<html lang="en">
<body>

	<p>
		<b>[OOTB] Linux auditd syslog for KUMA 3.2. Version 7</b><br>
		Change log:
		<ul>
		    <li>Extra normalizer "Audittools" was changed. Mutation with replaceWithRegexp function was changed. "(.*)(type=EXECVE\s.*?)(type=.*)?$" changed to "(.*)(type=EXECVE\s.*?)\s+(type=.*)?$".</li>
			<li>Extra normalizer "Audittools" was changed. Mutation with replaceWithRegexp function was changed. "a\d\=" changed to "\sa\d\=".</li>
			<li>Exta normalizer "Message parsing" was changed. Parameter "Keep extra fields" was disabled.</li>
			<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE" was changed. The value "GRP" was added to the Filter parameters.</li>
			<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE" was renamed to "CRED|USER|CRYPTO|SERVICE|GRP|ADD|DEL".</li>
			<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was renamed to "CRED|USER|CRYPTO|SERVICE|GRP|ADD|DEL msg".</li>
			<li>New mapping was added in the extra normalizer "CRED|USER|CRYPTO|SERVICE|GRP|ADD|DEL msg". Event field "SUID" was mapped to the KUMA field "S.SUID", Event field "id" was mapped to the KUMA field "N.id", Event field "grp" was mapped to the KUMA field "FlexString2", Event field "pid" was mapped to the KUMA field "DestinationProcessID", Event field "comm" was mapped to the KUMA field "S.command".</li>
			<li>Exta normalizer "CRED|USER|CRYPTO|SERVICE|GRP|ADD|DEL msg" was changed. Mapping of the KUMA field "DeviceCustomString6" was changed from the event field "Cipher" to "cipher". </li>
			<li>Exta normalizer "CRED|USER|CRYPTO|SERVICE|GRP|ADD|DEL" was changed. New regular expressions were added.</li>
			<li>Exta normalizer "CRED|USER|CRYPTO|SERVICE|GRP|ADD|DEL msg" was changed. Mutation with "replace" function were added for the "direction", "terminal", "grantors" fields. "?" replace for "".</li>
			<li>Exta normalizer "Audittools" was changed. New regular expression was added.</li>
			<li>Exta normalizer "Audittools part" was changed. New dictionaries "[OOTB] Linux. Syscall types by architecture" and "[OOTB] Linux. Auditd connect error codes" were added.</li>			
			<li>Exta normalizer "Audittools part" was changed. Event enrichment "replace" was added to the field DeviceCustomString3. "40000003" field replace for "i386".</li>
			<li>New mapping was added in the extra normalizer "Audittools part". Event field "SYSCALL" was mapped to the KUMA field "S.Syscall", Event field "fam" was mapped to the KUMA field "S.saddr_fam"</li>
		</ul>		
	</p>

	<p>
		<b>[OOTB] Linux auditd syslog for KUMA 3.2. Version 6</b><br>
		Change log:
		<ul>
			<li>New mapping was added in the extra normalizer "CRED|USER|CRYPTO|SERVICE msg". Event field "ID" was mapped to the KUMA field "DeviceCustomString1".</li>
			<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE" was changed. The values "ADD" and "DEL" were added to the Filter parameters.</li>
			<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was changed. Mutation with replaceWithRegexp function was added "(\w+=)" value is replaced with "|$1". Mutation with replace function was added """ value is replaced with "". Mutation with replace function was added "|op" value is replaced with "op".</li>
			<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was changed. Pair delimiter was changed from " " to the "|" symbol.</li>
			<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE" was changed. Mapping of the event field "ses" was changed from the KUMA field "Externalid" to "DeviceCustomNumber1".</li>
			<li>Extra normalizer "extranormalizer rsh" was changed. Mapping of the event field "cmd" was changed from the KUMA field "DeviceCustomString2" to "FlexString1".</li>
			<li>Extra normalizer "extranormalizer pam_" was changed. Mapping of the event field "tty" was changed from the KUMA field "DeviceCustomString4" to "DeviceCustomString2".</li>
			<li>Extra normalizer "extranormalizer pam_" was changed. Mapping of the event field "logName" was changed from the KUMA field "DeviceCustomString2" to "FlexString1".</li>
			<li>Extra normalizer "extranormalizer pam_" was changed. Mapping of the event field "openedBy" was changed from the KUMA field "DeviceCustomString2" to "DeviceCustomString4".</li>
			<li>Extra normalizer "extranormalizer execute command" was changed. Mapping of the event field "tty" was changed from the KUMA field "DeviceCustomString3" to "DeviceCustomString2".</li>
			<li>Extra normalizer "extranormalizer execute command" was changed. Mapping of the event field "user" was changed from the KUMA field "DeviceCustomString2" to "DeviceCustomString3".</li>
			<li>Extra normalizer "extranormalizer new group|user" was changed. Mapping of the event field "GID" was changed from the KUMA field "DeviceCustomString2" to "S.GID".</li>
			<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was changed. Mapping of the event field "addr" was changed from the KUMA field "DestinationAddress" to "SourceAddress". Mapping of the event field "laddr" was changed from the KUMA field "SourceAddress" to "DestinationAddress". Mapping of the event field "lport" was changed from the KUMA field "SourcePort" to "DestinationPort". Mapping of the event field "rport" was changed from the KUMA field "DestinationPort" to "SourcePort".</li>
			<li>Extra normalizer "Connect" was removed.</li>
			<li>New extra normalizers "Connect,bind syscall" and "Other" were added.</li>			
			<li>Extra normalizer "Audittools part" was changed. Event field "laddr" mapping was removed from the KUMA field SourceAddress. Event field "lport" mapping was removed from the KUMA field SourcePort.</li>
		</ul>		
	</p>

	<p>
	<b>[OOTB] Linux auditd syslog for KUMA 3.2. Version 5</b><br>
	Change log:
	<ul>
		<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was changed. Mapping of the event field "lport" was changed from the KUMA field "DestinationPort" to "SourcePort", Mapping of the event field "rport" was changed from the KUMA field "SourcePort" to "DestinationPort".</li>
		<li>Extra normalizer "Audittools" was changed. Mutation with replaceWithRegexp function was changed. "(audit\([^\)]+\):)\s(.*?)?(\w+=\w+)" changed to "(audit\([^\)]+\):)\s(.*?)?(\w+=[\"\w]+)".</li>
		<li>New mapping was added in the extra normalizer "Audittools part". Event field "laddr" was mapped to the KUMA field "SourceAddress", Event field "lport" was mapped to the KUMA field "SourcePort".</li>
		<li>New extra normalizer "Connect" was added.</li>
	</ul>		
	</p>
		
	<p>
	<b>[OOTB] Linux auditd syslog for KUMA 3.2. Version 4</b><br>
	Change log:
	<ul>
		<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was changed. New mutation with "decodeHexString" function was added for the "exe" field.</li>
		<li>Extra normalizer "Audittools part" was changed. New mutation with "decodeHexString" function was added for the "exe" field. Mutation with replaceWithRegexp function was added ("a\d\=" value was replaced with "a=" symbol). New mapping was added in the extra normalizer "Audittools part". Event field "a" was mapped to the KUMA field "SA.SyscallArgs".</li>
	</ul>		
	</p>

	<p>
	<b>[OOTB] Linux auditd syslog for KUMA 3.2. Version 3</b><br>
  	Change log:
	<ul>
		<li>Extra normalizer "Message parsing" was changed. New regular expression has been added.</li>
		<li>Extra normalizer "Audittools part" was changed. The new field mapping has been added. The field "path" has been mapped to the "S.saddr_path" KUMA field.</li>
		<li>Extra normalizer "Audittools part" was changed. The new field mapping has been added. The field "saddr_fam" has been mapped to the "S.saddr_fam" KUMA field.</li>
		<li>Extra normalizer "Audittools part" was changed. The new field mapping has been added. The field "obj" has been mapped to the "SA.TargetSELinuxContext" KUMA field.</li>
		<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was changed. The new field mapping has been added. The field "cmd" has been mapped to the "FlexString1" KUMA field.</li>
		<li>Extra normalizer "Audittools" was changed. Mutation with replaceWithRegexp function was added. "(SADDR=\{)\s([^\}]+)\s(\})" value is replaced with " $2".</li>
	</ul>
	</p>
  
	<p>
	<b>[OOTB] Linux auditd syslog for KUMA 3.2. Version 2</b><br>
  	Change log:
	<ul>
		<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was changed. Mapping of event field "acct" was changed from KUMA field "SourceUserName" to the KUMA field "DeviceCustomString1".</li>
		<li>Extra normalizer "CRED|USER|CRYPTO|SERVICE msg" was changed. The new field mapping has been added. The field "unit" has been mapped to the "DestinationServiceName" KUMA field.</li>
		<li>Extra normalizer "Audittools part" was changed. The new field mapping has been added. The field "} type" has been mapped to the "SA.RecordType" KUMA field.</li>
		<li>Extra normalizer "Audittools part" was changed. Mutation with replace function was added. "proctitle=" value is replaced with " |proctitle=".</li>
		<li>Extra normalizer "Audittools part" was changed. The new field mapping has been added. The field "|proctitle" has been mapped to the "DeviceCustomString5" KUMA field.</li>
	</ul>
	</p>

	<p>
	<b>[OOTB] Linux auditd syslog for KUMA 3.2. Version 1</b><br>
  	Change log:
	<ul>
		<li>Event enrichment with constant "auditd" was added  to the KUMA field DeviceProduct in main normalizer.</li>
		<li>In the extra normalizer "Audittools" event field "syscallArg" mapping was removed from the KUMA field DeviceCustomString5.</li>
		<li>Mapping was changed in the extra normalizer "Audittools part". Event field "proctitle" was mapped from the KUMA field "DeviceAction" to the KUMA field "DeviceCustomString5". Event field "pid" was mapped from the KUMA field "SourceProcessID" to the KUMA field "DestinationProcessID".</li>
		<li>Mapping was changed in the extra normalizer "CRED|USER|CRYPTO|SERVICE". Event field "SourceProcessID" was mapped from the KUMA field "SourceProcessID" to the KUMA field "DestinationProcessID". Event field "auid" was mapped from the KUMA field "SourceUserName" to the KUMA field "SourceUserID". Event field "uid" was mapped from the KUMA field "SourceUserID" to the KUMA field "DestinationUserID".</li>
		<li>Mapping was changed in the extra normalizer "Message parsing". Event field "auditId" was mapped from the KUMA field "DeviceProcessID".</li>
		<li>New mapping was added in the extra normalizer "Audittools part". Event field "ppid" was mapped to the KUMA field "SourceProcessID". Event field "GID" was mapped to the extended data model field "S.GID". Event field "EUID" was mapped to the extended data model field "S.EUID". Event field "SUID" was mapped to the extended data model field "S.SUID". Event field "SGID" was mapped to the extended data model field "S.SGID". Event field "AUID" was mapped to the KUMA field "SourceUserName". Event field "UID" was mapped to the KUMA field "DestinationUserName". Event field "euid" was mapped to the extended data model field "S.euid". Event field "auid" was mapped from the KUMA field "DestinationUserID" to the KUMA field "SourceUserID". Event field "uid" was mapped from the KUMA field "SourceUserID" to the KUMA field "DestinationUserID".</li>
		<li>New mutation was added for "msg" field in the extra normalizer "Message parsing". Symbol "GS" was replaced with space character.</li>
		<li>In the extra normalizer "Audittools part" new event enrichment was added. Replace of symbol "\x00" with space character was added for the data in the KUMA field "DeviceCustomString5".</li>
		<li>In the extra normalizer "Audittools" new event enrichment was added. Replace of two space characters with one space character was added for the data in the KUMA field "DeviceCustomString6".</li>
		<li>Mapping was changed in the extra normalizer "extranormalizer pam_". Event field "euid" was mapped from the field "DeviceCustomString3" to the extended data model field "S.euid".</li>
		<li>New mapping was added in the extra normalizer "CRED|USER|CRYPTO|SERVICE msg". Event field "AUID" was mapped to the KUMA field "SourceUserName". Event field "UID" was mapped to the KUMA field "DestinationUserName".</li>
		<li>In the extra normalizer "CRED|USER|CRYPTO|SERVICE msg" new event enrichment was added. Replace of symbol "'" with empty character was added for the data in the KUMA field "EventOutcome". Replace of the first character " with empty character was added for the data in the KUMA field "EventOutcome".</li>	
		<li>In the extra normalizer "Audittools part" event enrichment was changed. Text "yes" in the KUMA field "EventOutcome" now will be replaced with text "success" instead of "Successful". Text "no" in the KUMA field "EventOutcome" now will be replaced with text "failed" instead of "Failed".</li>
	</ul>
	</p>

</body>
</html>