<html lang="en">
<body>
  
	<p>
    <b>[OOTB] Sophos Central syslog. Version 2</b><br>
	Changelog:<br>
		<ul>
			<li>The parsing method in the main normalizer was changed from "syslog" to "regexp".</li>
			<li>Event enrichment with dictionary "[OOTB] Syslog priority to facility and severity" was added to the main normalizer.</li>
			<li>Extra normalizer "msg json" was changed. All event enrichments were removed. </li> 
			<li>New extra normalizers were added "Other events", "Malicious connection detected", "Access was blocked".</li>
			<li>New extra normalizers were added "Other events", "Malicious connection detected", "Access was blocked".</li>
			<li>Extra normalizer "Malware cleaned up" was updated. Condition was changed from "match" to "startsWith". Event field "name" was mapped to the KUMA field Message. Event field "core_remedy_items.items.0.result" was mapped from the KUMA field DeviceCustomString4 to the KUMA field EventOutcome.  Event field "core_remedy_items.items.1.result" was mapped from the KUMA field DeviceCustomString6 to the DeviceCustomString4.</li>
			<li>Extra normalizer "Malware detected" was updated. Condition was changed from "match" to "startsWith". Event field "name" was mapped to the KUMA field Message. Event enrichments with replaewithregexp function were added to the KUMA field FilePath, FileName.</li>
		</ul>
	</p>
  
  <p>
    <b>[OOTB] Sophos Central syslog. Version 1</b><br>
	This is the first version of the package.
  </p>

</body>
</html>