<html lang="en">
<body>

<p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 11</b><br>
		Change list:
		<ul>
			<li>Normalizer structure was optimized. Extra normalizers that was used for Name field mapping (209005, 318102, 318103, 318120, 318127, 402148, 409112, 409113, 409118, 409121, 409123, 520001, 520002, 520004, 520005, 520011, 520020, 613004, 613005, 613006, 613008, 613011, 613016, 613017, 613018, 613019, 613021, 613022, 613023, 613024, 613025, 613026, 613027, 613028, 613029, 613030, 613031, 613032, 613033, 613034, 613035, 613036, 613037, 613038, 613039, 613040, 613041, 613042, 713191, 746006, 746008, 746009, 747011, 774001), have been combined into one extra normalizer "Name field mapping".</li>
			<li>Normalizer structure was optimized. Extra normalizers "338304" and "338305" have been combined into one extra normalizer "338304 338305". First regular expression was updated.</li>
			<li>Extra normalizer order was optimized.</li>
			<li>Extra normalizer "ASA|FTD|FWSM|NGIPS" was changed. Event conditon was updated.</li>
			<li>Event enrichment with constant was removed from the KUMA fields Message, DeviceCustomString1, DeviceCustomString1Label.</li>
			<li>Extra normalizer "113011", "113014", "113003", "113039", "109103", "109104", "113042  was updated. Capture group "suser" was renamed to "user". Event field user was mapped from the KUMA field SourceUserName to DestinationUserName.</li>
			<li>Extra normalizer "302027" was edited. Event field "Duration" was mapped from the KUMA field DeviceCustomString2 to the DeviceCustomString3. </li>
			<li>Extra normalizer "303002" was updated. Capture group "suser" was renamed to "user". Event field user was mapped from the KUMA field SourceUserName to DestinationUserName. Capture group "cs1" was renamed to "action". Event field "action" was mapped from the KUMA field DeviceCustomString1 to DeviceAction.</li>
			<li>Extra normalizer "746005" was updated. Capture group "cs1" was renamed to "action". Event field "action" was mapped from the KUMA field DeviceCustomString1 to DeviceAction.</li>
			<li>Extra normalizer "210022" was updated. Event enrichment with constant to the KUMA field DeviceCustomNumber2Label was removed.</li>
			<li>Extra normalizer "313009" was updated. Event enrichment with constant to the KUMA field DeviceCustomNumber3Label was removed.</li>
			<li>Extra normalizer "716059" was updated. Event enrichment with constant to the KUMA field FlexNumber1Label was removed.</li>
			<li>Extra normalizer "734001" was updated. Event enrichment with constant to the KUMA field DeviceCustomString1Label was removed. Event enrichment with constant to the KUMA field DeviceCustomString2Label was removed.</li>
			<li>Extra normalizer "709008" was changed. Mapping of event field "Command" was changed from the KUMA field "DeviceCustomString2" to the "DeviceCustomString4".</li>
			<li>Extra normalizers "sec_login", "for IOSXE", "for CRYPTO", "OSPF", "10ACL", "10STP", "10SSHS", "10CFGMAN", "LINEPROTO", "LINK", "SYS", "DHCP_SNOOPING", "SEC", "PARSER", "SPAN", "MONITOR", "AAAA", "C4K_REDUNDANCY", "PORT_SECURITY" were updated. Additional regular expression was added. Capture group "all_message" was mapped to the KUMA field DeviceCustomString6.</li>
			<li>Extra normalizers "PARSER", "SPAN", "MONITOR", "AAAA", "C4K_REDUNDANCY", "PORT_SECURITY", "DOT1X" were updated. Event enrichement with constant "IOS" was added to the KUMA field DeviceProduct.</li>
			<li>Extra normalizer "for CRYPTO" was changed. Capture group "cs1" was renamed to "SPI". Event field "SPI" was mapped from the KUMA field DeviceCustomString1 to the FlexString1.</li>
			<li>Extra normalizer "613013" was changed. Event field "cs1" was mapped from the KUMA field DeviceCustomString1 to the DeviceCustomIPv6Address1. Event field "cs2" was mapped from the KUMA field DeviceCustomString2 to the DeviceCustomIPv6Address2. Event field "cs3" was mapped from the KUMA field DeviceCustomString3 to the DeviceCustomIPv6Address3. Event field "cs4" was mapped from the KUMA field DeviceCustomString4 to the DeviceCustomIPv6Address4.</li>
			<li>Extra normalizer "409107" was changed. Event enrichment with constant was added to the KUMA field Message.</li>
			<li>Extra normalizer "409120" was changed. Additional regular expression was added. Event field cs1 was mapped to the KUMA field DeviceCustomString1.</li>
			<li>Normalizer structure was optimized. Extra normalizers "302013" and "302015" have been combined into one extra  normalizer "302013 302015".</li>
			<li>Extra normalizer "302013 302015" was changed. Additional condition was added to the extra normalizer condition. Regular expression was updated. Event field "inbound_or_outbound" was mapped to the KUMA field DeviceDirection. Event conversion with replace function was added to the event field "inbound_or_outbound". Event enrichment was added to the KUMA field FlexString1, FlexString2, FlexString1Label, FlexStrign2Label.</li>
			<li>Extra normalizer "302013" was removed.</li>
			<li>Extra normalizer "305012" was changed. Regular expression was updated.</li>
			<li>Extra normalizer "302020" was updated. Event field "inbound_or_outbound" was mapped to the KUMA field DeviceDirection. Event conversion with replace function was added to the event field "inbound_or_outbound".</li>
			<li>Labels of the DeviceCustom* fields were updated.</li>
		</ul>
  </p>

<p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 10</b><br>
		Change list:
		<ul>
			<li>New extra normalizers were added "Other security events", "Other products".</li>
			<li>Extra normalizer "Product Separation" was changed. New regular expression was added. Mapping of the capture group "not_parsed" was added to the KUMA field DeviceCustomString6.</li>
		</ul>
  </p>

<p>
 <b>[OOTB] Cisco ASA and IOS syslog. Version 9</b><br>
	Change list:
		<ul>
		<li>Short version of changelog: support of new Cisco products was added, support of new event types was added, parsing and mapping of already supported event types was improved.</li>
		<li>Added support of Cisco PIX events.</li>
		<li>Added support of Cisco ACE events.</li>
		<li>New extra normalizers were added: 106002, 106007, 106014, 106024, 106101, 108004, 108005, 108006, 109001, 109002, 109003, 109005, 109006, 109007, 109008, 109010, 109011, 109012, 109013, 109014, 109016, 109017, 109018, 109025, 109026, 109027, 109031, 109033, 110003, 111001, 111002, 111003, 111004, 111005, 111006, 111007, 113005, 113006, 113007, 113010, 113013, 113017, 113018, 199011, 251006, 251007, 251008, 251009, 302022, 302023, 304003, 304004, 304005, 304006, 305013, 335004, 335005, 335006, 335007, 338001, 338002, 338003, 338004, 338005, 338006, 338007, 338008, 338101, 338102, 338103, 338104, 338201, 338202, 338203, 338204, 338301, 338302, 338304, 338305, 338306, 338307, 338308, 338309, 338310, 339001, 339002, 339003, 339004, 339005, 339006, 339007, 339008, 339010, 339011, 339012, 339013, 339014, 402114, 402115, 402116, 402117, 402119, 403108, 403110, 410002, 411001, 411002, 411003, 411004, 411005, 412001, 412002, 413001, 413002, 413003, 441001, 441002, 442004, 442005, 502101, 502102, 502111, 502112, 507003, 602303, 602304, 603102, 603103, 603104, 606004, 727016.</li>
		<li>Parsing of account name was improved: enrichment in the extranormalizer "Product Separation" now takes into account that event can contain user name part and NT domain part separated by "@" or "\", as well as does not contain domain part at all. Depends of type of event received it maps it parts to SourceNTDomain, SourceUserName, DestinationNTDomain and DestinationUserName KUMA fields.</li>
		<li>Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106001 was changed. Capture group "action" was added which and mapped to "DeviceAction" KUMA field. Capture group "tcp_flags" was added and mapped to "DeviceCustomString2" KUMA field. Capture group "dstzone" was renamed to "inb_interace", and its mapping was changed from "DestinationDnsDomain" to "DeviceInboundinterface". Other capture groups were renamed without field mapping changes: "proto" > "protocol", "srcip" > "src_ip_address", "hostname" > "src_hostname", "srcport" > "src_port", "dstip" > "dst_ip_address", "dsthostname" > "dst_hostname", "dstport" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106006 was changed. Capture group "action" was added and mapped to "DeviceAction" KUMA field. Capture group "dstzone" was renamed to "inb_interace" and mapped from the "DestinationDnsDomain" to the "DeviceInboundinterface" KUMA field. Other capture groups were renamed without field mapping changes: "proto" > "protocol", "srcip" > "src_ip_address", "hostname" > "src_hostname", "srcport" > "src_port", "dstip" > "dst_ip_address", "dsthostname" > "dst_hostname", "dstport" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106015 was changed. Capture group "action" was added and mapped to "DeviceAction" KUMA field. Capture group "cs3" renamed to "tcp_flags", and its mapping was changed from "DeviceCustomString1" to "DeviceCustomString2" KUMA field. Other capture groups were renamed without field mapping changes: "proto" > "protocol", "src" > "src_ip_address", "shost" > "src_hostname", "sport" > "src_port", "dst" > "dst_ip_address", "dhost" > "dst_hostname", "dport" > "dst_port", "deviceInboundinterface" > "inb_interface". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106016 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to "DestinationHostName" KUMA field. Capture group "dstzone" was renamed to "inb_interace", and its mapping was changed from "DestinationDnsDomain" to "DeviceInboundinterface". Capture group "outInter" was renamed to "inb_interace", and its mapping was changed from "DeviceOutboundinterface" to "DeviceInboundinterface". Other capture groups were renamed without field mapping changes: "proto" > "protocol", "srcip" > "src_ip_address", "hostname" > "src_hostname", "srcport" > "src_port", "dstip" > "dst_ip_address", "dsthostname" > "dst_hostname", "dstport" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106017 was changed. Capture group "src_hostname" was added and mapped to "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Several captuare groups were renamed: "srcip" > "src_ip_address", "dstip" > "dst_ip_address". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106021 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "dstzone" was renamed to "inb_interace", and its mapping was changed from "DestinationDnsDomain" to "DeviceInboundinterface". Other capture groups were renamed without field mapping changes: "proto" > "protocol", "srcip" > "src_ip_address", "dstip" > "dst_ip_address". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106023 was changed. Capture group "type" was renamed to "icmp_type" and mapped to the "FlexNumber1" KUMA field. Capture group "type" was renamed to "icmp_type" and mapped to the "FlexNumber2" KUMA field. Capture group "aclName" was renamed to "access_group_name", and its mapping was changed from "DeviceCustomString1" to the "DeviceCustomString2" KUMA field. Other capture groups were renamed without field mapping changes: "proto" > "protocol", "srcInt" > "out_interface", "dstint" > "inb_interface", "srcIp" > "src_real_ip_address", "hostname" > "src_hostname", "sPort" > "src_port", "dstIp" > "dst_real_ip_address", "dsthostname" > "dst_hostname", "dPort" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106100 was changed. Capture group "action" was added and mapped to "DeviceAction" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "interval" was added and mapped to the "DeviceCustomString3" KUMA field. Capture group "sg_info" was added and mapped to the "DeviceCustomString2" KUMA field. Capture group "srczone" was renamed to "out_interace", and its mapping was changed from the "SourceDnsDomain" to "DeviceOutboundinterface". Capture group "dstzone" was renamed to "inb_interace", and its mapping was changed from the "DestinationDnsDomain" to the "DeviceInboundinterface". Capture group "hit_num" was renamed to "hit_cnt_number" and mapping was changed from the "DeviceCustomString5" to the "DeviceCustomNumber1". Other capture groups were renamed without field mapping changes: "proto" > "protocol", "list" > "acl_name", "srcip" > "src_ip_address", "srcport" > "src_port", "dstip" > "dst_ip_address", "dstport" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 106103 was changed. The second capture group "shost" was renamed to "sport", and its mapping was changed from "SourseHostName" to "SourcePort". Capture group "src_hostname" was added and mapped to "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to "DestinationHostName" KUMA field. Capture group "interval" was added and mapped to the "DeviceCustomString3" KUMA field. Capture group "suser" was renamed to "username", and its mapping was changed from the "SourceUserName" to the "DestinationUserName". Capture group "deviceInboundinterface" was renamed to "out_interace", and its mapping was changed from "DeviceInboundinterface" to "DeviceOutboundinterface". Capture group "deviceOutboundinterface" was renamed to "inb_interface", and its mapping was changed from "DeviceOutboundinterface" to "DeviceInboundinterface". Capture group "ExtraHitCnt" was renamed to "hit_cnt_number", and its mapping was changed from "DeviceCustomString4" to "DeviceCustomNumber1". Other capture groups were renamed without field mapping changes: "ExtraAclName" > "acl_name", "act" > "action", "proto" > "protocol", "dhost" > "dst_hostname", "dpt" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 110002 was changed. Capture group "name" was added and mapped to "Name" KUMA field. Capture group "result" was added and mapped to "EventOutcome" KUMA field. Capture group "action" was added and mapped to "DeviceAction" KUMA field. Capture group "src_hostname" was added and mapped to "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to "DestinationHostName" KUMA field. Capture group "c6a1" was renamed to "src_ip_address", and its mapping was changed from "DeviceCustomIPv6Address1" to "SourceAddress". Capture group "c6a2" was renamed to "dst_ip_address", and its mapping was changed from "DeviceCustomIPv6Address2" to "DestinationAddress". Other capture groups were renamed without field mapping changes: "proto" > "protocol", "deviceOutboundinterface" > "out_interface", "spt" > "src_port", "dpt" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 111008 was changed. Capture group "action" was added and mapped to "DeviceAction" KUMA field. Capture group "suser" was renamed to "username", and its mapping was changed from "SourceUserName" to "DestinationUsername". Capture group "command" was renamed "entered_command". Added enrichment of "Name" and "Message" fields containing Explanation of the event and "DeviceCustomString1" with Recommended actions.</li>
		<li>Extra normalizer 111009 was changed. Capture group "action" was added and mapped to "DeviceAction" KUMA field. Capture group "suser" was renamed to "username", and its mapping was changed from the "SourceUserName" to the "DestinationUsername". Several groups were renamed. Capture group "userName" > "username", "msg" > "entered_command". Added enrichment of "Name" and "Message" fields containing Explanation of the event and "DeviceCustomString1" with Recommended actions.</li>
		<li>Extra normalizer 111010 was changed. Capture group "action" was added and mapped to "DeviceAction" KUMA field. Capture group "dst_hostname" was added and mapped to "DestinationHostName" KUMA field. Capture group "src" was renamed to "dst_ip_address", and its mapping was changed from "SourceAddress" to the "DestinationAddress". Capture group "suser" was renamed to "username", and its mapping was changed from the "SourseUserName" to the "DestinationUserName". Other capture groups were renamed without field mapping changes: "cs1" > "application_name", "cs2" > "entered_command", "spt" > "src_port", "dpt" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 113004 was changed. Capture group "result" was added and mapped to the "EventOutcome" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "cs1" was renamed to "aaa_type", and its mapping was changed from "DeviceCustomString1" to "DeviceCustomString2". Capture group "src" was renamed to "dst_ip_address", and its mapping was changed from "SourceAddress" to "DestinationAddress". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 113008 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "suser" was renamed to the "username", and its mapping was changed from the "SourceUserName" to the "DestinationUserName". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 113009 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "cs1" was renamed to the "group_policy_name", and its mapping was changed from the "DeviceCustomString1" to the "DeviceCustomString2". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 113012 was changed. Capture group "result" was added and mapped to the "EventOutcome" KUMA field. Capture group "suser" was renamed to the "username", and its mapping was changed from the "SourceUserName" to the "DestinationUserName". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 113019 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "result" was added and mapped to the "EventOutcome" KUMA field. Capture group "spriv" was renamed to the "group_name", and its mapping was changed from the "SourceUserPrivileges" to the "DestinationUserPrivileges". Capture group "suser" was renamed to the "username", and its mapping was changed from the "SourceUserName" to the "DestinationUserName". Capture group "cs1" was renamed to the "session_type", and its mapping was changed from the "DeviceCustomString1" to the "DeviceCustomString2". Capture group "cs2" was renamed to the "duration", and its mapping was changed from the "DeviceCustomString2" to the "DeviceCustomString3". Capture group "cn1" was renamed to the "bytes_snt", and its mapping was changed from the "DeviceCustomNmber1" to the "BytesOut". Capture group "cn2" was renamed to the "bytes_rcv", and its mapping was changed from the "DeviceCustomNumber2" to the "BytesIn". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302010 was changed. Capture group "name" was added and mapped to the KUMA field "Name". Capture group "cn1" was renamed to the "connections_in_use" and mapped from the "DeviceCustomString1" to the "DeviceCustomNumber1" KUMA field. Capture group "cn2" was renamed to the "connections_most_used" and mapped from the "DeviceCustomString2" to the "DeviceCustomNumber2" KUMA field. Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302013 was changed. Capture group "deviceInboundInterface" was renamed to the "out_interface" and mapped from the "DeviceInboundinterface" to the "DeviceOutboundinterface" KUMA field. Capture group "deviceOutboundInterface" was renamed to the "inb_interface" and mapped from the "DeviceOutboundinterface" to the "DeviceInboundinterface". Other capture groups were renamed without field mapping changes: "proto" > "protocol", "src" > "src_real_ip_address", "shost" > "src_hostname", "sourceTranslatedAddress" > "src_mapped_ip_address", "sourceTranslatedPort" > "src_mapped_port", "dst" > "dst_real_ip_address", "dhost" > "dst_hostname", "destinationTranslatedAddress" > "dst_mapped_ip_address", "destinationTranslatedPort" > "dst_mapped_port", "ExtraExternalUser" > "username". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302014 was changed: The second capture group "suser" was renamed to the "inb_interface", and mapped to the "DeviceInboundinterface". The second capture group "dstip" was renamed to the "dst_real_port", and mapped to the "DestinationPort". Capture group "username" was added and mapped to the "DestinationUserName" KUMA field. Capture group "seq_num" was renamed to the "connection_id", and its mapping was changed from the "DeviceCustomString2" to the "ExternalId". Capture group "sourceTranslatedAddress" was renamed to the "src_real_ip_address", and its mapping was changed from the "SourceTranslatedAddress" to the "SourcePort". Capture group "sourceTranslatedPort" was renamed to the "src_real_port", and its mapping was changed from the "SourceTranslatedPort" to the "SourcePort". Other capture groups were renamed without field mapping changes: "dstInt" > "out_interface", "dstIp" > "dst_real_ip_address". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302015 was changed. Capture group "ExtraExternalUser" was renamed to the "username" and mapped from the "DeviceCustomString5" to the "DestinationUserName". Other capture groups were renamed without field mapping changes: "proto" > "protocol", "deviceInboundinterface" > "out_interface", "src" > "src_real_ip_address", "shost" > "src_hostname", "sourceTranslatedAddress" > "src_mapped_ip_address", "sourceTranslatedPort" > "src_mapped_port", "deviceOutboundinterface" > "inb_interface", "dst" > "dst_real_ip_address", "dhost" > "dst_hostname", "destinationTranslatedAddress" > "dst_mapped_ip_address", "destinationTranslatedPort" > "dst_mapped_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302016 was changed. Capture group "duration" was added and mapped to the "DeviceCustomString2" KUMA field. Capture groups were renamed: "deviceOutboundinterface" > "out_interface", "deviceInboundinterface" > "inb_interface", "src" > "src_real_ip_address", "shost" > "src_hostname", "sport" > "src_real_port", "dst" > "dst_real_ip_address", "dhost" > "dst_hostname", "dport" > "dst_real_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302020 was changed. Capture group "duration" was added and mapped to the "DeviceCustomString2" KUMA field. Capture group "ExtraExternalUser" was renamed to the "username" and mapped from the "DeviceCustomString5" to the "DestinationUserName". Other capture groups were renamed without field mapping changes: "dst" > "src_real_ip_address", "dpt" > "src_real_ip_address", "sourceTranslatedAddress" > "dst_mapped_ip_address", "sourceTranslatedPort" > "dst_mapped_port", "src" > "dst_real_ip_address", "shost" > "dst_hostnames". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302021 was changed. Capture group "ExtraExternalUser" was renamed to the "username" and mapped from the "Extra.externalUser" to the "DestinationUserName". Other capture groups were renamed without field mapping changes: "src" > "src_real_ip_address", "shost" > "src_hostname", "sport" > "src_real_port", "destinationTranslatedAddress" > "dst_mapped_ip_address", "destinationTranslatedPort" > "dst_mapped_port", "dst" > "dst_real_ip_address", "dport" > "dst_real_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302024 was changed. Capture group "protocol" was added and mapped to the "TransportProtocol" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "cs1" was renamed to the "role" and mapped from the "DeviceCustomString1" to the "DeviceCustomString2". Other capture groups were renamed without field mapping changes: "deviceOutboundinterface" > "out_interface", "deviceInboundinterface" > "inb_interface", "src" > "src_real_ip_address", "spt" > "src_real_port", "sourceTranslatedAddress" > "src_mapped_ip_address", "sourceTranslatedPort" > "osrc_mapped_port", "dst" > "dst_real_ip_address", "dpt" > "dst_real_port", "destinationTranslatedAddress" > "dst_mapped_ip_address", "destintaionTranslatedPort" > "dst_mapped_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302025 was changed. Capture group "protocol" was added and mapped to the "TransportProtocol" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "role" was added and mapped to the "DeviceCustomString2" KUMA field. Capture group "cn1" was renamed to the "forwarded_bytes" and mapped from the "DeviceCustomNumber1" to the "BytesOut". Other capture groups were renamed without field mapping changes: "deviceOutboundinterface" > "out_interface", "deviceInboundinterface" > "inb_interface", "src" > "src_real_ip_address", "spt" > "src_real_port", "dst" > "dst_real_ip_address", "dpt" > "dst_real_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302026 was changed. Capture group "protocol" was added and mapped to the "TransportProtocol" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "cs1" was renamed to the "role", and its mapping was changed from the "DeviceCustomString1" to the "DeviceCustomString2". Other capture groups were renamed without field mapping changes: "deviceOutboundinterface" > "out_interface", "deviceInboundinterface" > "inb_interface", "src" > "src_real_ip_address", "spt" > "src_real_port", "sourceTranslatedAddress" > "src_mapped_ip_address", "sourceTranslatedPort" > "src_mapped_port", "dst" > "dst_real_ip_address", "dpt" > "dst_real_port", "destinationTranslatedAddess" > "dst_mapped_ip_address", "destinationTranslatedPort" > "dst_mapped_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 302027 was changed. Capture group "protocol" was added and mapped to the "TransportProtocol" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "role" was added and mapped to the "DeviceCustomString2" KUMA field. Capture group "cn1" was renamed to the "forwarded_bytes", and its mapping was changed from the "DeviceCustomNumber1" to the "BytesOut". Other capture groups were renamed without field mapping changes: "deviceOutboundinterface" > "out_interface", "deviceInbboundinterface" > "inb_interface", "src" > "src_real_ip_address", "spt" > "src_real_port", "dst" > "dst_real_ip_address", "dpt" > "dst_real_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 304001 was changed. Capture group "dst_ip_address" was added and mapped to the "DestinationAddress" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture groups were renamed: "srcIp" > "src_ip_address", "hostname" > "src_hostname". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 305006 was changed: Added parsing of events with different protocols inside (UDP, TCP, ICMP, Protocol 50). Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "code" was renamed to the "icmp_code", and its mapping was changed from the "Code" to the "FlexNumber2". Other capture groups were renamed without field mapping changes: "outcome" > "result", "transportProtocol" > "protocol", "outInter" > "out_interface", "inInter" > "inb_interface", "srcIp" > "src_ip_address", "dstIp" > "dst_ip_address", "type" > "icmp_type". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 305010 was changed. Capture group "cs5" is deleted. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "devoceOutboundinterface" was renamed to the "inb_interface", and its mapping was changed from the "DeviceOutboundinterface" to the "DeviceInboundinterface". Other capture groups were renamed without field mapping changes: "destinationTranslatedAddress" > "dst_mapped_ip_address", "src" > "src_ip_address", "cs6" > "duration". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 305011 was changed: Added parsing of events with "static translation". Capture group "dstIp" was renamed to the "dst_mapped_ip_address" and mapped from the "DeviceAddress" to the "DestinationTranslatedAddress". Capture group "dPort" was renamed to the "dst_mapped_port" and mapped from the "DestinationPort" to the "DestinationTranslatedPort". Other capture groups were renamed without field mapping changes: "srcInt" > "inb_interface", "dstInt" > "out_interface", "srcIp" > "src_ip_address", "hostname" > "src_hostname", "dsthostname" > "dst_hostname", "sPort" > "src_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 305012 was changed: Added parsing of events with "static translation". Capture group "dstIp" was renamed to the "dst_mapped_ip_address" and mapped from the "DestinationAddress" to the "DestinationTranslatedAddress". Capture group "dPort" was renamed to the "dst_mapped_port" and mapped from the "DestinationPort" to the "DestinationTranslatedPort". Capture group "time" was renamed to the "duration" and mapped from the "DeviceCustomString1" to the "DeviceCustomString2". Other capture groups were renamed without field mapping changes: "srcInt" > "inb_interface", "dstInt" > "out_interface", "srcIp" > "src_ip_address", "hostname" > "src_hostname", "dsthostname" > "dst_hostname", "sPort" > "src_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 313001 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "protocol" was added and mapped to the "TransportProtocol" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "cn1" was renamed to the "icmp_type" and mapped from the "DeviceCustomNumber1" to the "FlexNumber1". Capture group "cn2" was renamed to the "icmp_code" and mapped from the "DeviceCustomNumber2" to the "FlexNumber2". Other capture groups were renamed without field mapping changes: "src" > "src_ip_address", "deviceOutboundinterface" > "out_interface". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 313004 was changed: Added parsing of events with "shared interface". Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "protocol" was added and mapped to the "TransportProtocol" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "reason" was added and mapped to the "Reason" KUMA field. Several capture groups were renamed: "src" > "src_ip_address", "int" > "out_interface". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 313005 was changed: Added parsing of events with "shared interface". Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Capture group "reason" was added and mapped to the "Reason" KUMA field. Capture group "deviceInbouinterface" was renamed to the "out_interface" and mapped from the "DeviceInboundinterface" to the "DeviceOutboundinterface". Capture group "deviceOutboundinterface" was renamed to the "inb_interface" and mapped from the "DeviceOutboundinterface" to the "DeviceInboundinterface". Other capture groups were renamed without field mapping changes: "cn1" > "icmp_type", "cn2" > "icmp_code", "msg" > "embedded_framge_info_icmp_msg_info". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 338303 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "result" was added and mapped to the "EventOutcome" KUMA field. Several capture groups were renamed: "src" > "dst_ip_address", "sourceDnsDomain" > "domain_name". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 410001 was changed: Improved interface name parsing. Capture group "protocol2" was added and mapped to the "ApplicationProtocol" KUMA field. Capture group "packet_length" was added and mapped to the "DeviceCustomNumber1" KUMA field. Capture group "packet_limit" was added and mapped to the "DeviceCustomNumber2" KUMA field. Several capture groups were renamed: "deviceAction" > "action", "proto" > "protocol", "srcInt" > "src_interface", "dstInt" > "dst_interface", "srcIp" > "src_ip_address", "dstIp" > "dst_ip_address", "sPort" > "src_port", "dPort" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 419002 was changed. Capture group "src_ip_address" was added and mapped to the "SourceAddress" KUMA field. Capture group "dst_ip_address" was added and mapped to the "DestinationAddress" KUMA field. The second capture group "shost" was renamed to the "src_port" and mapped from the "SourceHost" KUMA field to the "SourcePort". Several capture groups were renamed: "proto" > "protocol", "shost" > "src_hostname", "dhost" > "dst_hostname". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 502103 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "cn1" was renamed to the "old_privilege_level" and mapped from the "DeviceCustomNumber1" KUMA field to the "DeviceCustomString2". Capture group "cn2" was renamed to the "new_privilege_level" and mapped from the "DeviceCustomNumber2" KUMA field to the "DestinationUserPrivileges". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 605005 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "deviceOutboundinterface" was renamed to the "inb_interface" and mapped from the "DeviceOutboundinterface" to the "DeviceInboundinterface". Capture group "app" was renamed to the "dst_service_name" and mapped from the "ApplicationProtocol" to the "DestinationServiceName". Capture group "suser" was renamed to the "username" and mapped from the "SourceUserName" to the "DestinationUserName". Other capture groups were renamed without field mapping changes: "src" > "src_ip_address", "spt" > "src_port", "dst" > "dst_ip_address", "dpt" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 609001 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Several capture groups were renamed: "srcInt" > "zone_name", "srcIp" > "src_ip_address", "hostname" > "src_hostname". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 609002 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Several capture groups were renamed: "srcInt" > "zone_name", "srcIp" > "src_ip_address", "hostname" > "src_hostname". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 611101 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "result" was added and mapped to the "EventOutcome" KUMA field. Capture group "src" was renamed to the "src_address". Capture group "suser" was renamed to the "username" and mapped from the "SourceUserName" KUMA field to the "DestinationUserName". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 611103 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "result" was added and mapped to the "EventOutcome" KUMA field. Capture group "src" was renamed to the "src_address". Capture group "suser" was renamed to the "username" and mapped from the "SourceUserName" KUMA field to the "DestinationUserName". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 710003 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Several capture groups were renamed: "proto" > "protocol", "src" > "src_ip_address", "spt" > "src_port", "dst" > "dst_ip_address", "dpt" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 710005 was changed. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "src_hostname" was added and mapped to the "SourceHostName" KUMA field. Capture group "dst_hostname" was added and mapped to the "DestinationHostName" KUMA field. Several capture groups were renamed: "proto" > "protocol", "src" > "src_ip_address", "spt" > "src_port", "dst" > "dst_ip_address", "dpt" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 725001 was changed: Added "sport" mapping to the "SourcePort" KUMA field.</li>
		<li>Extra normalizer 725002 was changed: Added "sport" mapping to the "SourcePort" KUMA field.</li>
		<li>Extra normalizer 725007 was changed. Capture group "name" was added and mapped to the "Name" KUMA field. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Several capture groups were renamed: "src" > "src_ip_address", "spt" > "src_port", "dst" > "dst_ip_address", "dpt" > "dst_port". Event enrichments with explanation of event and recommended actions were added to the field "Message" and "DeviceCustomString1".</li>
		<li>Extra normalizer 725016 was changed: Added Capture group "sport" mapping to the "SourcePort" KUMA field.</li>
		<li>Extra normalizer 746019 was changed: Added Capture group "sourceTranslatedAddress" mapping to the "SourceTanslatedAddress" KUMA field.</li>
		<li>Extra normalizer 769002 was changed. Capture group "url" was added and mapped to the "RequestUrl" KUMA field. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "cs1" was renamed to the "old_file_name" and mapped from the "DeviceCustomString1" to the "DestinationUserName". Capture group "file" was renamed to the "new_file_name" and mapped from the "DeviceCustomString1" to the "DestinationUserName".</li>
		<li>Extra normalizer 769003 was changed. Capture group "url" was added and mapped to the "RequestUrl" KUMA field. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "cs1" was renamed to the "old_file_name" and mapped from the "DeviceCustomString1" to the "DestinationUserName" KUMA field. Capture group "file" was renamed to the "new_file_name" and mapped from the "DeviceCustomString1" to the "DestinationUserName" KUMA field.</li>
		<li>Extra normalizer SSH2_SESSION was changed. Capture group "protocol" was added and mapped to the "ApplicationProtocol" KUMA field. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "cs1" was renamed to the "crypto_cipher" and mapped from the "DeviceCustomString1" to the "DeviceCustomString2". Capture group "cs2" was renamed to the "hmac" and mapped from the "DeviceCustomString2" to the "DeviceCustomString3" KUMA field. Capture group "tty" mapping was changeg from the "DeviceCustomString3" to the "DeviceCustomNumber1" KUMA field. Capture group "src1" was renamed to the "src_ip_address".</li>
		<li>Extra normalizer SSH2_USERAUTH was changed. Capture group "protocol" was added and mapped to the "ApplicationProtocol" KUMA field. Capture group "action" was added and mapped to the "DeviceAction" KUMA field. Capture group "cs1" was renamed to the "crypto_cipher" and mapped from the "DeviceCustomString1" to the "DeviceCustomString2" KUMA field. Capture group "cs2" was renamed to the "hmac" and mapped from the "DeviceCustomString2" to the "DeviceCustomString3" KUMA field. Capture group "cn1" was renamed to the "tty" and mapped from the "DeviceCustomString3" to the "DeviceCustomNumber1" KUMA field. Capture group "suser" was renamed to the "username" and mapped from the "SourceUserName" to the "DestinationUserName" KUMA field. Capture group "outcome" was renamed to the "status".</li>
		<li>Extra normalizer SSH2_CLOSE was changed. Capture group "protocol" was added and mapped to the "ApplicationProtocol" KUMA field. Capture group "cs1" was renamed to the "crypto_cipher" and mapped from the "DeviceCustomString1" to the "DeviceCustomString2" KUMA field. Capture group "cs2" was renamed to the "hmac" and mapped from the "DeviceCustomString2" to the "DeviceCustomString3" KUMA field. Capture group "cn1" was renamed to the "tty" and mapped from the "DeviceCustomString3" to the "DeviceCustomNumber1" KUMA field. Capture group "suser" was renamed to the "username" and mapped from the "SourceUserName" to the "DestinationUserName" KUMA field.Capture group "act" was renamed to the "action".</li>
		<li>Additional regular expressions were added to the all fourth level extra normalizers.</li>
		<li>Extra normalizer "ASA|FTD|FWSM|NGIPS" was changed. Event Conversion was removed from the "deviceProduct" field in the extra normalizer filter parameters.<li>
		</ul>		
 </p>

<p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 8</b><br>
		Change list:
		<ul>
			<li> Extra normalizer "ASA|FTD|FWSM" was changed. Extra normalizer name "ASA|FTD|FWSM" was changed to the "ASA|FTD|FWSM|NGIPS". Additional condition "NGIPS" was added to the filter condition.</li>
			<li>Support for "NGIPS" events was added.</li>
			<li>Extra normalizer "for302014" was changed. Mapping of event field "seq_num" was changed from KUMA field "DeviceCustomNumber1" to the KUMA field "DeviceCustomString2".</li>
		</ul>
  </p>

<p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 7</b><br>
		Change list:
		<ul>
			<li>Support of additional event type was added. New regular expressions were added to the main normalizer.</li>
			<li>Extra normalizer "434001" was changed. The regular expression was changed. Positions of the capture groups "deviceOutboundInterface" and "deviceInboundInterface" were fixed. New regular expression was added.</li>
      <li>Extra normalizer "434002" was changed. The regular expression was changed. Positions of the capture groups "deviceOutboundInterface" and "deviceInboundInterface" were fixed. New regular expression was added.</li>
      <li>Extra normalizer "434003" was changed. The regular expression was changed. Positions of the capture groups "deviceOutboundInterface" and "deviceInboundInterface" were fixed. New regular expression was added.</li>
      <li>Extra normalizer "434004" was changed. The regular expression was changed. Positions of the capture groups "deviceOutboundInterface" and "deviceInboundInterface" were fixed. New regular expression was added.</li>
      <li>Extra normalizer "434007" was changed. The regular expression was changed. Positions of the capture groups "deviceOutboundInterface" and "deviceInboundInterface" were fixed. New regular expression was added.</li>
      <li>Extra normalizer "106023" was changed. New regular expression was added.</li>
			<li>Extra normalizer "for302014" was changed. New regular expressions was added.</li>
      <li>New extra normalizers were added: "106028", "110001", "305009", "305010", "212005", "305005", "106010".</li>
		</ul>
  </p>

 <p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 6</b><br>
		Change list:
		<ul>
			<li>New extra normalizer "PORT_SECURITY" was added.</li>
			<li>In the extra normalizer "Product Separation" new event enrichments were added to the KUMA fields "SourceUserName", "SourceNtDomain".</li>
			<li>Extra normalizer "305011" was changed. New regular expression was added. Event field "sUser" was mapped to the KUMA field "SourceUserName".</li>
			<li>Extra normalizer "305012" was changed. New regular expression was added. Event field "sUser" was mapped to the KUMA field "SourceUserName".</li>
			<li>Extra normalizer "302027" was changed. Event enrichment was added to the KUMA field "BytesOut" (data from the field "DeviceCustomNumber1" was mapped to the KUMA field "BytesOut").</li>
			<li>Extra normalizer "302025" was changed. Event enrichment was added to the KUMA field "BytesOut" (data from the field "DeviceCustomNumber1" was mapped to the KUMA field "BytesOut").</li>
			<li>Extra normalizer "722029|722030|722031" was changed. Mapping of event field "Out" was changed from the KUMA field "DeviceCustomString1" to the "DeviceCustomString3". Event enrichment for the KUMA field "BytesOut" was added (data from the field "DeviceCustomString3" was mapped to the KUMA field "BytesOut"). Event enrichment for the field "BytesIn" was added (data from the field "DeviceCustomString1" was mapped to the KUMA field "BytesOut").</li>
		</ul>
  </p>

 <p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 5</b><br>
		Change list:
		<ul>
			<li>Regular expression in the extra normalizer "106015" was replaced.</li>
			<li>In the extra normalizer "106015" event field "sport" was mapped to the KUMA "SourcePort".</li>
		</ul>
  </p>

 <p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 4</b><br>
		Change list:
		<ul>
			<li>Support for new event types was added: "PARSER-5-CFGLOG_LOGGEDCMD", "SPAN-5-PKTCAP_START", "SPAN-SW1-5-PKTCAP_START", "MONITOR-5-ETH_SPAN_SESSION_UP", "C4K_REDUNDANCY-5-CONFIGSYNC", "AAAA-4-CLI_DEPRECATED".</li>
			<li>New extra normalizers were added: "PARSER", "SPAN", "MONITOR", "C4K_REDUNDANCY", "AAAA".</li>
			<li>New regular expressions were added to the extra normalizer «SYS».</li>
			<li>Option "Keep extra fields" was disabled for extra normalizers: "Product Separation", "ASA|FTD", "113039", "313009", "LINK", "SYS", "722029|722030|722031", "716039", "771002", "KV-part 734003", "430003|430002".</li>
		</ul>
  </p>
  
   <p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 3</b><br>
		Change list:
		<ul>
			<li>New extra normalizer was added "DHCP_SNOOPING".</li>
			<li>New extra normalizer was added "SEC".</li>
			<li>In the extra normalizer "113004" was added new regular expression.</li>
			<li>In the extra normalizer "SSH2_SESSION" was added new regular expression.</li>
			<li>In the extra normalizer "SSH2_USERAUTH" was added new regular expression.</li>
			<li>New conditions were added to the extra normalizer "SSH".</li>
			<li>New event mapping was added to the extra normalizer "717022". Event field "SN" was mapped to the KUMA field DeviceCustomString2, event field "email" was mapped to the KUMA field DeviceCustomString3, event field "cn" was mapped to the KUMA field SourceUserName. Mapping was removed from the KUMA field FlexString1.</li>
			<li>Event enrichment with constants to the DeviceCustom*label fields was removed in the extra normalizers: 106011, 111008, 111010, 113003, 113004, 113009, 113011, 113019, 210022, 302010, 303002, 313001, 313009, 502103, 602101, 606001, 606002, 711004, 716059, 717016, 717022, 717028, 717053, 720036, 720038, 720044, 720068, 720073, 721016, 721018, 722010, 722011, 722012, 722022, 722032, 722035, 722036, 722041, 722051, 722053, 722055, 733100, 734001, 737003, 737006, 737016, 737026, 737029, 737031, 737034.</li>
		</ul>
  </p>
  
  <p>
	  <b>[OOTB] Cisco ASA and IOS syslog. Version 2</b><br>
		Change list:
		<ul>
			<li>Support of event parsing from generated by Cisco Firepower Threat Defense (version 7.2) was added.</li>
			<li>New extra normalizers were added: 106016, 106017, 109201, 109207, 109210, 111009, 113015, 113028, 113034, 199016, 199017, 199018, 305006, 317077, 317078, 321006, 419003, 430002, 430003, 500003, 710006, 716039, 716047, 716603, 717025, 717029, 717030, 717036, 717038, 722029, 722030, 722031, 725004, 725008, 725010, 725011, 725012, 725014, 725017, 725021, 725022, 725023, 725024, 734002, 734003, 734004, 737001, 737035, 737200, 737201, 737400, 737401, 746012, 746013, 771002, 815004, 852001, 852002, 6414004.</li>
		</ul>
  </p>
 
 <p>
  <b>[OOTB] Cisco ASA and IOS syslog. Version 1</b><br>
  	Change list:
	<ul>
		<li>Regular expressions in the extra normalizers "302013", "for302014","302015", "302016" was fixed. Event field mapping was updated.</li>
		<li>Extra normalizer "ASA" was changed. Event enrichment for the field DeviceDirection was added (replace "outbound" with "0" and replace "inbound" with "1").</li>
		<li>Normalizer name was changed to the "[OOTB] Cisco ASA and IOS syslog.</li>
		<li>Other minor improvements.</li>
 </ul>
 </p>

</body>
</html>