.event_data.VirtualAccount
  • winlog.event_data.WorkstationName

New Uncommitted Fields — 8 Fields 8

  • winlog.event_data.AdditionalInfo2
  • winlog.event_data.AuthenticationPackageName
  • winlog.event_data.ExecutablePath
  • winlog.event_data.FileName
  • winlog.event_data.LinkName
  • winlog.event_data.SecurityPackageName
  • winlog.event_data.TargetProcessName
  • winlog.event_data.Url

Uncommitted Changed Behavior 1

  • event.reason — now populated from the first message / event.original line when missing.

Changed Values 4

  • ElevatedToken: %%1842 / %%1843 → Elevated Token: Yes / Elevated Token: No.
  • VirtualAccount: %%1842 / %%1843 → Yes / No.
  • RestrictedAdminMode: %%1842 / %%1843 → Yes / No.
  • ImpersonationLevel: numeric tokens → named impersonation levels.

No Longer Populated 1

  • observer.ip

No Longer Indexed / Searchable 1

  • agent.id
Dashboard Changes 82

New56

  • Account Lifecycle Activity
  • Authentication Activity
  • Domain Admins Group Changes
  • Failed Remote Logins
  • High Signal Security Events
  • NTLM Authentication Attempts
  • Privilege and Admin Activity
  • Privileged Activity
  • Privileged Group Membership Changes
  • Recently Enabled Devices
  • Recently Installed Software
  • Service Account Logins
  • Software Events
  • Special Privileges Assigned
  • Password Resets
  • Critical AD Security Events alert
  • Account Management Group Membership
  • Account Management User Accounts
  • Audit Policy Changes
  • Explicit Credential Use
  • Failed Interactive Logons
  • Firewall Operational Events
  • Firewall Policy and Configuration
  • Firewall Rule Changes
  • Logoffs
  • NTLM Authentication Failure
  • Operating System Activity
  • PowerShell Activity
  • Privileged Logon
  • Remote Desktop Login
  • Scheduled Task Activity
  • Scheduled Task Created
  • Security Log Cleared
  • Service Activity
  • Software Lifecycle
  • Successful Interactive Logons
  • User Account Changed
  • User Account Disabled
  • User Account Enabled
  • Windows Service Installed
  • Wireless Network Activity
  • Workstation Activity
  • File Auditing Policy Changes
  • File Auditing Policy Change Details
  • File Access and Activity
  • File Access Details
  • File Creation/Modification/Deletion
  • File Creation/Modification/Deletion Details
  • Mass File Deletion
  • Permission and Ownership Changes
  • Permission and Ownership Details
  • Permission Changes
  • Removable Media Activity
  • Removable Media Details
  • Share Access Events
  • Share Access Details

Unchanged0

None

Changed25

  • Administrator Logon alert
  • Domain Policy Change alert
  • Failed User Login alert
  • File Deletion alert
  • Login Failure by Administrator alert
  • Login Failure by IP alert
  • Login Failure by Workstation alert
  • Active Directory All Activity
  • Failed User Logins
  • Recently Created Users
  • Recently Deleted Users
  • Recently Disabled Users
  • Recently Locked Out Users
  • Successful User Logins
  • Event Logs All Activity
  • File Auditing Added or Modified Items
  • File Auditing All Activity
  • File Auditing Audit Failure
  • Admin Login Activity
  • Authentication Failed Logons
  • Authentication Successful Logons
  • User Account Created
  • User Account Deleted
  • File Deletion
  • Veeam All Activity

Deleted1

  • Duplicate Event Logs – Login Failure by IP search
Monitor Changes 8

New1

  • Critical AD Security Events

Unchanged7

  • Login failure by user
  • Login failure by IP
  • Login failure by workstation
  • Login failure by Administrator
  • Administrator login
  • Domain policy change
  • File deletion

Changed0

None

Document updated July 24, 2026.

Return to Change Log