<html lang="en">
<body>
	
	<p>
	<b>[OOTB] Checkpoint syslog. Version 2</b><br>
	Changelog:<br>
		<ul>
			<li>Main normalizer was changed. Regular expressions were updated. New regular expression was added. Conversion with regular expression was added to the event field "mid".</li>
			<li>Extra normalizer "Common KV Normalization" was changed. Condition was removed. Additional conversion was added to the msg field (replace "; " with "|" symbol). Additional conversion was added to the msg field (replace ":"" with "="" symbols). Mapping was changed. Event field "time" was mapped from the KUMA field "DeviceCustomString1" to the field EndTime. Event field "flags" was mapped to the KUMA field FlexNumber2. Event field "originsicname" was mapped from the KUMA field RequestContext to the KUMA field DeviceExternalID. Event field "lastupdatetime" was mapped to the KUMA field DeviceCustomDate1. Conversion to the field DeviceDirection was changed (value "101" was replaced with "1", value "100" was replaced with "0").</li>
			<li>Extra normalizer "VPN-1 & FireWall-1" was changed. Additional condition was added to the normalizer. Event field "message_info" was mapped to the KUMA field Message. Event field "dst_uo_name" was mapped to the KUMA field DestinationCountry. Event field "src_uo_name" was mapped to the KUMA field SourceContry. Event field "xlatedport" was mapped to the KUMA field DestinationTranslatedPort. Event field "xlatedst" was mapped to the KUMA field DestinationTranslatedAddress. Event field "xlatesport" was mapped to the KUMA field SourceTranslatedPort. Event field "xlatesrc" was mapped to the KUMA field SourceTranslatedPort. Event field "nat_rule_uid"  was mapped to the KUMA field DeviceCustomString3. Event field "nat_rulenum" was mapped to the KUMA field DeviceCustomNumber1.</li>
			<li>Additional conditions were added to the extra normalizers "Firewall KV Normalizer", "Application Control KV Normalizer", "URL Filtering KV Normalizer", "Log Update KV Normalization", "Identity Awareness KV Parser", "SmartDefense KV Parser", "Application Control KV Parser", "Connectra KV Parser", "Anti Malware KV Parser", "Empty ProductName KV Parser".</li>
			<li>Extra normalizer "Identity Awareness KV Parser" was changed. Parameter "Keep extra fields" was disabled.</li>
			<li>Extra normalizer "SmartDefense KV Parser" was changed. Parameter "Keep extra fields" was disabled.</li>
			<li>Extra normalizer "Application Control KV Parser" was changed. Parameter "Keep extra fields" was disabled.</li>
			<li>Extra normalizer "Connectra KV Parser" was changed. Parameter "Keep extra fields" was disabled.</li>
			<li>Extra normalizer "Anti Malware KV Parser" was changed. Parameter "Keep extra fields" was disabled.</li>
			<li>Extra normalizer "Connectra(+)VPN-1 & FireWall-1 KV Parser" was changed. Parameter "Keep extra fields" was disabled.</li>
			<li>New extra normalizers were added "HTTPS Inspection", "Empty ProductName KV Parser - ProductName".</li>
			<li>Some DeviceCustom* labels were updated.</li>
		</ul>
	</p>
	
	<p>
	<b>[OOTB] Checkpoint syslog. Version 1</b><br>
   	Changelog:<br>
	Support of events from the Checkpoint (version R81) have been added.<br>
	The normalizer name has been changed from "[OOTB] Checkpoint Syslog basic" to "[OOTB] Checkpoint syslog".<br>
	Type of the main normalizer has been changed to "regexp".<br>
	New extra normalizers have been added:
		<ul>
			<li>VPN-1 & FireWall-1</li>
			<li>Identity Awareness KV Parser</li>
			<li>SmartDefense KV Parser</li>
			<li>Application Control KV Parser</li>
			<li>Connectra KV Parser</li>
			<li>Anti Malware KV Parser</li>
			<li>Connectra(+)VPN-1 & FireWall-1 KV Parser</li>
			<li>Empty ProductName KV Parser</li>
		</ul>
	New event mappings have been added to the main normalizer:
		<ul>
			<li>Event field "ProductName" to the KUMA field "DeviceProduct"</li>
			<li>Event field "ProductFamily" to the KUMA field "DeviceFacility"</li>
			<li>Event field "sport_svc" to the KUMA field "SourcePort"</li>
			<li>Event field "svc" to the KUMA field "DestinationPort"</li>
			<li>Event field "Action" to the KUMA field "DeviceAction"</li>
			<li>Event field "session_uid" to the KUMA field "ExternalID"</li>
		</ul>
	New event enrichments have been added to the main normalizer:
		<ul>	
			<li>Enrichment type "event" to the KUMA field "DeviceAction"</li>
			<li>Enrichment type "dictionary" to the KUMA field "TransportProtocol"</li>
		</ul>
	Other minor improvements.<br>	
	</p>

</body>
</html>