Link
Search

Input / Field / Parser Changes

Consolidated field additions, mappings, value changes, parser behavior, removals, indexing notes, dashboard changes, and monitor changes organized by input.

26 inputs 1,129 documented entries Compared with 2.25.2 where noted

Barracuda

27 entries

Dashboard Changes 8

New6

  • All activity
  • Denied traffic
  • Blocked spyware traffic
  • Spyware detected
  • Traffic blocked
  • Virus detected

Unchanged0

None

Changed2

  • High Risk Countries
  • Web traffic → Web and URL activity

Deleted0

None

Monitor Changes 6

New4

  • Blocked spyware traffic
  • Spyware detected
  • Traffic blocked
  • Virus detected

Unchanged0

None

Changed2

  • High-risk connection by source — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Brand-New Fields 9

  • barracuda.policy.action
  • barracuda.policy.action_type_code
  • barracuda.policy.format_version
  • barracuda.policy.match_flag
  • barracuda.policy.matched
  • barracuda.policy.source_type
  • barracuda.policy.source_type_code
  • barracuda.policy.time_qualified
  • barracuda.policy.time_qualified_flag

Changed Values and Parsing 4

  • event.dataset — now forced to lowercase.
  • event.outcome — Allowed → allowed; Denied → denied; all other outcome values are also lowercased.
  • related.hosts — moved from 203_extra_parsing to 207_related_hosts.
  • related.hosts — now includes source and destination addresses and IPs, observer IP, URL domain, and other host values.

Cisco ASA

50 entries

Dashboard Changes 12

New9

  • Admin login failure
  • All activity
  • Denied traffic
  • VPN activity
  • VPN failures
  • Configuration and command activity
  • HA failover event
  • VPN login failure
  • VPN login success

Unchanged0

None

Changed3

  • Connection Denied
  • High Risk Country
  • Web traffic → Web activity

Deleted0

None

Monitor Changes 9

New5

  • VPN login failure
  • VPN login success
  • Configuration/command activity
  • Admin login failure
  • HA failover event

Unchanged2

  • Connection denied by source
  • Connection denied by label

Changed2

  • High-risk connection by source — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Brand-New Fields 8

  • destination.registered_domain
  • neqter.log_type
  • source.packets
  • source.registered_domain
  • tls.server.issuer
  • tls.server.x509.not_after
  • tls.server.x509.serial_number
  • user.changes.roles

Changed Values and Behavior 14

  • event.action — normalized action.
  • event.outcome — normalized to success or failure.
  • event.category — now populated.
  • event.type — now populated.
  • event.kind — now set to event.
  • event.duration — now stored in nanoseconds.
  • message — now contains the parsed ASA message.
  • observer.vendor — now set to Cisco.
  • observer.product — now set to ASA.
  • network.direction — lowercase.
  • network.protocol — lowercase.
  • network.transport — lowercase.
  • Ports, byte counts, and packet counts — converted to integers.
  • log.syslog.timestamp — now accepts timestamps without a year.

Moved / Renamed 7

  • event.id → event.code
  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • user / source.user.name → user.name
  • sysloghost / host.hostname → observer.name
  • cisco_message → message
  • neqter_log_type → neqter.log_type

Cisco Firepower

69 entries

Dashboard Changes 12

New11

  • All activity
  • Blocked connections
  • Error messages
  • Failed authentications
  • File events
  • High-risk connections
  • SSL activity
  • SSL failures
  • System errors
  • Threat and denied traffic
  • VPN activity

Unchanged0

None

Changed1

  • Web traffic → URL traffic

Deleted0

None

Monitor Changes 5

New5

  • High-risk connection by source
  • High-risk connection by country
  • Error messages
  • VPN session failures
  • Failed authentications

Unchanged0

None

Changed0

None

Brand-New Fields 22

  • cisco.firepower.url.reputation
  • destination.registered_domain
  • event.severity_label
  • log.origin.file.line
  • log.origin.file.name
  • log.syslog.msgid
  • log.syslog.version
  • neqter.log_type
  • observer.egress.zone
  • observer.ingress.zone
  • process.command_line
  • process.thread.name
  • related.hash
  • server.domain
  • server.port
  • source.packets
  • tls.server.issuer
  • tls.server.x509.issuer.distinguished_name
  • tls.server.x509.not_after
  • tls.server.x509.serial_number
  • tls.server.x509.subject.distinguished_name
  • url.query

Changed Values and Behavior 19

  • event.action — normalized and lowercased.
  • event.category — standardized categories.
  • event.dataset — now follows cisco_firepower.*.
  • event.duration — now stored in nanoseconds.
  • event.kind — now set to event or alert.
  • event.outcome — normalized to success or failure.
  • event.severity — converted to an integer.
  • event.start — supports additional timestamp sources.
  • event.type — now populated.
  • message — normalized to contain the Firepower payload.
  • observer.vendor — now set to Cisco.
  • observer.product — now set to Firepower or ASA.
  • network.direction — lowercase.
  • network.protocol — normalized and lowercase.
  • network.transport — normalized and lowercase.
  • tls.version_protocol — lowercase.
  • Ports, byte counts, packet counts, and process IDs — converted to integers.
  • URL components — expanded parsing support.
  • JSON, RFC 5424, SFIMS, and appliance-process logs — newly supported.

Moved / Renamed 11

  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • client.user.name → user.name
  • client.user.group.name → user.group.name
  • server.user.name / source.user.name → user.name
  • client.address parsing → client.ip; client.address is still copied back.
  • source.address parsing → source.ip; source.address is still copied back.
  • destination.address parsing → destination.ip; destination.address is still copied back.
  • tls.client.subject → tls.server.subject
  • tls.client.issuer → tls.server.issuer
  • syslog_pri → log.syslog.*

Cisco Meraki

41 entries

Dashboard Changes 7

New4

  • All activity
  • Endpoint activity
  • Threat activity
  • VPN activity

Unchanged0

None

Changed3

  • Connection Denied
  • High Risk Country
  • Web traffic → URL activity

Deleted0

None

Monitor Changes 4

New0

None

Unchanged2

  • Connection denied by IP address
  • Connection denied by label

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Brand-New Declared Fields 3

These fields were previously emitted dynamically but were missing from the 2.25.2 index pattern.
  • log.syslog.version
  • neqter.log_type
  • vpn.connectivity

Changed Values and Behavior 18

  • event.action — now populated and normalized.
  • event.category — standardized to network, web, authentication, or intrusion_detection.
  • event.dataset — now follows cisco_meraki.*.
  • event.kind — now set to event or alert.
  • event.outcome — allow and deny replaced with success and failure.
  • event.provider — now set to meraki.
  • event.severity — converted to an integer.
  • message — now contains the Meraki key/value payload.
  • network.direction — now populated for IDS events.
  • network.transport — lowercase.
  • observer.vendor — now set to Cisco.
  • observer.product — now set to Meraki.
  • rule.id — now populated from IDS signatures.
  • rule.name — now populated from flow patterns.
  • user.name — directory-name parsing corrected.
  • Source, destination, client, and server IP fields — typed .ip values are now created.
  • Source, destination, and NAT ports — converted to integers.
  • Additional firewall, VPN-firewall, IDS, and peer-contact formats — now supported.

Moved / Renamed 9

  • vpn.type → network.vpn.type
  • vpn.connectivity → event.action and event.outcome
  • Event type value → event.action
  • event.category is now normalized separately.
  • client.address → also copied to client.ip
  • server.address → also copied to server.ip
  • source.address → also copied to source.ip
  • destination.address → also copied to destination.ip
  • syslog_pri → log.syslog.*

Cisco Meraki API

17 entries

Dashboard Changes 4

New0

None

Unchanged0

None

Changed4

  • All activity
  • Failed wireless connections
  • Network events
  • Organization configuration changes

Deleted0

None

Monitor Changes 0

No monitors in either version.

Brand-New Fields 8

  • client.id
  • client.name
  • event.ingested
  • file.hash.value
  • http.version
  • observer.mac
  • observer.type
  • url.query

Changed Values and Behavior 5

  • message — now uses message, then label, then the complete original event.
  • source.ip — accepts more Meraki source-IP properties and validates the IP.
  • event.category, event.dataset, event.kind, and event.type — additional API, security, and availability values.
  • event.outcome — API requests now produce success or failure; security events can produce blocked.
  • file.hash.* — hash type is automatically detected.

Cisco Endpoint

18 entries

Dashboard Changes 5

New3

  • Audit logs
  • Endpoint events
  • DFC threats

Unchanged1

  • File events

Changed1

  • All activity

Deleted0

None

Monitor Changes 0

No monitors in either version.

Brand-New Fields 2

  • event.ingested
  • related.hash

Moved / Changed Values 11

  • Audit action: event.outcome → event.action
  • Audit object type: event.type → event.code
  • Endpoint event type: event.type → event.action and event.code
  • neqter.type: cisco-secure-endpoint-api → cisco-secure-endpoint
  • event.category: audit/events → normalized ECS categories
  • event.type: raw Cisco values → normalized ECS types
  • event.outcome: raw audit action → success / failure
  • event.module: Cisco detection value → cisco_secure_endpoint
  • event.id: audit job_id → original audit_log_id
  • message — now has multiple fallbacks.
  • @timestamp — endpoint-event timestamps now include the UTC Z.

CrowdStrike

8 entries

Dashboard Changes 1

New0

None

Unchanged0

None

Changed1

  • Activity → All activity

Deleted0

None

Monitor Changes 0

No monitors in either version.

Brand-New Field 1

  • neqter.log_type = syslog

Changed Behavior 3

  • message — retains the original raw log when statusMessage is missing.
  • observer.ip — now comes from TCP metadata or host.ip.
  • related.* — automatically generated from observer, source, and user fields.

Dropped from Ashley 4 Field Definition but Still Written by the Parser 3

  • file.name
  • file.path
  • service.name

Duo Security

35 entries

Dashboard Changes 8

New0

None

Unchanged6

  • Admin Login
  • Admin Reset Password
  • Failed Authentication
  • High Risk Host Country
  • Integration Created
  • Integration Deleted

Changed2

  • All activity
  • High Risk Host Target Country

Deleted0

None

Monitor Changes 7

New0

None

Unchanged7

  • High-risk access device by country
  • High-risk authentication device by country
  • Admin login
  • Admin password reset
  • Integration created
  • Integration deleted
  • Unsuccessful authentication

Changed0

None

Brand-New Fields 6

  • duo.telephony.context
  • duo.telephony.credits
  • duo.telephony.phone_number
  • event.ingested
  • event.name
  • neqter.log_type

Changed Behavior 5

  • Added CEF log parsing.
  • Added Duo telephony log parsing.
  • message — changed from pretty-printed JSON to raw or event-specific text.
  • related.ip and related.user — enrichment moved to the shared pipeline and now includes more values.
  • Geo enrichment now keeps only city, country, location, and region.

Removed Fields 9

  • host.geo.continent_name
  • host.geo.country_iso_code
  • host.geo.name
  • host.geo.region_iso_code
  • host.target.geo.continent_name
  • host.target.geo.country_iso_code
  • host.target.geo.name
  • host.target.geo.region_iso_code
  • Temporary dumpster.* fields are now removed.

FortiGate

76 entries

Dashboard Changes 12

New7

  • Admin login failed
  • Admin login successful
  • Configuration changed
  • All activity
  • Denied traffic
  • VPN failures
  • Successful SSL VPN login

Unchanged1

  • VPN Failed Login

Changed3

  • Web traffic
  • High Risk Countries
  • VPN traffic → VPN activity

Deleted1

  • Duplicate old Web traffic search

Monitor Changes 8

New4

  • Configuration changed
  • Admin login failed
  • Admin login successful
  • Successful SSL VPN login

Unchanged2

  • VPN failed login by IP address
  • VPN failed login by user

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by label — window 5 → 1 minute

Brand-New Fields 27

  • destination.registered_domain
  • event.severity_label
  • neqter.log_type
  • observer.egress.zone
  • observer.ingress.zone
  • source.registered_domain
  • fortigate.endpoint.destination.family
  • fortigate.endpoint.destination.hardware_vendor
  • fortigate.endpoint.destination.master_mac
  • fortigate.endpoint.destination.os_name
  • fortigate.endpoint.destination.server
  • fortigate.endpoint.destination.software_version
  • fortigate.endpoint.destination.type
  • fortigate.endpoint.source.family
  • fortigate.endpoint.source.hardware_vendor
  • fortigate.endpoint.source.hardware_version
  • fortigate.endpoint.source.master_mac
  • fortigate.endpoint.source.name
  • fortigate.endpoint.source.os_name
  • fortigate.endpoint.source.server
  • fortigate.endpoint.source.software_version
  • fortigate.endpoint.source.type
  • fortigate.wireless.ap.name
  • fortigate.wireless.ap.serial_number
  • fortigate.wireless.channel
  • fortigate.wireless.encryption
  • fortigate.wireless.ssid

Moved / Renamed 7

  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • source.os.name → fortigate.endpoint.source.os_name
  • url.original / url.domain → destination.registered_domain
  • Source IP mapping: source.address → source.ip; source.address is then backfilled.
  • Destination IP mapping: destination.address → destination.ip; destination.address is then backfilled.
  • Raw FortiGate action: event.outcome → event.action

Changed Values and Behavior 8

  • event.dataset — now fortigate.<type> and lowercase.
  • event.outcome — normalized to success or failure.
  • event.action, event.category, and network.protocol — lowercase.
  • log.syslog.timestamp — now uses FortiGate date, time, and timezone.
  • source.port and destination.port — converted to integers.
  • message — prefers msg, then logdesc, then the raw log.
  • source.address — can now contain srcname instead of the IP.
  • network.transport — translates protocol numbers to icmp, tcp, or udp.

No Longer Populated 14

  • destination.bytes
  • network.direction
  • source.bytes
  • user.group.name
  • url.category
  • url.domain
  • url.original
  • log.syslog.facility.code
  • log.syslog.facility.name
  • log.syslog.priority
  • log.syslog.severity.code
  • source.geo.* except source.geo.country_name
  • destination.geo.* except destination.geo.country_name
  • Temporary kv.* and dumpster.* fields.

Google Workspace

29 entries

Dashboard Changes 24

New5

  • Google 2-Step Verification disabled
  • Failed logins from outside the US
  • High-risk connections
  • Suspicious login blocked
  • User account suspended or deleted

Unchanged0

None

Changed19

  • Admin events
  • Delegated admin privileges and roles
  • Passwords changed
  • Users created
  • Users deleted or suspended
  • Documents made accessible outside organization
  • Drive events
  • File downloads
  • File uploads
  • File views
  • Primary Drive events
  • Failed login events
  • Login events
  • Successful login events
  • Suspicious login events
  • Document creations
  • Downloads
  • Events
  • Uploads

Deleted0

None

Monitor Changes 5

New5

  • High-risk connections
  • Failed logins outside the US
  • Suspicious login blocked
  • User suspended/deleted
  • Two-step verification disabled

Unchanged0

None

Changed0

None

Juniper

36 entries

Dashboard Changes 6

New5

  • All activity
  • Failed authentication
  • Failed login
  • Successful authentication
  • Successful login

Unchanged0

None

Changed0

None

Deleted1

  • Web traffic

Monitor Changes 4

New4

  • Successful login
  • Failed login
  • Successful authentication
  • Failed authentication

Unchanged0

None

Changed0

None

Brand-New Fields 9

  • device.id
  • event.count
  • event.name
  • event.severity_label
  • neqter.log_type
  • network.vpn.gateway.name
  • network.vpn.ike.version
  • process.command_line
  • source.packets

Moved / Renamed 10

  • client.bytes → source.bytes
  • client.packets → source.packets
  • server.bytes → destination.bytes
  • server.packets → destination.packets
  • service.name → network.application
  • process.title → process.name
  • Juniper firewall value in observer.ip → host.ip
  • Direct source.address mapping → source.ip, then source.address is backfilled.
  • Direct destination.address mapping → destination.ip, then destination.address is backfilled.
  • syslog.severity.code → log.syslog.severity.code

Changed Values and Behavior 7

  • event.dataset now uses juniper.<dataset>.
  • event.outcome is normalized to success or failure.
  • event.duration changes from seconds to nanoseconds.
  • Ports, byte counts, packet counts, PIDs, and protocol numbers become integers.
  • network.transport now supports icmp, tcp, udp, gre, esp, and ah.
  • Concatenated Juniper messages are split into separate events.
  • Empty placeholder values such as N/A, UNKNOWN, and -1 are removed.

Linksys

11 entries

Dashboard Changes 2

New0

None

Unchanged1

  • All traffic

Changed1

  • High Risk Countries

Deleted0

None

Monitor Changes 2

New0

None

Unchanged0

None

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Brand-New Indexed Field 1

  • neqter.log_type

Moved 1

  • source.interface → observer.ingress.interface.name

Newly Populated Existing Fields 2

  • related.hosts
  • related.user

Changed Values and Behavior 3

  • event.dataset is lowercase.
  • message retains the raw log when no message is parsed.
  • observer.ip uses connection metadata.

OPNsense

94 entries

Dashboard Changes 1

New1

  • All activity

Unchanged0

None

Changed0

None

Deleted0

None

Monitor Changes 0

No monitors in either version.

Brand-New Populated Fields 85

  • @timestamp
  • client.address
  • client.geo.city_name
  • client.geo.country_name
  • client.geo.location
  • client.geo.region_name
  • client.ip
  • destination.address
  • destination.geo.city_name
  • destination.geo.country_name
  • destination.geo.location
  • destination.geo.region_name
  • destination.ip
  • destination.port
  • event.action
  • event.category
  • event.code
  • event.dataset
  • event.id
  • event.kind
  • event.original
  • event.outcome
  • event.provider
  • event.reason
  • event.sequence
  • event.severity
  • event.type
  • file.path
  • http.request.method
  • http.version
  • log.level
  • log.syslog.facility.code
  • log.syslog.facility.name
  • log.syslog.priority
  • log.syslog.severity.code
  • log.syslog.severity.name
  • log.syslog.structured_data
  • log.syslog.timestamp
  • log.syslog.version
  • message
  • neqter.label
  • neqter.log_type
  • neqter.type
  • network.bytes
  • network.direction
  • network.iana_number
  • network.packets
  • network.protocol
  • network.transport
  • network.type
  • network.vlan.name
  • network.vpn.type
  • observer.egress.interface.name
  • observer.hostname
  • observer.ingress.interface.name
  • observer.ip
  • observer.product
  • observer.vendor
  • process.command_line
  • process.name
  • process.pid
  • related.hosts
  • related.ip
  • related.user
  • rule.category
  • rule.id
  • rule.ruleset
  • rule.uuid
  • server.address
  • server.ip
  • source.address
  • source.domain
  • source.geo.city_name
  • source.geo.country_name
  • source.geo.location
  • source.geo.region_name
  • source.ip
  • source.mac
  • source.port
  • url.domain
  • url.original
  • url.path
  • url.port
  • url.scheme
  • user.name

New Fixed Values 5

  • neqter.type = opnsense
  • event.provider = opnsense
  • event.dataset = opnsense.<process/package>
  • observer.vendor = Deciso
  • observer.product = OPNsense

Populated but Not Indexed 3

  • process.thread.id
  • icmp_unreachport_destination.address
  • icmp_unreach_network.transport

Palo Alto

5 entries

Dashboard Changes 2

New1

  • All activity

Unchanged0

None

Changed0

None

Deleted1

  • Web traffic

Monitor Changes 0

No monitors in either version.

Brand-New Field 1

  • neqter.log_type

Moved 2

  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name

pfSense

59 entries

Dashboard Changes 7

New5

  • All activity
  • Threat activity
  • Threat and denied traffic
  • VPN activity
  • VPN failures

Unchanged1

  • High Risk Countries

Changed1

  • Web traffic → URL activity

Deleted0

None

Monitor Changes 2

New0

None

Unchanged0

None

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Moved 11

  • event.kind (process name) → process.name
  • log.syslog.procid → process.pid
  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • error.message → event.reason
  • event.outcome (raw action) → event.action
  • dhcp_client_mac → source.mac
  • dhcp_client_hostname → source.domain
  • DHCP client IP → source.ip
  • DHCP VLAN → network.vlan.name
  • OpenVPN client → user.name

Brand-New / Newly Populated 31

  • client.address
  • client.geo.city_name
  • client.geo.country_name
  • client.geo.location
  • client.geo.region_name
  • client.ip
  • event.category
  • event.code
  • event.provider
  • event.reason
  • event.severity
  • file.path
  • http.request.method
  • http.version
  • log.level
  • neqter.log_type
  • network.protocol
  • network.vpn.type
  • observer.product
  • observer.vendor
  • process.command_line
  • rule.category
  • rule.ruleset
  • related.user
  • server.address
  • server.ip
  • url.domain
  • url.original
  • url.path
  • url.port
  • url.scheme

Changed Values and Behavior 8

  • event.kind: process name → event or alert.
  • event.dataset: old Charon descriptions → pfsense.<process/package>.
  • event.outcome: pass / block / reject → success / failure.
  • event.action: now contains the raw pass, block, or reject action.
  • event.type: expanded to connection, protocol, info, and error.
  • network.type: 4 / 6 → ipv4 / ipv6.
  • network.bytes: no longer populated from filterlog packet length; still used for Charon.
  • Ports, sequence, priority, version, byte, and packet fields: string → integer.

PreVeil

3 entries

Dashboard Changes 1

New0

None

Unchanged0

None

Changed1

  • Activity → All activity

Deleted0

None

Monitor Changes 0

No monitors in either version.

Brand-New / Newly Indexed 2

Possible source typo: log.syslog.timestam may have been intended as log.syslog.timestamp.
  • neqter.log_type
  • log.syslog.timestam

SentinelOne

6 entries

Dashboard Changes 1

New0

None

Unchanged0

None

Changed1

  • Activity → All activity

Deleted0

None

Monitor Changes 0

No monitors in either version.

Brand-New / Newly Indexed 1

  • neqter.log_type

Changed Behavior 4

  • observer.ip — previously included deviceAddress; now only contains the syslog sender IP.
  • server.ip — now contains deviceAddress.
  • server.domain — now contains deviceHostName.
  • observer.name — no longer populated.

SonicWall

59 entries

Dashboard Changes 15

New13

  • Administrative account and user management changes
  • All activity
  • Authentication failures
  • Authentication successes
  • Blocked traffic
  • Firewall and security policy changes
  • Hardware/resource exhaustion/reboots
  • HA failover and cluster problems
  • Security service failures and expired protection
  • Threat detection and active attacks
  • VPN activity
  • VPN failures
  • VPN tunnel failures

Unchanged1

  • High Risk Country

Changed1

  • Web traffic → Web activity

Deleted0

None

Monitor Changes 11

New9

  • Successful authentications
  • Failed authentications
  • Firewall/security policy changes
  • Admin/user-management changes
  • VPN tunnel failure
  • HA/cluster problems
  • Hardware/resource/reboot events
  • Threat/attack events
  • Security-service failures

Unchanged0

None

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Moved 4

  • source.interface → observer.ingress.interface.name
  • destination.interface → observer.egress.interface.name
  • kv.rule: rule.id → rule.name
  • rule.id is now populated from sid, ruleid, ruleId, ruleID, or parsed from rule.name.

Brand-New / Newly Populated and Indexed 20

  • destination.packets
  • event.dataset
  • event.duration
  • event.outcome
  • event.provider
  • event.sequence
  • event.severity
  • neqter.log_type
  • network.application
  • network.name
  • network.vpn.name
  • observer.hostname
  • observer.product
  • observer.vendor
  • rule.name
  • rule.ruleset
  • source.packets
  • url.path
  • user.domain
  • user.email

Changed Values and Behavior 9

  • event.kind: SonicWall category description → event.
  • event.category: title-case values → lowercase normalized values.
  • event.type: descriptive values → start, end, or denied.
  • event.action: expanded and normalized mappings.
  • event.outcome: now success / failure.
  • event.duration: converted to nanoseconds.
  • rule.id: no longer populated directly from kv.rule.
  • url.original: rebuilt from url.domain and url.path.
  • Numeric byte, packet, port, sequence, severity, and ICMP values: string → integer.

Sophos UTM

83 entries

Dashboard Changes 10

New8

  • All activity
  • Authentication failures
  • Authentication successes
  • Critical events
  • Emergency events
  • Error events
  • High-risk country
  • Threat and denied traffic

Unchanged0

None

Changed1

  • Web traffic

Deleted1

  • Duplicate old Web traffic search

Monitor Changes 7

New7

  • Authentication failures
  • Authentication successes
  • Critical events
  • Emergency events
  • Error events
  • High-risk connection by country
  • High-risk connection by IP address

Unchanged0

None

Changed0

None

Moved 8

  • kv.action: event.outcome → event.action
  • kv.sys: event.category → event.dataset
  • kv.srcip: source.address → source.ip
  • kv.dstip: destination.address → destination.ip
  • syslog_host → observer.name
  • syslog_program → process.name
  • syslog_pid → process.pid
  • source.address and destination.address are still derived from the IP fields.

Brand-New / Newly Populated 50

  • destination.domain
  • dns.question.name
  • dns.question.type
  • dns.resolved_ip
  • dns.view
  • error.message
  • event.action
  • event.code
  • event.correlation_id
  • event.dataset
  • event.duration
  • event.id
  • event.kind
  • event.provider
  • event.reason
  • event.sequence
  • event.severity
  • event.type
  • http.request.method
  • http.request.referrer
  • http.response.bytes
  • http.response.status_code
  • log.level
  • neqter.log_type
  • network.application
  • network.bytes
  • network.iana_number
  • network.protocol
  • network.tcp.flags
  • network.transport
  • observer.egress.interface.name
  • observer.hostname
  • observer.ingress.interface.name
  • observer.name
  • observer.product
  • observer.vendor
  • process.command_line
  • process.name
  • process.pid
  • rule.category
  • rule.id
  • rule.name
  • rule.ruleset
  • source.domain
  • url.path
  • user.domain
  • user.email
  • user.group.name
  • user.id
  • user_agent.original

Changed Values and Behavior 8

  • event.outcome: raw Sophos action → success / failure.
  • event.action: now contains the raw action and is lowercased.
  • event.category: old sys value → normalized activity category.
  • event.dataset: sophos_utm.<process/dataset>.<category>.
  • event.kind: event, or alert for Snort.
  • network.transport: derived from network.iana_number.
  • user.name containing email: split into user.name, user.email, and user.domain.
  • Numeric duration, byte, port, severity, PID, and status values: string → integer.

Sophos XG/XGS

45 entries

Dashboard Changes 9

New6

  • All activity
  • High Risk Countries
  • Authentication failures
  • Authentication successes
  • Threat and denied traffic
  • VPN activity

Unchanged1

  • Sophos XG Authentication

Changed1

  • Web traffic → URL activity

Deleted1

  • Duplicate old Web traffic search

Monitor Changes 6

New4

  • High-risk connection by IP address
  • High-risk connection by label
  • Successful authentications
  • Failed authentications

Unchanged2

  • Failed authentication by IP address
  • Failed authentication by user

Changed0

None

Moved 4

  • event.action (log_subtype) → event.kind
  • event.risk_score → event.severity
  • network.transport (protocol) → network.protocol
  • network.transport now contains application technology.

Brand-New / Newly Populated and Indexed 17

  • event.id
  • event.reason
  • host.hostname
  • host.ip
  • network.application
  • network.type
  • observer.egress.interface.name
  • observer.egress.zone
  • observer.ingress.interface.name
  • observer.ingress.zone
  • rule.description
  • rule.id
  • rule.name
  • rule.ruleset
  • rule.uuid
  • tls.version
  • neqter.log_type

Changed Values and Behavior 8

  • event.action: log_subtype → con_event / connevent.
  • event.kind: now contains log_subtype.
  • event.severity: now contains app_risk / application_risk.
  • network.protocol: now contains protocol.
  • network.transport: protocol → app_technology / application_technology.
  • destination.bytes: recv_bytes → bytes_received.
  • source.bytes: sent_bytes → bytes_sent.
  • user.group.name: user_gp → user_group / usergroupname.

No Longer Populated 1

  • event.risk_score

Synology

12 entries

Dashboard Changes 7

New3

  • Authentication activity
  • Authentication failures
  • File deletes

Unchanged1

  • Failed Login

Changed2

  • All traffic → All activity
  • File traffic → File activity

Deleted1

  • System messages

Monitor Changes 5

New3

  • Authentication failures by source
  • File deletes by user
  • File-activity spike by user

Unchanged2

  • Failed login by IP address
  • Failed login by user

Changed0

None

TeraStation

7 entries

Dashboard Changes 3

New0

None

Unchanged0

None

Changed3

  • All traffic → All activity
  • File traffic → File activity
  • System messages

Deleted0

None

Monitor Changes 0

No monitors in either version.

Parser Changes 1

  • None

Moved Fields 1

  • None

Changed Values / Types 1

  • None

Brand-New / Newly Indexed 1

  • neqter.log_type

Ubiquiti UniFi

105 entries

Dashboard Changes 9

New1

  • Configuration changes

Unchanged3

  • Attempted Information Leak
  • High Risk Country
  • Miscellaneous Attack

Changed2

  • Admin activity → Admin accessed UniFi network
  • All activity → All traffic

Deleted3

  • Client activity
  • Rule triggers
  • Security detections

Monitor Changes 6

New2

  • Configuration changes
  • Admin accessed UniFi network

Unchanged2

  • High-risk connection by IP address
  • High-risk connection by country

Changed2

  • Attempted information leak — no-grouping value changed from “Do not group by a field” to blank, with the same behavior
  • Miscellaneous attack — no-grouping value changed from “Do not group by a field” to blank, with the same behavior

Brand-New / Newly Populated 59

  • client.bytes
  • client.ip
  • client.mac
  • destination.domain
  • destination.ip
  • destination.user.id
  • destination.user.name
  • event.code
  • event.module
  • event.name
  • event.provider
  • event.severity
  • host.hostname
  • log.syslog.severity.code
  • log.syslog.severity.name
  • log.syslog.timestamp
  • network.vlan.id
  • related.ip
  • server.bytes
  • server.domain
  • server.mac
  • source.domain
  • source.ip
  • source.user.id
  • source.user.name
  • ubiquiti.unifi.access_method
  • ubiquiti.unifi.category
  • ubiquiti.unifi.connected_to.device.ip
  • ubiquiti.unifi.connected_to.device.mac
  • ubiquiti.unifi.connected_to.device.model
  • ubiquiti.unifi.connected_to.device.name
  • ubiquiti.unifi.connected_to.device.port
  • ubiquiti.unifi.connected_to.device.version
  • ubiquiti.unifi.duration
  • ubiquiti.unifi.host
  • ubiquiti.unifi.last_connected_to.device.ip
  • ubiquiti.unifi.last_connected_to.device.mac
  • ubiquiti.unifi.last_connected_to.device.model
  • ubiquiti.unifi.last_connected_to.device.name
  • ubiquiti.unifi.last_connected_to.device.port
  • ubiquiti.unifi.last_connected_to.device.version
  • ubiquiti.unifi.last_connected_to.wifi.rssi
  • ubiquiti.unifi.link_speed
  • ubiquiti.unifi.network.subnet
  • ubiquiti.unifi.settings.change_count
  • ubiquiti.unifi.settings.changes
  • ubiquiti.unifi.settings.entry
  • ubiquiti.unifi.settings.section
  • ubiquiti.unifi.site
  • ubiquiti.unifi.sub_category
  • ubiquiti.unifi.usage.down
  • ubiquiti.unifi.usage.up
  • ubiquiti.unifi.wifi.airtime_utilization
  • ubiquiti.unifi.wifi.band
  • ubiquiti.unifi.wifi.channel
  • ubiquiti.unifi.wifi.channel_width
  • ubiquiti.unifi.wifi.interference
  • ubiquiti.unifi.wifi.name
  • ubiquiti.unifi.wifi.rssi

Moved 4

  • observer.ingress.interface.id → observer.ingress.interface.name
  • observer.hostname (BSSID) → observer.mac
  • host.mac / observer.mac (station MAC) → client.mac and source.mac
  • event.kind / event.category raw identifiers → event.code

Existing Fields with Changed Values / Behavior 25

  • event.action
  • event.category
  • event.dataset
  • event.id
  • event.kind
  • event.outcome
  • event.reason
  • event.type
  • host.mac
  • host.name
  • message
  • network.name
  • network.transport
  • observer.ingress.interface.name
  • observer.mac
  • observer.product
  • observer.vendor
  • observer.version
  • process.pid
  • related.hosts
  • server.ip
  • source.mac
  • source.port
  • destination.mac
  • destination.port

No Longer Populated 2

  • observer.ingress.interface.id
  • observer.hostname

vCenter

55 entries
vCenter did not exist in version 2.25.2. All listed fields are brand-new in Ashley 4.

Dashboard Changes 1

New1

  • All activity

Unchanged0

None

Changed0

None

Deleted0

None

Monitor Changes 0

No monitors in either version.

Unchanged / Moved / Removed 1

  • None

Brand-New Fields 52

  • @timestamp
  • event.action
  • event.category
  • event.code
  • event.correlation_id
  • event.created
  • event.dataset
  • event.id
  • event.kind
  • event.module
  • event.name
  • event.original
  • event.outcome
  • event.provider
  • event.reason
  • event.sequence
  • event.severity
  • event.severity_label
  • event.type
  • event.value.new
  • event.value.old
  • host.name
  • log.level
  • log.syslog.appname
  • log.syslog.facility.code
  • log.syslog.facility.name
  • log.syslog.procid
  • log.syslog.severity.code
  • log.syslog.severity.name
  • log.syslog.timestamp
  • message
  • neqter.label
  • neqter.type
  • observer.name
  • observer.product
  • observer.vendor
  • process.command_line
  • process.name
  • process.pid
  • process.thread.name
  • related.hosts
  • related.user
  • source.address
  • source.ip
  • source.geo.city_name
  • source.geo.country_name
  • source.geo.location
  • source.geo.region_name
  • user_agent.original
  • user.domain
  • user.email
  • user.name

Temporary and Not Indexed / Searchable 1

  • dumpster.vcenter.*

WatchGuard

67 entries

Dashboard Changes 11

New9

  • Firewall restart alert
  • Firewall session exhaustion alert
  • Potential attack traffic alert
  • Security protection coverage reduced alert
  • All activity
  • Authentication failures
  • Authentication successes
  • Denied traffic
  • VPN activity

Unchanged1

  • High Risk Country

Changed1

  • Web traffic → URL activity

Deleted0

None

Monitor Changes 10

New8

  • Failed authentication by source IP
  • Failed authentication by user
  • Firewall restart
  • Session exhaustion
  • Attack traffic
  • Reduced security coverage
  • Successful authentication by source IP
  • Successful authentication by user

Unchanged0

None

Changed2

  • High-risk connection by IP address — window 5 → 1 minute
  • High-risk connection by country — window 5 → 1 minute

Brand-New / Newly Populated 22

  • event.dataset
  • event.kind
  • event.provider
  • event.risk_score
  • event.sequence
  • http.request.referrer
  • network.application
  • network.direction
  • network.type
  • observer.egress.interface.name
  • observer.ingress.interface.name
  • observer.vendor
  • process.name
  • process.pid
  • related.hash
  • rule.description
  • tls.cipher
  • tls.version
  • tls.version_protocol
  • url.original
  • url.port
  • url.scheme

Moved 4

  • Plain kv.msg: event.type → event.reason
  • Secondary action values: event.action → rule.description
  • Combined interface data → network.name and network.transport
  • Filterlog interface → observer.ingress.interface.name or observer.egress.interface.name

Existing Fields with Changed Values / Behavior 20

  • client.address
  • destination.address
  • destination.bytes
  • destination.port
  • event.action
  • event.category
  • event.duration
  • event.outcome
  • event.reason
  • event.type
  • file.path
  • message
  • network.name
  • network.transport
  • rule.category
  • rule.name
  • source.address
  • source.bytes
  • source.port
  • user.email

Windows

112 entries

Dashboard Changes 82

New56

  • Account Lifecycle Activity
  • Authentication Activity
  • Domain Admins Group Changes
  • Failed Remote Logins
  • High Signal Security Events
  • NTLM Authentication Attempts
  • Privilege and Admin Activity
  • Privileged Activity
  • Privileged Group Membership Changes
  • Recently Enabled Devices
  • Recently Installed Software
  • Service Account Logins
  • Software Events
  • Special Privileges Assigned
  • Password Resets
  • Critical AD Security Events alert
  • Account Management Group Membership
  • Account Management User Accounts
  • Audit Policy Changes
  • Explicit Credential Use
  • Failed Interactive Logons
  • Firewall Operational Events
  • Firewall Policy and Configuration
  • Firewall Rule Changes
  • Logoffs
  • NTLM Authentication Failure
  • Operating System Activity
  • PowerShell Activity
  • Privileged Logon
  • Remote Desktop Login
  • Scheduled Task Activity
  • Scheduled Task Created
  • Security Log Cleared
  • Service Activity
  • Software Lifecycle
  • Successful Interactive Logons
  • User Account Changed
  • User Account Disabled
  • User Account Enabled
  • Windows Service Installed
  • Wireless Network Activity
  • Workstation Activity
  • File Auditing Policy Changes
  • File Auditing Policy Change Details
  • File Access and Activity
  • File Access Details
  • File Creation/Modification/Deletion
  • File Creation/Modification/Deletion Details
  • Mass File Deletion
  • Permission and Ownership Changes
  • Permission and Ownership Details
  • Permission Changes
  • Removable Media Activity
  • Removable Media Details
  • Share Access Events
  • Share Access Details

Unchanged0

None

Changed25

  • Administrator Logon alert
  • Domain Policy Change alert
  • Failed User Login alert
  • File Deletion alert
  • Login Failure by Administrator alert
  • Login Failure by IP alert
  • Login Failure by Workstation alert
  • Active Directory All Activity
  • Failed User Logins
  • Recently Created Users
  • Recently Deleted Users
  • Recently Disabled Users
  • Recently Locked Out Users
  • Successful User Logins
  • Event Logs All Activity
  • File Auditing Added or Modified Items
  • File Auditing All Activity
  • File Auditing Audit Failure
  • Admin Login Activity
  • Authentication Failed Logons
  • Authentication Successful Logons
  • User Account Created
  • User Account Deleted
  • File Deletion
  • Veeam All Activity

Deleted1

  • Duplicate Event Logs – Login Failure by IP search

Monitor Changes 8

New1

  • Critical AD Security Events

Unchanged7

  • Login failure by user
  • Login failure by IP
  • Login failure by workstation
  • Login failure by Administrator
  • Administrator login
  • Domain policy change
  • File deletion

Changed0

None

New in Ashley 4 — 7 Fields 7

  • winlog.event_data.ElevatedToken
  • winlog.event_data.ImpersonationLevel
  • winlog.event_data.RestrictedAdminMode
  • winlog.event_data.TargetLogonId
  • winlog.event_data.TargetUserSid
  • winlog.event_data.VirtualAccount
  • winlog.event_data.WorkstationName

New Uncommitted Fields — 8 Fields 8

  • winlog.event_data.AdditionalInfo2
  • winlog.event_data.AuthenticationPackageName
  • winlog.event_data.ExecutablePath
  • winlog.event_data.FileName
  • winlog.event_data.LinkName
  • winlog.event_data.SecurityPackageName
  • winlog.event_data.TargetProcessName
  • winlog.event_data.Url

Uncommitted Changed Behavior 1

  • event.reason — now populated from the first message / event.original line when missing.

Changed Values 4

  • ElevatedToken: %%1842 / %%1843 → Elevated Token: Yes / Elevated Token: No.
  • VirtualAccount: %%1842 / %%1843 → Yes / No.
  • RestrictedAdminMode: %%1842 / %%1843 → Yes / No.
  • ImpersonationLevel: numeric tokens → named impersonation levels.

No Longer Populated 1

  • observer.ip

No Longer Indexed / Searchable 1

  • agent.id

Document updated July 24, 2026.

Return to Change Log