<html lang="en">
<body>

<p>
		<b>[OOTB] Microsoft Products for KUMA 3 Version 18</b><br>
		Change log:
		<ul>
			<li>Support of events from the Microsoft - Windows - TaskScheduler - Operational event journal was added.</li>
			<li>Extra normalizer "1" was changed. Target field of the first event enrichment with regexp was changed from the KUMA field OldfilePath to OldFileName.</li>
			<li>Extra normalizer Microsoft-Windows-GroupPolicy was changed. Event enrichment with constant "Windows" was added to the KUMA field DeviceProduct.</li>
			<li>Extra normalizer "4697" was changed. Event field "Event.EventData.Data.ServiceType" was mapped to the KUMA field DeviceCustomString1. Event field "Event.EventData.Data.ServiceFileName" was mapped from the KUMA field DeviceCustomString2 to the KUMA field FileName. Event field "Event.EventData.Data.ServiceAccount" was mapped to the KUMA field DeviceCustomString5. Event field "Event.EventData.Data.ServiceStartType" was mapped to the KUMA field DeviceCustomString2.</li>
			<li>New extra normalizers were added: "Microsoft-Windows-TaskScheduler", "TaskScheduler 100 101 102 103 106 110", "TaskScheduler 101 ResultCode mapping", "TaskScheduler 129", "TaskScheduler 101 ResultCode mapping", "TaskScheduler 129", "TaskScheduler 140 141 332", "TaskScheduler 201 202 203".</li>
			<li>Extra normalizer "1000 (Defender)" was updated. Event conversion was removed from the event field "Event.EventData.Data.Domain".</li>
			<li>Extra normalizer "1015 (Defender)" was updated. Event conversion was removed from the event field "Event.EventData.Data.Domain", "Event.EventData.Data.Domain", "Event.System.Security.User".</li>
			<li>New dictionary "[OOTB] Windows. Task Scheduler. EventIDs and Event Names" was added.</li>
			<li>Exta normalizers "4701", "TaskContentNew" were changed. Parameter "Keep extra fields" was disabled. Mapping of event field "Task.Actions.Exec.Command" was removed from the KUMA field DeviceAction.</li>
			<li>Exta normalizers "4698" was changed. Mapping of event field "Task.Actions.Exec.Command" was removed from the KUMA field DeviceAction.</li>
			<li>Extra normalizers "A scheduled tasks management" was removed.</li>
			<li>DeviceCustom* fields labels were updated.</li>
		</ul>		
	</p>

<p>
		<b>[OOTB] Microsoft Products for KUMA 3 Version 17</b><br>
		Change log:
		<ul>
			<li>New extra normalizers "1040", "1013, 11725", "4698", "4698 TaskContent" were added.</li>
			<li>Extra normalizers "4768" and "4771" were changed. Event field "Event.EventData.Data.CertIssuerName" was mapped to the KUMA field S.CertIssuerName, Event field "Event.EventData.Data.CertSerialNumber" was mapped to the KUMA field S.CertSerialNumber, Event field "Event.EventData.Data.CertThumbprint" was mapped to the KUMA field S.CertThumbprint, Event field "Event.EventData.Data.TicketOptions" was mapped to the KUMA field S.TicketOptions, Event field "Event.EventData.Data.TicketEncryptionType" was mapped to the KUMA field S.TicketEncryptionType, Event field "Event.EventData.Data.PreAuthType" was mapped to the KUMA field S.PreAuthType.</li>
			<li>Extra normalizer "4768" was changed. Event field "Event.EventData.Data.ServiceSid" was mapped to the KUMA field DestinationUserID.</li>
			<li>Extra normalizer "4738" was changed. Event field "Event.EventData.Data.SamAccountName" was mapped to the KUMA fields S.SamAccountName and DeviceCustomString1, Event field "Event.EventData.Data.UserPrincipalName" was mapped to the KUMA field S.UserPrincipalName, Event field "Event.EventData.Data.PasswordLastSet" was mapped to the KUMA fields S.PasswordLastSet and DevicecustomDate1, Event field "Event.EventData.Data.AllowedToDelegateTo" was mapped to the KUMA fields S.AllowedToDelegateTo and FileType, Event field "Event.EventData.Data.DnsHostName" was mapped to the KUMA field S.DnsHostName, Event field "Event.EventData.Data.ServicePrincipalNames" was mapped to the KUMA field S.ServicePrincipalNames.</li>
			<li>Extra normalizer "A computer account management" was changed. Event field "Event.EventData.Data.SamAccountName" was mapped to the KUMA fields S.SamAccountName and DeviceCustomString1, Event field "Event.EventData.Data.UserPrincipalName" was mapped to the KUMA field S.UserPrincipalName, Event field "Event.EventData.Data.PasswordLastSet" was mapped to the KUMA fields S.PasswordLastSet and DevicecustomDate1, Event field "Event.EventData.Data.AllowedToDelegateTo" was mapped to the KUMA fields S.AllowedToDelegateTo and FileType, Event field "Event.EventData.Data.DnsHostName" was mapped to the KUMA field S.DnsHostName, Event field "Event.EventData.Data.ServicePrincipalNames" was mapped to the KUMA field S.ServicePrincipalNames.</li>
			<li>Extra normalizer "User Account Management" was changed. Event field "Event.EventData.Data.SamAccountName" was mapped to the KUMA field DeviceCustomString1, event field "Event.EventData.Data.UserPrincipalName" was mapped to the KUMA field S.UserPrincipalName, Mapping of the event field "Event.EventData.Data.PasswordLastSet" was changed from the KUMA field "FlexString2" to "DeviceCustomDate1", event field "Event.EventData.Data.PasswordLastSet" was mapped to the KUMA field S.PasswordLastSet, event field "Event.EventData.Data.AllowedToDelegateTo" was mapped to the KUMA field FileType, event field "Event.EventData.Data.DnsHostName" was mapped to the KUMA field S.DnsHostName, Event field "Event.EventData.Data.ServicePrincipalNames" was mapped to the KUMA field S.ServicePrincipalNames.</li>
			<li>Extra normalizer "4769" was changed. Mapping of the event field "Event.EventData.Data.TicketEncryptionType" was changed from the KUMA field "DeviceCustomString5" to "DeviceCustomString3". Event field "Event.EventData.Data.CertIssuerName" was mapped to the KUMA field S.CertIssuerName, Event field "Event.EventData.Data.CertSerialNumber" was mapped to the KUMA field S.CertSerialNumber.</li>
			<li>Extra normalizer "1042" was changed. Mapping of the event field "Event.EventData.Data.0" was changed from the KUMA field "FilePath" to "OldFilePermission". Event enrichment "ReplaceWithRegexp" was added to the field "Event.EventData.Data.0". Event field "Event.System.Security.UserID" was mapped to the KUMA field DestinationUserID.</li>
			<li>Extra normalizer "1034" was changed. Event enrichment "Replace" was added to the field DeviceCustomString6 and DeviceCustomString3.</li>
			<li>Extra normalizer "4104" was changed. Mapping of the event filed "Event.EventData.Data.ScriptBlockId" was removed from the KUMA field DeviceCustomStrin1.</li>
			<li>Extra normalizer "1317" was changed. Mapping of the event filed "Event.System.Security.UserID" was changed from the KUMA field SourceUserName to the KUMA fied SourceUserID.</li>
			<li>Extra normalizers "7000, 7023, 7024", "7031", "7011", "7001", "7043", "7038", "7002", "7003 7037", "7005", "7006", "7009", "7016, 7017, 7018, 7019, 7020, 7021, 7022", "7026", "7028", "7030", "7032", "7033", "7034", "7035", "7036", "7039", "7040", "7041", "7042", "107", "1074", "109", "42", "12", "13 system" were changed. Parameter "Use raw event" was enabled. Parameter "XML attributes" was changed to "Event.EventData.Data.Name".</li>
			<li>Extra normalizer "1074" was changed. Mapping of the event filed "Event.EventData.Data.param2" was changed from the KUMA field SourceDnsDomain to the KUMA fied DestinationHostName. Event converion was removed from the event field "Event.EventData.Data.param2". Mapping of the event field "Event.EventData.Data.param7" was changed from the SourceUserName to the DestinationUserName.</li>
			<li>Extra normalizer "13 system" was changed. Event conversions were added to the event field "Event.EventData.Data.StopTime" (regexp and append functions).</li>
			<li>Extra normalizers "Windows PowerShell 400 403 regexp", "Windows PowerShell 800 regexp", "Windows PowerShell 600 regexp", "SMBServer 3000 RenderingInfo.Message parsing" were changed. New regular expression was added.</li>
			<li>Extra normalizer "2080 Event.RenderingInfo.Message regex part" was changed. Capture group "all" was mapped to the KUMA field DeviceCustomString6.</li>
			<li>Extra normalizer "1001" was changed. Additional regular expression was added. Capture group "all" was mapped to the KUMA field DeviceCustomString6.</li>
			<li>Extra normalizer "4625" was edited. Mapping of the event field "Event.EventData.Data.FailureReason" was removed from the KUMA field DeviceCustomString4. Mapping of the event field "Event.EventData.Data.Status" was changed fro the KUMA field DeviceCustomString6 to the KUMA field DeviceCustomString4. Event enrichment with replace function was removed from the KUMA field DeviceCustomString4. Event enrichment with replace function was added to the field S.DecodedReason. Event enrichment with dictionary "[OOTB] Windows. Failure codes" was removed from the KUMA field DeviceCustomString6. Event enrichment with dictionary "[OOTB] Windows. Failure codes" was added to the field S.DecodedStatus.</li>
			<li>Extra normalizer "4768" was edited. Option "Keep extra fields" was disabled. Event enrichement with dictionary "[OOTB] Windows. KRB ResultCodes" was removed from the KUMA field DeviceCustomString4. Event enrichement with dictionary "[OOTB] Windows. KRB ResultCodes" was added to the field S.DecodedStatus.</li>
			<li>Extra normalizer "4771" was edited. Mapping of the event field "Event.EventData.Data.Status" was removed from the KUMA field Reason. Event enrichement with dictionary "[OOTB] Windows. KRB ResultCodes" was removed from the KUMA field DeviceCustomString4. Event enrichment with dictionary "[OOTB] Windows. KRB ResultCodes" was added to the field S.DecodedStatus.</li>
			<li>Extra normalizer "4776" was edited. Mapping of the event field "Event.EventData.Data.Status" was removed from the KUMA field Reason. Event enrichement with dictionary "[OOTB] Windows. Validate Cred. Error Codes" was removed from the KUMA field DeviceCustomString4. Event enrichment with dictionary "[OOTB] Windows. Validate Cred. Error Codes" was added to the field S.DecodedStatus.</li>
			<li>Table "[OOTB] Windows. GroupPolicy EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. GroupPolicy. EventIDs and Event Names".</li>
			<li>Dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. EventIDs and Event Names".</li>
			<li>Dictionary "[OOTB] Microsoft DNS Server. EventIDs and Event Names" was renamed to "[OOTB] Microsoft. DNS Server. EventIDs and Event Names".</li>
			<li>Dictionary "[OOTB] Windows_Terminal Server. EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. Terminal Server. EventIDs and Event Names".</li>
			<li>Dictionary "[OOTB] Windows Hyper-V EventID-Name" was renamed to "[OOTB] Windows. Hyper-V. EventIDs and Event Names".</li>
			<li>Dictionary "[OOTB] Windows. Service Control Manager EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. Service Control Manager. EventIDs and Event Names".</li>
			<li>Dictionary "[OOTB] Windows. LogonTypes (Windows all events)" was renamed to "[OOTB] Windows. Logon Types".</li>
			<li>Dictionary "[OOTB] Windows_Sysmon. EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. Sysmon. EventIDs and Event Names".</li>
			<li>Dictionary "[OOTB] Windows. FailureCodes (4625)" was changed. Dictionary was renamed from "[OOTB] Windows. FailureCodes (4625)" to "[OOTB] Windows. Failure Codes". Dicionary description was updated.</li>
			<li>Other minor improvements: labels in the extra normalizers were updated.</li>
		</ul>		
	</p>

<p>
		<b>[OOTB] Microsoft Products for KUMA 3 Version 16</b><br>
		Change log:
		<ul>
			<li>Extra normalizer "4625" was changed. Event enrichment with dictionary "[OOTB] Windows. LogonTypes (Windows all events)" was added to the extra normalizer "4625" on "FlexString2" KUMA field. Event enrichment with dictionary "[OOTB] Windows. FailureCodes (4625)" was added to the extra normalizer "4625" to the "DeviceCustomString6" KUMA field. Event enrichment with "replace" function was added to the extra normalizer "4625" to the "DeviceCustomString4" KUMA field. Mapping of the event field "Event.EventData.Data.WorkstationName" was changed from the KUMA field "SourceHostName" to "DeviceCustomString2".</li>
			<li>Extra normalizer "4907" was changed. Event field "Event.EventData.Data.OldSd" was mapped to the KUMA field DeviceCustomString5. Event field "Event.EventData.Data.NewSd" was mapped to the KUMA field DeviceCustomString6.</li>
            <li>Extra normalizer "Kerberos or DRA group for EFS or The audit policy (SACL) on an object policy was changed." was changed. Event field "Event.EventData.Data.OldSd" was mapped to the KUMA field DeviceCustomString5. Event field "Event.EventData.Data.NewSd" was mapped to the KUMA field DeviceCustomString6.</li>
            <li>Extra normalizer "4770" was changed. Event field "Event.EventData.Data.TicketEncryptionType" was mapped to the KUMA field DeviceCustomString3. Event field "Event.EventData.Data.TicketOptions" was mapped to the KUMA field DeviceCustomString1. Event field "Event.EventData.Data.ServiceSid" was mapped to the KUMA field DestinationUserID.</li>
            <li>Extra normalizer "4768" was changed. Event field "Event.EventData.Data.TicketOptions" was mapped to the KUMA field DeviceCustomString1. Event field "Event.EventData.Data.TicketEncryptionType" was mapped to the KUMA field DeviceCustomString3.</li>
            <li>Extra normalizer "4771" was changed. Event field "Event.EventData.Data.PreAuthType" was mapped to the KUMA field DeviceCustomString5. Event field "Event.EventData.Data.TicketOptions" was mapped to the KUMA field DeviceCustomString1.</li>
            <li>Extra normalizer "4662" was changed. Event field "Event.EventData.Data.AdditionalInfo" was mapped to the KUMA field DeviceCustomString3. Event field "Event.EventData.Data.AdditionalInfo2" was mapped to the KUMA field DeviceCustomString4.</li>
            <li>Extra normalizer "5140" was changed. Event field "Event.EventData.Data.ShareLocalPath" was mapped to the KUMA field FilePath.</li>
			<li>New extra normalizer "TaskContentNew" was added.</li>
		</ul>		
	</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 15</b><br>
	Change list:
		<ul>
			<li>Support of some events generated by MsiInstaller and MSExchange was added.</li>
			<li>Event enrichment was added to the extra "normalizer 33205 data KV part" to the field "Event.EventData.Data".</li>
			<li>Extra normalizer 4624 was changed. Label of the field FlexString1 was changed from "Subject logon ID" to "Target logon ID".</li>
			<li>Extra normalizer 4769 was changed. Event field Event.EventData.Data.TransmittedServices was mapped to the KUMA field DeviceCustomString2.</li>
			<li>Extra normalizer 4768 was changed. Event field Event.EventData.Data.TransmittedServices was mapped to the KUMA field DeviceCustomString2.</li>
			<li>Extra normalizers 4898, 4887 were changed. Event.System.Correlation.ActivityID was mapped to the KUMA field DeviceCustomString5.</li>
			<li>Extra normalizer 4738 was changed. Event field Event.EventData.Data.UserPrincipalName was mapped to the KUMA field DeviceCustomString3.</li>
			<li>New extra normalizers were added: 7038, 7002, "7003 7037", 7005, 7006, 7009, "7016, 7017, 7018, 7019, 7020, 7021, 7022", 7026, 7028, 7030, 7032, 7033, 7034, 7035, 7036, 7039, 7040, 7041, 7042, 7043, "Other system events", "MsiInstaller", "1034 1033 1035", 1038, 1029, 1042, 1013, "11707 11728 11724", 1022, 1025, 1026, 1027, 1005, 1014, 1028, "MSExchange", "9000", "9017", "9018", "2004 MSExchange OAuth", "2080", "2080 Event.RenderingInfo.Message regex part", "12018", "IISInfoCtrs", "1001", "Microsoft-Windows-RestartManager", "10000", "Microsoft-Windows-Security-SPP", "16384".</li>
			<li>Dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was changed. Event names were removed for event IDs 7000, 7001, 7009, 7011, 7023, 7031, 7034, 7043, 7045 from the dictionary.</li>
			<li>Extra normalizer "7000 7009 7023 7034" was renamed to "7000, 7023, 7024".</li>
			<li>Extra normalizer condition was updated. Event enrichments were added.</li>
			<li>Extra normalizer "7001" was changed. Event enrichments were added.</li>
			<li>Extra normalizer "7011" was changed. Event enrichment was added.</li>
			<li>Extra normalizer "7031" was changed. Event enrichments were added. Mapping of event field Event.EventData.Data.param3, Event.EventData.Data.param4 were removed. Mapping of the event field Event.EventData.Data.param5 was changed from KUMA field DeviceCustomString5 to DeviceCustomString3.</li>
			<li>Extra normalizer "7038" was changed. Event enrichments were added.</li>
			<li>Extra normalizer "7043" was changed. Event enrichment was added.</li>
			<li>Extra normalizer 7045 was changed. Extra normalizer "7045" was moved from the "System" parent extra extra normalizer to "Service Control Manager" parent extra normalizer. Mapping was changed. Field Event.EventData.Data.ImagePath was mapped from the KUMA field FileName to the KUMA field FilePath.</li>
			<li>Event enrichment with dictionary "[OOTB] Windows. Service Control Manager EventIDs and Event Names mapping" was added in the extra normalizer "Service Control Manager".</li>
			<li>Extra normalizers 107, 1074, 109, 42, "12 system", "13 system", 104, "5827 5829 5830", "5828 5831" were moved from the "System" parent extra extra normalizer to "Other system events" parent extra normalizer.</li>
			<li>Event enrichment with dictionary was removed from the "System" extra normalizer.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 14</b><br>
	Change list:
		<ul>
			<li>New extra normalizers were added: 33205, "33205 data KV part", "33205 additional_information xml parsing", 4902.</li>
			<li>New event names for evend ID 33205 was added to the dictionary "[OOTB] Windows. EventIDs and Event Names mapping".</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 13</b><br>
	Change list:
		<ul>
			<li>Filter of the extra normalizer "Extra 5136" was fixed (space symbol was removed).</li>
			<li>Dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was edited. Symbol " was removed from the description of event with ID 1317. Event name was added for event with ID 1535.</li>
			<li>Normalizer "4701" was edited. Mapping of event field "Task.version" was changed from KUMA field DeviceVersion to DeviceCustomFloatingPoint1. Mapping of event field "Task.Settings.StopIfGoingOnBatteries" as removed from event field DeviceCustomString5. Mapping of event field "Task.Actions.Exec.Aruments" was mapped to the KUMA field DeviceCustomString5. Mapping of event field "Task.Settings.DisallowStartIfOnBatteries" was removed from event field DeviceCustomString4. Mapping of event field "Task.Actions.Exec.Command" was mapped from the KUMA field DeviceAction to the KUMA field DeviceCustomString4. Mapping of event field "Task.Settings.ExecutionTimeLimit" was removed from event field DeviceCustomString2. Mapping of event field "Task.RegistrationInfo.URI" was changed fom KUMA field SourceProcessId to the KUMA field DeviceCustomString2. Mapping of event field "Task.Settings.MultipleInstancesPolicy" was removed from event field DeviceCustomString3. Mapping of event field "Task.RegistrationInfo.Author" was changed fom KUMA field SourceProcessName to the KUMA field DeviceCustomString3. Mapping of event field "Task.Settings.StartWhenAvailable" was removed from event field DeviceCustomString6.</li>
			<li>Extra normalizer "6144,6145" was changed. Event field "Event.EventData.Data.ErrorCode" was mapped to the KUMA field Reason. Event field "Event.EventData.Data.GPOList" was mapped from the KUMA field "DeviceCustomString1" to the KUMA field "S.GPOList". Event enrichment was added to the KUMA field "DeviceCustomString1"(data from the S.GPOList field copied to the KUMA field DeviceCustomString1). Event enrichment with constant was added to the KUMA field DeviceCustomString1Label.</li>
			<li>Extra normalizer "5145" was changed. Mutation was removed from the event field "Event.EventData.Data.ShareName". New enrichment was added. Data from KUMA field DeviceCustomString2 was duplicated to the KUMA field DeviceCustomString6.</li>
			<li>New enrichment with template was added to the KUMA field SourceHostName in the extra normalizer "5156".</li>
			<li>Extra normalizer 4662 was edited. Mapping of event field "Event.EventData.Data.ObjectType" was removed from the KUMA field DeviceCustomString5.</li>
			<li>Event enrichment (template) in the KUMA field DeviceCustomString6 was updated in the extra normalizer "User Account Management".</li>
			<li>New extra normalizers were added "1535", "4886", "4887", "4900", "4882", "4899", "5827 5829 5830", "5828 5831".</li>
			<li>Extra normalizer was edited "4898". Event field "Event.EventData.Data.TemplateInternalName" was mapped to the KUMA field FileName. Event field "Event.EventData.Data.TemplateOID" was mapped to the KUMA field DeviceCustomString4.</li>
			<li>Extra normalizer "4882 4883 4884 4885" was renamed to "4883 4884 4885". Event ID 4882 was removed from the extra normalizer "4883 4884 4885" condition.</li>
			<li>Extra normalizer "5168" was changed. Event name "Event.EventData.Data.ConfiguredNames" was mapped to the KUMA field DeviceCustomString1. Event field "Event.EventData.Data.SpnName" was mapped to the KUMA field DeviceCustomString2. Event field "Event.EventData.Data.ErrorCode" was mapped from the KUMA field DeviceCustomString4 to the KUMA field Reason. Event field "Event.EventData.Data.IpAddresses" was mapped to the KUMA field DeviceCustomString4. Event field "Event.EventData.Data.SubjectUserSid" was mapped from the KUMA field SourceUserName to the KUMA field SourceUserID. Event field "Event.EventData.Data.SubjectLogonId" was mapped from the KUMA field SourceUserID to the KUMA field FlexString1.</li>
			<li>Additional regular expression was added to the extra normalizer "4103 ContextInfo regexp".</li>
			<li>Extra normalizer "System" was edited. Value of parameter "Use raw event" was changed to "yes".</li>
			<li>New table "[OOTB] Windows. GroupPolicy EventIDs and Event Names mapping" with event ID and event names was added.</li>
			<li>Description of the dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was updated.</li>
			<li>Description of the dictionary "[OOTB] Windows Hyper-V EventID-Name" was updated.</li>
			<li>Description of the dictionary "[OOTB] Windows. Validate Cred. Error Codes" was updated.</li>
			<li>Description of the dictionary "[OOTB] Windows_Terminal Server. EventIDs and Event Names mapping" was updated.</li>
			<li>Description of the dictionary "[OOTB] Windows.Codes (4719)" was updated.</li>
			<li>Support of some event types from the Microsoft Windows Group Policy operational log (Applications and Services Logs – Microsoft – Windows - Group Policy - Operational) was added.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 12</b><br>
	Change list:
		<ul>
			<li>Extra normalizer "Windows Filtering Platform actions" was changed. Mutation with replace function was added to the KUMA field "DeviceDirection". Event enrichment was removed from the field "FileType". Event enrichment witch dictionary "[OOTB] IANAProtocolNumbers" was added to the KUMA field "TransportProtocol". Event field "Event.EventData.Data.ProcessID" was added to the KUMA field "DeviceCustomString3". Event ID "5156" was removed from extra normalizer condition.</li>
			<li>Extra normalizer "5159" was changed. Event field "Event.EventData.Data.Protocol" was mapped from KUMA field "ApplicationProtocol" to the KUMA field "TransportProtocol". Target field of event enrichment with dictionary "[OOTB] IANAProtocolNumbers" was changed from KUMA field "ApplicationProtocol" to KUMA field "TransportProtocol".</li>
			<li>Extra normalizer "4103" was changed. Event field "Event.EventData.Data.Payload" was mapped from the KUMA field "Message" to extended field "S.ScriptBlockText". Event enrichment was added to the KUMA field “Message”. Event mutation was added to the event field "Event.EventData.Data.Payload" (replace symbols "\r\n" with "").</li>
			<li>Extra normalizer "4103 ContextInfo regexp" was changed. Event mutation was added to the event field " Event.EventData.Data.ContextInfo" (replace symbols "\r\n" with "").</li>
			<li>Extra normalizer "User Account Management" was changed. Labels were added to the KUMA fields "DeviceCustomString3", "DeviceCustomString2", "DeviceCustomString1", "FlexString2". Event field "Event.EventData.Data.LogonHours" was mapped from the KUMA field "SourceMacAddress" to the KUMA field "OldFilePermission". Event field "Event.EventData.Data.AccountExpires" was mapped from the KUMA field "DeviceCustomIpv6Address1" to the KUMA field "FilePermission". Event field "Event.EventData.Data.SidHistory" was mapped from the KUMA field "DestinationMacAddress" to the KUMA field "OldFileType". Event field "Event.EventData.Data.UserAccountControl" was mapped from the KUMA field " DeviceCustomIpv6Address4" to the KUMA field "OldFileId". Event field "Event.EventData.Data.UserParameters" was mapped from the KUMA field "DeviceMacAddress" to the KUMA field "FileId". Event field "Event.EventData.Data.AllowedToDelegateTo" was mapped from the KUMA field "DeviceCustomIPv6Address3" to the KUMA field "FileType". Event field "Event.EventData.Data.PrimaryGroupId" was mapped from the KUMA field "DeviceCustomIpv6Address2" was mapped to the KUMA field "DeviceCustomNumber1".</li>
			<li>New extra normalizer "5156" was added.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 11</b><br>
	Change list:
		<ul>
			<li>Support of some events in xml format from the event log «Microsoft - Windows - DNS-Server – Audit» was added.</li>
			<li>New extra normalizers were added: «Microsoft-Windows-DNSServer», «DNS Server 519 520 521», «DNS Server 515 516», «DNS Server 518», «DNS Server 561», «DNS Server 517», «DNS Server 546», «DNS Server 514», «DNS Server 536», «DNS Server 537», «DNS Server 573», «DNS Server 541».</li>
			<li>New dictionary «[OOTB] Microsoft DNS Server. EventIDs and Event Names» was added.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 10</b><br>
	Change list:
		<ul>
			<li>Support of some event types (event ID 7000, 7009, 7023, 7034, 7031, 7011, 7001, 7043) generated by "Service Control Manager" was added.</li>
			<li>New extra normalizers were added: "Service Control Manager", "7000 7009 7023 7034", "7031", "7011", "7001", "7043".</li>
			<li>Event names for events with ID 7009, 7023, 7034, 7031, 7011, 7001, 7043 were added to the dictionary "[OOTB] Windows. EventIDs and Event Names mapping".</li>
			<li>New regular expression was added to the extra normalizer "4103 ContextInfo regexp".</li>
			<li>Event enrichment with dictionary was removed from the extra normalizer "4738".</li>
			<li>New event enrichments were added to the "4738" (replace, replace with regexp).</li>
			<li>Extra normalizer "4742" was removed.</li>
			<li>Event enrichment to the KUMA field "DeviceAction" in the extra normalizer "4657" was changed. Text of event enrichment "New Registry Value created" was replaced with text "New registry value created".  Text of event enrichment "Existing Registry Value modified" was replaced with text "Existing registry value modified". Text of event enrichment "Registry Value Deleted" was replaced with text "Registry value deleted".</li>
			<li>New event enrichment was added in the extra normalizer "Extra 5136". Data from the KUMA field "DeviceCustomString4" copied to the KUMA field "DeviceAction".</li>
			<li>Field mapping was changed in the extra normalizer "A computer account management". Event field "Event.EventData.Data.TargetDomainName" mapped from the KUMA field "DeviceCustomString6" to the KUMA field "DestinationNtDomain". Event field "Event.EventData.Data.TargetUserName" was mapped from the KUMA field "DeviceCustomString1" to the KUMA field to the KUMA field "DestinationUserName". Event field "Event.EventData.Data.NewUacValue" was mapped to the KUMA field "DeviceCustomString5". Event field "Event.EventData.Data.OldUacValue" was mapped to the KUMA field "DeviceCustomString4". Event field "Event.EventData.Data.UserAccountControl"was mapped to the KUMA field "DeviceCustomString6". Event field "Event.EventData.Data.HomeDirectory" was mapped to the KUMA field "FileName". Event field "Event.EventData.Data.HomePath" was mapped to the KUMA field "FilePath". Event field "Event.EventData.Data.PasswordLastSet" was mapped to the KUMA field "DeviceCustomDate1".</li>
			<li>Event enrichment was changed in the extra normalizer "A computer account management". Event enrichment with constant was removed from the KUMA field "DeviceCustomString6Label". Event enrichment with template was removed from the KUMA field "DeviceCustomString6"</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 9</b><br>
	Change list:
		<ul>
			<li>In the extra normalizer "Terminal Server" filter parameters were updated. Logical condition was changed to "OR", new condition "Microsoft-Windows-TerminalServices-LocalSessionManager" was added.</li>
			<li>New extra normalizer "23 (TerminalServer)" was added.</li>
			<li>Normalizer structure optimization. Extra normalizers 21(TerminalServer), 22(TerminalServer), 24(TerminalServer), 25(TerminalServer) were combined to extra normalizer "21 22 24 25(TerminalServer)". </li>
			<li>Parameter "XML Atributes" was disabled in the extra normalizer "1149 (TerminalServer)".</li>
			<li>Event name was added for the event with ID 23 (TerminalServer) to the dictionary "22(TerminalServer)".</li>
			<li>Event enrichment with constant to the KUMA field "Message" was updated in the extra normalizers "21 22 24 25(TerminalServer)", "39 (TerminalServer), "1149 (TerminalServer)".</li>
			<li>Event enrichment to the KUMA field "OldFileType" was removed from the extra normalizer "Terminal Server".</li>
			<li>Regular expression in the event enrichment to the KUMA field "DestinationUserName" in the extra normalizer "21 22 24 25(TerminalServer)" was updated.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 8</b><br>
	Change list:
		<ul>
			<li>Extra normalizer "4104" was changed. Event enrichment from the KUMA field "Message" to the KUMA field "FileName" was deleted. Event field "Event.EventData.Data.ScriptBlockText" was mapped to the KUMA extended event schema field "S.ScriptBlockText".</li>
			<li>New extra normalizers were added: "Microsoft-Windows-SMBServer", "SMBServer 3000", "SMBServer 3000 RenderingInfo.Message parsing".</li>
			<li>Field mapping was changed in the extra normalizer "5145" . Event field "Event.EventData.Data.RelativeTargetName" was mapped from the KUMA field "DestinationServiceName" to the KUMA field "FileName".</li>
			<li>Mapping in the extra normalizer "4624" was changed. Event field "Event.EventData.Data.LmPackageName" was mapped to the KUMA field "FlexString2".</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 7</b><br>
	Change list:
		<ul>
			<li>Support of some event types from the event log "Microsoft Windows PowerShell" were added.</li>
			<li>New extra normalizers were added: "Windows PowerShell journal", "Windows PowerShell 400 403", "Windows PowerShell 400 403 regexp", "Windows PowerShell 800", "Windows PowerShell 800 regexp", "Windows PowerShell 600", "Windows PowerShell 600 regexp", "4610".</li>
			<li>Mapping in the main normalizer was changed. Mapping of the event field "Event.EventData.Data.AuthenticationPackageName" was removed from the KUMA field "DeviceCustomString5".</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 6</b><br>
	Change list:
		<ul>
			<li>Parsing of some events generated by the Microsoft Skype for business was added.</li>
			<li>Parsing of the event ID 4898 from the Windows Security log was added. New extra normalizer "4898" was added.</li>
			<li>Field mapping was changed in the extra normalizers 4618, 4626, 4634, 4647, "WS or ScreenSaver Operations". Event field "Event.EventData.Data.TargetLogonId" was mapped to the KUMA field "FlexString2".</li>
			<li>Field mapping was changed in the extra normalizers 6416, 5381, 4826, 5382, 5379. Event field "Event.EventData.Data.SubjectUserSid" was mapped to the KUMA field "SourceUserID". Event field "Event.EventData.Data.SubjectLogonId" was mapped to the KUMA field "FlexString1".</li>
			<li>Field mapping was changed in the extra normalizers 4719, 5051, "5888 5889 5890". Event field "Event.EventData.Data.SubjectUserSid" was mapped to the KUMA field "DestinationUserID".</li>
			<li>Dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was updated. Name of the event with ID 6272 was changed to "Network Policy Server granted access to a user".</li>
			<li>Field mapping was changed in main normalizer. Event field "Event.EventData.Data.IpAddress" was mapped from the KUMA field "DeviceCustomIPv6Address2" to the KUMA field "SourceAddress".</li>
			<li>Event enrichment was changed in main normalizer. Source of the enrichment with regular expression to the KUMA field "SourceAddress" was changed from the KUMA field "DeviceCustomIPv6Address2" to the KUMA field "SourceAddress".</li>
			<li>Field mapping was changed in the extra normalizers 4821, 5145, 4771, 4769, 4820, 5140, 4648, 4625. Event field "Event.EventData.Data.IpAddress" mapping was removed from the KUMA field "SourceAddress".</li>
			<li>Field mapping was changed in the extra normalizers 5145, 4771, 4769, 5140, 4624, 4770, 4768. Event field "Event.EventData.Data.IpAddress" mapping was removed from the KUMA field "DeviceCustomIPv6Address2".</li>
			<li>Field mapping was changed in the extra normalizers 4771, 4770. Event field "Event.EventData.Data.IpAddress" mapping was removed from the KUMA field "DeviceCustomString3".</li>
			<li>Field mapping was changed in the extra normalizers "KRB ticket request failed". Event field "Event.EventData.Data.IpAddress" mapping was removed from the KUMA field "DeviceCustomIPv6Address1".</li>
			<li>Field mapping was changed in the extra normalizers "Windows Filtering Platform actions". Event field "Event.EventData.Data.SourceAddress" mapping was removed from the KUMA field "DeviceCustomIPv6Address2". Event field "Event.EventData.Data.DestAddress" mapping was removed from the KUMA field "DeviceCustomIPv6Address3".</li>
			<li>Event enrichments were changed in the extra normalizers 5, 18, 15, 10, 7, 11, 13, 17, 22, 23, 25. Type of event enrichment to the KUMA field "FileName" was changed from the "replacewithregexp" to the "regexp". Regular expressions in the event enrichments to the KUMA fields "FileName" and "FilePath" were fixed.</li>
			<li>Event enrichments were changed in the extra normalizer 11. Type of event enrichment to the KUMA field "OldFileName" was changed from the "replacewithregexp" to the "regexp". Regular expressions in the event enrichments to the KUMA fields "OldFileName" and "OldFilePath" were fixed.</li>
		</ul>
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 5</b><br>
	Change list:<br>
	Extra normalizer 1102 was updated:
		<ul>
			<li>Event field "Event.UserData.LogFileCleared.SubjectDomainName" was mapped to the SourceNtDomaint KUMA field.</li>
			<li>Event field "Event.UserData.LogFileCleared.SubjectUserName" was mapped to the SourceUserName KUMA field.</li>
		</ul>
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 4</b><br>
	Change list:
	<ul>
		<li>Type of the main normalizer was changed from "regexp" to "xml".</li>
		<li>Removed support of MS SQL events 33205, 18453, 18456. Some of this events was not in the xml format.</li>
		<li>Extra normalizer "2889" was changed. Event mapping to the KUMA field DeviceCustomString2 was changed from "Event.EventData.Data0" to "Event.EventData.Data.0".</li>
		<li>Extra normalizer "1644" was changed. Event mapping of the event field "Event.EventData.Data.16" was changed from the KUMA field SourceHostName to the SourceUserName.</li>
	</ul>
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 3</b><br>
		In the extra normalizer 424 value of the parameter "Use raw event" was changed to "yes".
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 2</b><br>
	Change list:
	<ul>
		<li>Normalizer name was changed to the "[OOTB] Microsoft Products for KUMA 3".</li>
		<li>Type of the main normalizer was changed from "xml" to "regexp".</li>
		<li>Parsing of the events from the Microsoft Hyper-V was added.</li>
		<li>New dictionary "[OOTB] Windows Hyper-V EventID-Name" was added.</li>
		<li>Normalizer structure optimization. Extra normalizers were combined with other extra normalizers: 4106, 4660, 4661, 4823, 4866, 4867, 4868, 4869, 4870, 4871, 4873,4874, 4875, 4876, 4877, 4882, 4883, 4884, 4885, 4890, 4891, 4892, 4896, 4902, 4909, 5056, 5059, 5888, 5889, 5890, 6272, 6278, 6279, 6280, "22 (TerminalServer)", "24 (TerminalServer)", "25 (TerminalServer)".</li>		
		<li>Event field mapping in the main normalizer was fixed. Event field name was changed from the "Event.System.Keyword" to the "Event.System.Keywords" (this field mapped the KUMA field EventOutcome).</li>
		
		<li>Extra normalizer "4663" was updated:
			<ul>
				<li>Event field "Event.System.Task" was mapped to the KUMA field DeviceCustomString6.</li>
				<li>Event enrichment with dictionary "[OOTB] Windows. Task category codes" was added to the field DeviceCustomString6.</li>
				<li>Enrichment with a dictionary "[OOTB] Windows.Codes (4663)" in extra normalizer 4663 (in the field DeviceCustomString1) was replaced with event enrichment (replace operation).</li>
			</ul>
		</li>
		<li>New dictionary "[OOTB] Windows. Task category codes" was added. The dictionary contains the IDs of the Task Category parameter of Windows OS audit events and their corresponding names.</li>
		
		<li>Extra normalizer "4103" was updated:
		<ul>
			<li>Parsing of the event field "Event.EventData.Data.ContextInfo" was moved from the extra normalizer "4103" to the extra normalizer "4103 ContextInfo regexp".</li>
			<li>New event mapping was added in the extra normalizer 4103 to the KUMA fields SourceUserName, DestinationUserName, FlexString2, DeviceCustomString4.</li>
		</ul>
		</li>		
		
		<li>Extra normalizer "4662" was updated:
			<ul>
				<li>Event field "Event.EventData.Data.AccessMask" was mapped from the KUMA field DeviceCustomString1 to the KUMA field DeviceCustomString2.</li>
				<li>Event enrichment with dictionary of the KUMA field FilePermission was removed.</li>
				<li>Event field "Event.EventData.Data.Properties" was additional mapped to the KUMA field DeviceCustomString6.</li>
			</ul>
		</li>
		<li>Dictionary "[OOTB] Windows.Codes (4662)" was updated:
			<ul>
				<li>Additional operation codes were added.</li>
				<li>Description of the dictionary "[OOTB] Windows.Codes (4662)" was updated.</li>
			</ul>
		</li>
		
		<li>Extra normalizer "1" was updated:
			<ul>
				<li>Event field "Event.EventData.Data.Image" was mapped from the KUMA field FilePath to the KUMA field OldFilePath.</li>
				<li>Event enrichment with regular expressions were mapped to the KUMA fields OldFileName and OldFilePath. Regular expressions were updated.</li>
			</ul>
		</li>
		
		<li>Extra normalizer "7" was updated:
			<ul>
				<li>Event enrichment with regular expressions were added for the fields OldFileName and OldFilePath.</li>
				<li>Regular expressions that used in event enrichment in the KUMA fields FileName and FilePath were updated.</li>
			</ul>
		</li>
		
		<li>Extra normalizer "4104" was updated:
			<ul>
				<li>Event field "Event.EventData.Data.ScriptBlockText" mapping to the KUMA field Message was fixed.</li>
				<li>Event field "Event.EventData.Data.ScriptBlockId" mapping to the KUMA field DeviceCustomString2 was removed. This field still mapped to the KUMA field FileId.</li>
			</ul>
		</li>
		
		<li>Option "Keep extra fields" was disabled for the extra normalizers: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 255.</li>
						
		<li>Event field Event.EventData.Data.SubjectLogonId was added to the KUMA field FlexSting1 in the extra normalizers: 4658, 4618, 4870, 4877, 5377, 5058, 4871, 4869, 4661, 4662, 4865, 5140, 4818, 4918, 4659, 4904, 5122, 5123, 4672, 4875, 4696, 4615, 5633, 4819, 5888, 5889, 4905, 4670, 4866, 4912, 4890, 4891, "Kerberos or DRA group for EFS or The audit policy (SACL) on an object policy was changed.", 5632, 4626, 4873, 4907, 5890, 4876, 5376, 4884, 4867, 4892, 5378, 4657, 4664, 4882, 5059, 4896, 4624, 4691, 4874, 4660, 4868, 5039.</li>
		<li>Event field Event.EventData.Data.SubjectUserSid was mapped to the KUMA field DestinationUserID in the extra normalizers: 4615, 4657, 4658, 4662, 4670, 4672, 4691, 4818, 4819, 4904, 4905, 4907, 4912, 4913, 5039, 5058, 5376, 5377, 5378.</li>
		<li>Additional field mapping was added in the extra normalizer 5632: "Event.EventData.Data.SSID" to the KUMA field DeviceCustomString3, "Event.EventData.Data.LocalMac" to the KUMA field DeviceMacAddress, "Event.EventData.Data.PeerMac" to the KUMA field DestinationMacAddress. Field mapping was changed in the extra normalizer: event field "Event.EventData.Data.ReasonText" mapped to the KUMA field DeviceCustomString4, event field "Event.EventData.Data.ErrorCode" mapped to the KUMA field DeviceCustomString5.</li>
				
		<li>Change list for the Microsoft SQL Sever events:
		<ul>
			<li>Parsing of the events with ID 18456, 33205, 18453 was added.</li>
			<li>Names for the events with ID 33205 and 18453 was added to the dictionary "[OOTB] Microsoft SQL Server codes".</li>
			<li>Event mapping was changed for event with ID 18456. Event field Event.EventData.Data.2 to the KUMA field DeviceHostName.</li>
		</ul>
		</li>
		
		<li>Option "Keep extra fields" was disabled for the extra normalizer "AD FS".</li>
		<li>Other minor improvements.</li>
	</ul>
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 1</b><br>
	This is the first version of the package "[OOTB] Microsoft Products" for the KUMA 3.<br>
	Change list:<br>
	Parsing of additional Microsoft products events have been added to the normalizer:
	<ul>
		<li>Microsoft Active Directory Federation Service (AD FS)</li>
		<li>Microsoft Active Directory Domain Service (AD DS)</li>
		<li>Microsoft SQL Server</li>
	</ul>
	Other minor improvements.
  	</p>

</body>
</html>
