<html lang="en">
<body>

  <p>
    <b>[OOTB] KEDR telemetry. Version 10</b><br>
   	Change log:<br>
	Field mapping in the extra normalizer 5145 was updated.
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 9</b><br>
   	Change log:
	<ul>
		<li>New extra normalizers were added: 4625, 4656, 4657, 4662, 4663, 4698, 4699, 4700, 4701, 4702, "User Account Management", "Groups Management", 4738, 4768, 4771, "A directory service object modification", 5140.</li>
		<li>Extra normalizer "windows event log event" was changed. Event field "EventData.Data.SubjectLogonId.value" was mapped from the KUMA field DeviceCustomString3 to the FlexString1. Mapping of the event field "System.Correlation.ActivityID.value" was removed.</li>
		<li>Main normalizer was changed. Mutation was removed from the event field "StartupParameters".</li>
	</ul>
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 8</b><br>
   	Change log:
	<ul>
		<li>New extra normalizers were added: 4624, 4672, 4663, "Process. ParentFileFullName is not empty", "Process. ParentFileFullName is empty", 4770, 4768, 4771, 4781, 4769, 4739, 4697, 7045, 5145, "code injection".</li>
		<li>Extra normalizer "windows event log event" was changed. Event enrichment was updated in the extra normalizer "windows event log event" to the KUMA field Name was updated. Event enrichments were removed from the KUMA fields SourcentDomain, SourceUserName, DestinationUserName, DestinationNtDomain.</li>
		<li>Main normalizer was changed. Destination of the event enrichement from KUMA field DeviceHostName was changed from DeviceDnsdomain to DeviceNtDomain. Event enrichements with template to the KUMA fields SourcePort, DestinationPort, SourceAddress, DestinationAddress were removed. Event enrichement with template was removed from the KUMA field ExternalID. Mapping of event field "IOAImportance" was removed from the KUMA field DeviceCustomIPv6Address1. Mapping of event field "IOAITag" was removed from the KUMA field DeviceCustomIPv6Address2. New event enrichments with replacewithregexp function were added to the KUMA fields SourceAddress, DestinationAddress. New event enrichments with regexp function were added to the KUMA fields DeviceCustomIPv6Address3, DeviceCustomIPv6Address4.</li>
		<li>Extra normalizer "portlisten" was changed. Event field "LocalIp" was mapped to the KUMA field SourceAddress. Event field "LocalPort" was mapped to the KUMA field SourcePort. Conversion with trim function was added to the event field "LocalIp".</li>
		<li>Extra normalizer "process" was changed. Mapping of the event field "ParentStartupParameters" was removed from the KUMA field SourceProcessName.</li>
		<li>New dictionary [OOTB] Windows. KRB ResultCodes was added.</li>
		<li>Extra normalizer "connection" was updated. Event enrichments with template to the KUMA fields SourcePort, DestinationPort, SourceAddress, DestinationAddress were added. Conversion was removed from the event field "Direction". Event enrichment with replace function was added to the KUMA field Destination.</li>
		<li>Extra normalizer "portlisten" was changed. Event field "LocalIp" was mapped to the KUMA field SourceAddress, event field "LocalPort" was mapped to the field SourcePort.</li>
		<li>Extra normalizer "threatdetect" was changed. Event field "LocalIp" was mapped to the KUMA field SourceAddress, event field "LocalPort" was mapped to the field SourcePort, event field "RemoteIp" was mapped to the field DestinationAddress, event field "RemotePort" was mapped to the event field DesinationPort.</li>
		<li>Extra normalizer "threatprocessingresult" was changed. Event field "LocalIp" was mapped to the KUMA field SourceAddress, event field "LocalPort" was mapped to the field SourcePort.</li>
	</ul>
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 7</b><br>
   	Change log:
	<ul>
		<li>New event enrichment was added to the main normalizer. A template was added, as a result of which, in events of the "inbound" type, the "LocalPort" field is mapped to the KUMA "SourcePort" field, and in events of the "outbound" type, the "RemotePort" field is mapped to the KUMA "SourcePort" field.</li>
        <li>New event enrichment was added to the main normalizer. A template was added, as a result of which, in events of the "outbound" type, the "LocalPort" field is mapped to the KUMA "DestinationPort" field, and in events of the "inbound" type, the "RemotePort" field is mapped to the KUMA "DestinationPort" field.</li>
        <li>New event enrichment was added to the main normalizer. A template was added, as a result of which, in events of the "inbound" type, the "LocalIp" field is mapped to the KUMA "SourceAddress" field, and in events of the "outbound" type, the "RemoteIp" field is mapped to the KUMA "SourceAddress" field.</li>
        <li>New event enrichment was added to the main normalizer. A template was added, as a result of which, in events of the "outbound" type, the "LocalIp" field is mapped to the KUMA "DestinationAddress" field, and in events of the "inbound" type, the "RemoteIp" field is mapped to the KUMA "DestinationAddress" field.</li>
        <li>The extra normalizer "threatprocessingresult" was changed. The fields "LocalIp", "LocalPort", "RemoteIp", and "RemotePort" were removed.
        <li>The extra normalizer "threatdetect" was changed. The fields "LocalIp", "LocalPort", "RemoteIp", and "RemotePort" were removed.</li>
        <li>The extra normalizer "portlisten" was changed. The fields "LocalIp", "LocalPort", "RemoteIp", and "RemotePort" were removed.</li>
        <li>The extra normalizer "connection" was changed. The fields "LocalIp", "LocalPort", "RemoteIp", and "RemotePort" were removed.</li>
		<li>The extra normalizer "windows event log event" was changed. The enrichment of the KUMA "Name" field was removed.</li>
        <li>New event enrichment was added to the extra normalizer "windows event log event". The KUMA field "DeviceEventClassID" is mapped to the KUMA field "Name" with the "Replace" function, which converts the event class into a description.</li>
	</ul>
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 6</b><br>
   	Change log:
	<ul>
		<li>Value of parameter "Keep raw event" changed from "Always" to "Only errors".</li>
		<li>Mapping in the main normalizer was changed. Mapping of the event field "SignatureSubjectName" was removed from the KUMA field "FileID". Event field "ProductVendor" was mappedt to the KUMA field "FileID".</li>
		<li>Mapping in the extra normalizer "driver" was changed. Mapping of the event field "ProductVendor" was removed from the KUMA field "DeviceCustomString6".</li>
		<li>Mapping in the extra normalizer "module" was changed. Mapping of the event field "DllSignatureCheckResult" was mapped to the KUMA field "EventOutcome".</li>
		<li>New event enrichment was added to the main normalizer (DeviceHostName to lower case).</li>
		<li>Extra normalizer "4610 or 4614 or 4622" was changed. Mapping of event field "Extra.Data.EventData.Data.Name.value" was removed from the KUMA field DeviceCustomString1Label. Mapping of event field "Extra.Data.EventData.value" was removed from the KUMA field DeviceCustomString1. Event field "EventData.Data.Name.value" was mapped to the KUMA field DeviceCustomString1Label. Event field "EventData.Data.value" was mapped to the KUMA field DeviceCustomString1.</li>
	</ul>
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 5</b><br>
   	Change log:
	<ul>
		<li>Event enrichments to the KUMA fields SourceUserName, DestinationUserName, SourceNtDomain, DestinationNtDomain were updated in the main normalizer. New regular expressions were added.</li>
		<li>Data from the KUMA field SourceUserName was duplicated to the KUMA field DestinationUserName in the extra normalizers: connection, process, filechange, applock, blockeddocument, module, driver, portlisten, registry, threatdetect, threatprocessingresult, process_interpreted_file_run, process_console_interactive_input, amsi_scan, process-terminate, dns_lookup, named_pipe.</li>
	</ul>
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 4</b><br>
   	Change log:
	<ul>
		<li>New extra normalizers were added: " dns_lookup", " named_pipe".</li>
		<li>Additional data was added to the dictionary «[OOTB] KEDR. FileOperationType» (enteries 7, 8, 9).</li>
		<li>Mapping was changed in the main normalizer. Mapping of event field "UniquePid" was removed from the KUMA field «FlexString2». Event field "OriginalFileName" was mapped to the KUMA field «DeviceCustomString1». Event field "ZoneIdentifier" was mapped to the KUMA field "DeviceCustomFloatingPoing1". Event field "OsName" was mapped from the KUMA field "DeviceVersion" to the field "Extra.OsName". Event field "OsVersion" was mapped from the KUMA field "DeviceCustomString1" to the field "Extra.OsVersion".</li>
		<li>Mapping was changed in the extra normalizer "process". Mapping of event field "UniquePid" was removed from the KUMA field «FlexString2». Mapping of event field "UniqueParentPid" was removed from the KUMA field «FlexString1».</li>
		<li>Event enrichment was changed in the main normalizer. Event enrichment with template was added to the KUMA field "ExtarnalID" in the main normalizer.</li>
	</ul>
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 3</b><br>
   	Change log:
	<ul>
		<li>Additional condition was added in the extra normalizer "amsi_scan".</li>
		<li>Additional event enrichments were added in the main normalizer (lower case to the KUMA fields "DestinationUserName", "SourceHostName").</li>
		<li>Additional mapping was added in the extra normalizer "windows event log event". Event field "EventData.Data.lpAddress.value" was mapped to the KUMA field "SourceAddress". Event field "EventData.Data.WorkstationName.value" was mapped to the KUMA field "SourceHostName".</li>		
	</ul>
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 2</b><br>
   	Change log:
	<ul>
		<li>Mapping of the field "ProductVersion" in the main normalizer have been changed from the "FileId" field to the "DeviceVersion" KUMA field.</li>
		<li>Mapping of the field "SignatureSubjectName" in the main normalizer have been changed from the "FlexString2" field to the "FileId" KUMA field.</li>
	</ul>
  </p>

  <p>
    <b>[OOTB] KEDR telemetry. Version 1</b><br>
   	Change log:
	<ul>
		<li>Parsing of new event type have been added (process_terminate event).</li>
		<li>Mapping of additional event fields has been added in extra normalizers.</li>
		<li>Mapping of the Timestamp field has been added in the "registry" extra normalizer.</li>
		<li>Mapping of the timestamp field was changed from the StartTime to the EndTime KUMA field.</li>
		<li>Event enrichment have been added for *UserName fields (lower case).</li>
		<li>Event enrichment have been added to the SourceNtDomain KUMA field (upper case).</li>
		<li>Mapping of the LocalIp field was changed from the DestinationAddress to the SourceAddress KUMA field in the "portlisten" extra normalizer.</li>
		<li>Mapping of the LocalPort field was changed from the DestinationPort to the SourcePort KUMA field in the "portlisten" extra normalizer.</li>
	</ul>
  </p>

</body>
</html>