Cisco Secure Email Gateway

@timestamp

Event timestamp.

date

cisco_secure_email_gateway.log.5xx_hard_bounces

5XX Hard Bounces.

long

cisco_secure_email_gateway.log.act

keyword

cisco_secure_email_gateway.log.action

keyword

cisco_secure_email_gateway.log.active_recipients

Active Recipients.

long

cisco_secure_email_gateway.log.address

ip

cisco_secure_email_gateway.log.alert_category

keyword

cisco_secure_email_gateway.log.antivirus_result

keyword

cisco_secure_email_gateway.log.appliance.product

keyword

cisco_secure_email_gateway.log.appliance.vendor

keyword

cisco_secure_email_gateway.log.appliance.version

keyword

cisco_secure_email_gateway.log.attempted_recipients

Attempted Recipients.

long

cisco_secure_email_gateway.log.backoff

The number of (x) seconds before the email gateway needs to wait before it makes an attempt to upload the file to the file analysis server. This occurs when the email gateway reaches the daily upload limit.

long

cisco_secure_email_gateway.log.bmld

long

cisco_secure_email_gateway.log.bounce_type

Bounced or delayed (for example, hard or soft-bounce).

keyword

cisco_secure_email_gateway.log.cache.exceptions

Cache Exceptions.

long

cisco_secure_email_gateway.log.cache.expired

Cache Expired.

long

cisco_secure_email_gateway.log.cache.hits

Cache Hits.

long

cisco_secure_email_gateway.log.cache.misses

Cache Misses.

long

cisco_secure_email_gateway.log.case_id

keyword

cisco_secure_email_gateway.log.case_ld

Percent CPU used by CASE scanning.

long

cisco_secure_email_gateway.log.category.name

keyword

cisco_secure_email_gateway.log.cef_format_version

keyword

cisco_secure_email_gateway.log.cfp1

double

cisco_secure_email_gateway.log.cfp1_label

keyword

cisco_secure_email_gateway.log.cmrkld

long

cisco_secure_email_gateway.log.command

text

cisco_secure_email_gateway.log.commit_changes

text

cisco_secure_email_gateway.log.completed_recipients

Completed Recipients.

long

cisco_secure_email_gateway.log.connection

keyword

cisco_secure_email_gateway.log.connection_status

keyword

cisco_secure_email_gateway.log.cpu.elapsed_time

Elapsed time since the application started.

long

cisco_secure_email_gateway.log.cpu.total_time

Total CPU time used by the application.

long

cisco_secure_email_gateway.log.cpu.utilization

CPU Utilization.

long

cisco_secure_email_gateway.log.crt.delivery_connection_id

Delivery Connection ID (DCID).

keyword

cisco_secure_email_gateway.log.crt.injection_connection_id

Injection Connection ID (ICID).

keyword

cisco_secure_email_gateway.log.cs1

keyword

cisco_secure_email_gateway.log.cs1_label

keyword

cisco_secure_email_gateway.log.cs2

keyword

cisco_secure_email_gateway.log.cs2_label

keyword

cisco_secure_email_gateway.log.cs3

keyword

cisco_secure_email_gateway.log.cs3_label

keyword

cisco_secure_email_gateway.log.cs4

keyword

cisco_secure_email_gateway.log.cs4_label

keyword

cisco_secure_email_gateway.log.cs5

keyword

cisco_secure_email_gateway.log.cs5_label

keyword

cisco_secure_email_gateway.log.cs6

keyword

cisco_secure_email_gateway.log.cs6_label

keyword

cisco_secure_email_gateway.log.current.inbound_connections

Current Inbound Connections.

long

cisco_secure_email_gateway.log.current.outbound_connections

Current Outbound Connections.

long

cisco_secure_email_gateway.log.data.ip

ip

cisco_secure_email_gateway.log.deleted_recipients

Deleted Recipients.

long

cisco_secure_email_gateway.log.delivered_recipients

Delivered Recipients.

long

cisco_secure_email_gateway.log.delivery_connection_id

Delivery Connection ID. This is a numerical identifier for an individual SMTP connection to another server, for delivery of 1 to thousands of messages, each with some or all of their RIDs being delivered in a single message transmission.

keyword

cisco_secure_email_gateway.log.description

text

cisco_secure_email_gateway.log.destination

text

cisco_secure_email_gateway.log.destination_memory

Number of destination objects in memory.

long

cisco_secure_email_gateway.log.details

Additional information.

text

cisco_secure_email_gateway.log.device_direction

keyword

cisco_secure_email_gateway.log.disk_io

Disk I/O Utilization.

long

cisco_secure_email_gateway.log.disposition

The file reputation disposition values are: MALICIOUS CLEAN FILE UNKNOWN - When the reputation score is zero. VERDICT UNKNOWN - When the disposition is FILE UNKNOWN and score is non-zero. LOW RISK - When no dynamic content is found in a file after file analysis, the verdict is Low Risk. The file is not sent for file analysis, and the message continues through the email pipeline.

keyword

cisco_secure_email_gateway.log.dkim_aligned

Protocol DKIM aligned is true or false.

boolean

cisco_secure_email_gateway.log.dns.hard_bounces

DNS Hard Bounces.

long

cisco_secure_email_gateway.log.dns.requests

DNS Requests.

long

cisco_secure_email_gateway.log.domain

keyword

cisco_secure_email_gateway.log.dropped_messages

Dropped Messages.

long

cisco_secure_email_gateway.log.email

keyword

cisco_secure_email_gateway.log.email_participants

All the participants in the email.

keyword

cisco_secure_email_gateway.log.email_tracker_header

Header consisting of (but not typically displaying) critical information for efficient email tracking and delivery.

keyword

cisco_secure_email_gateway.log.encrypted_hash

keyword

cisco_secure_email_gateway.log.encryption_queue

Messages in the Encryption Queue.

long

cisco_secure_email_gateway.log.engine

Engine used by the interim verdict.

keyword

cisco_secure_email_gateway.log.env

keyword

cisco_secure_email_gateway.log.error_code

keyword

cisco_secure_email_gateway.log.esa.amp_verdict

keyword

cisco_secure_email_gateway.log.esa.as_verdict

keyword

cisco_secure_email_gateway.log.esa.attachment_details

text

cisco_secure_email_gateway.log.esa.av_verdict

keyword

cisco_secure_email_gateway.log.esa.content_filter_verdict

keyword

cisco_secure_email_gateway.log.esa.dane.host

keyword

cisco_secure_email_gateway.log.esa.dane.ip

ip

cisco_secure_email_gateway.log.esa.dane.status

keyword

cisco_secure_email_gateway.log.esa.delivery_connection_id

keyword

cisco_secure_email_gateway.log.esa.dha_source

ip

cisco_secure_email_gateway.log.esa.dkim_verdict

keyword

cisco_secure_email_gateway.log.esa.dlp_verdict

keyword

cisco_secure_email_gateway.log.esa.dmarc_verdict

keyword

cisco_secure_email_gateway.log.esa.final_action_details

text

cisco_secure_email_gateway.log.esa.friendly_from

keyword

cisco_secure_email_gateway.log.esa.graymail_verdict

keyword

cisco_secure_email_gateway.log.esa.helo.domain

keyword

cisco_secure_email_gateway.log.esa.helo.ip

ip

cisco_secure_email_gateway.log.esa.injection_connection_id

keyword

cisco_secure_email_gateway.log.esa.mail_auto_remediation_action

text

cisco_secure_email_gateway.log.esa.mail_flow_policy

keyword

cisco_secure_email_gateway.log.esa.mar_action

keyword

cisco_secure_email_gateway.log.esa.mf_verdict

keyword

cisco_secure_email_gateway.log.esa.msg_size

long

cisco_secure_email_gateway.log.esa.msg_too_big

keyword

cisco_secure_email_gateway.log.esa.msg_too_big_from_sender

boolean

cisco_secure_email_gateway.log.esa.outbreak_filter_verdict

keyword

cisco_secure_email_gateway.log.esa.rate_limited_ip

keyword

cisco_secure_email_gateway.log.esa.reply_to

keyword

cisco_secure_email_gateway.log.esa.sdr_consolidated_domain_age

text

cisco_secure_email_gateway.log.esa.sender_group

keyword

cisco_secure_email_gateway.log.esa.spf_verdict

keyword

cisco_secure_email_gateway.log.esa.tls.domain

keyword

cisco_secure_email_gateway.log.esa.tls.in.cipher

keyword

cisco_secure_email_gateway.log.esa.tls.in.connection_status

keyword

cisco_secure_email_gateway.log.esa.tls.in.protocol

keyword

cisco_secure_email_gateway.log.esa.tls.out.cipher

keyword

cisco_secure_email_gateway.log.esa.tls.out.connection_status

keyword

cisco_secure_email_gateway.log.esa.tls.out.protocol

keyword

cisco_secure_email_gateway.log.esa.url_details

text

cisco_secure_email_gateway.log.estimated.quarantine

Estimated number of messages in the Spam quarantine.

long

cisco_secure_email_gateway.log.estimated.quarantine_release_queue

Estimated number of messages in the Spam quarantine release queue.

long

cisco_secure_email_gateway.log.event.name

keyword

cisco_secure_email_gateway.log.event_class_id

keyword

cisco_secure_email_gateway.log.expired_hard_bounces

Expired Hard Bounces.

long

cisco_secure_email_gateway.log.filter_hard_bounces

Filter Hard Bounces.

long

cisco_secure_email_gateway.log.generated_bounce_recipients

Generated Bounce Recipients.

long

cisco_secure_email_gateway.log.global_unsubscribe_hits

Global Unsubscribe Hits.

long

cisco_secure_email_gateway.log.hard_bounce_recipients

Hard Bounced Recipients.

long

cisco_secure_email_gateway.log.helo

keyword

cisco_secure_email_gateway.log.host

The hostname or serial of the host sending the log. Configured in the Cisco Secure Email Gateway log subscription dashboard.

keyword

cisco_secure_email_gateway.log.injected.bytes

Total Injected Message Size in Bytes.

long

cisco_secure_email_gateway.log.injected.messages

Injected Messages.

long

cisco_secure_email_gateway.log.injected.recipients

Injected Recipients.

long

cisco_secure_email_gateway.log.injection_connection_id

Injection Connection ID. This is a numerical identifier for an individual SMTP connection to the system, over which 1 to thousands of individual messages may be sent.

keyword

cisco_secure_email_gateway.log.interface

keyword

cisco_secure_email_gateway.log.listener.name

keyword

cisco_secure_email_gateway.log.log_available

Amount of disk space available for log files.

keyword

cisco_secure_email_gateway.log.log_used

Percent of log partition used.

long

cisco_secure_email_gateway.log.malware

The name of the malware threat.

keyword

cisco_secure_email_gateway.log.maturity

Sender maturity time.

keyword

cisco_secure_email_gateway.log.max_io

Maximum disk I/O operations per second for the mail process.

long

cisco_secure_email_gateway.log.mcafee_ld

Percent CPU used by McAfee anti-virus scanning.

long

cisco_secure_email_gateway.log.message

text

cisco_secure_email_gateway.log.message_filters_verdict

keyword

cisco_secure_email_gateway.log.message_status

keyword

cisco_secure_email_gateway.log.messages_length

Total number of messages in the system.

long

cisco_secure_email_gateway.log.name

keyword

cisco_secure_email_gateway.log.network_requests

Network Requests.

long

cisco_secure_email_gateway.log.ns_name

keyword

cisco_secure_email_gateway.log.object

keyword

cisco_secure_email_gateway.log.object_attr

keyword

cisco_secure_email_gateway.log.object_category

keyword

cisco_secure_email_gateway.log.other_hard_bounces

Other Hard Bounces.

long

cisco_secure_email_gateway.log.outcome

keyword

cisco_secure_email_gateway.log.policy

Per-recipient policy defined in the inbound table.

keyword

cisco_secure_email_gateway.log.privilege

keyword

cisco_secure_email_gateway.log.qname

keyword

cisco_secure_email_gateway.log.quarantine.load

CPU load during the Quarantine process.

long

cisco_secure_email_gateway.log.quarantine.messages

Number of individual messages in policy, virus, or outbreak quarantine (messages present in multiple quarantines are counted only once).

long

cisco_secure_email_gateway.log.quarantine.queue_kilobytes_used

KBytes used by policy, virus, and outbreak quarantine messages.

long

cisco_secure_email_gateway.log.queue_kilobytes_free

Queue Kilobytes Free.

long

cisco_secure_email_gateway.log.queue_kilobytes_usd

Queue Kilobytes Used.

long

cisco_secure_email_gateway.log.ram.used

Allocated memory in bytes.

long

cisco_secure_email_gateway.log.ram.utilization

RAM Utilization.

long

cisco_secure_email_gateway.log.rank

long

cisco_secure_email_gateway.log.read_bytes

long

cisco_secure_email_gateway.log.recepients

keyword

cisco_secure_email_gateway.log.recipient_id

Recipient ID.

keyword

cisco_secure_email_gateway.log.ref_zone

keyword

cisco_secure_email_gateway.log.referrals

text

cisco_secure_email_gateway.log.rejected_recipients

Rejected Recipients.

long

cisco_secure_email_gateway.log.reporting_load

CPU load during the Reporting process.

long

cisco_secure_email_gateway.log.reputation_score

The reputation score assigned to the file by the file reputation server.

keyword

cisco_secure_email_gateway.log.resource_conservation

Resource conservation tarpit value. Acceptance of incoming mail is delayed by this number of seconds due to heavy system load.

long

cisco_secure_email_gateway.log.response

SMTP response code and message from recipient host.

text

cisco_secure_email_gateway.log.result

text

cisco_secure_email_gateway.log.retries

The number of upload attempts performed on a given file.

long

cisco_secure_email_gateway.log.risk_factor

long

cisco_secure_email_gateway.log.run_id

The numeric value (ID) assigned to the file by the file analysis server for a particular file analysis.

keyword

cisco_secure_email_gateway.log.score

The analysis score assigned to the file by the file analysis server.

long

cisco_secure_email_gateway.log.server_error_details

text

cisco_secure_email_gateway.log.session

keyword

cisco_secure_email_gateway.log.severity

keyword

cisco_secure_email_gateway.log.soft_bounced_events

Soft Bounced Events.

long

cisco_secure_email_gateway.log.sophos_ld

Percent CPU used by Sophos anti-virus scanning.

long

cisco_secure_email_gateway.log.spf_aligned

Protocol SPF aligned is true or false.

boolean

cisco_secure_email_gateway.log.spy_name

The name of the threat, if a malware is found in the file during file analysis.

keyword

cisco_secure_email_gateway.log.start_time

keyword

cisco_secure_email_gateway.log.subject

text

cisco_secure_email_gateway.log.submit.timestamp

The date and time at which the file is uploaded to the file analysis server by the email gateway.

date

cisco_secure_email_gateway.log.suspected_domains

keyword

cisco_secure_email_gateway.log.swap_usage

keyword

cisco_secure_email_gateway.log.swapped.in

Memory swapped in.

long

cisco_secure_email_gateway.log.swapped.out

Memory swapped out.

long

cisco_secure_email_gateway.log.swapped.page.in

Memory paged in.

long

cisco_secure_email_gateway.log.swapped.page.out

Memory paged out.

long

cisco_secure_email_gateway.log.threat_category

Category of the threat.

keyword

cisco_secure_email_gateway.log.threat_level

Threat level.

keyword

cisco_secure_email_gateway.log.total_ld

Total CPU consumption.

long

cisco_secure_email_gateway.log.type

keyword

cisco_secure_email_gateway.log.unattempted_recipients

Unattempted Recipients.

long

cisco_secure_email_gateway.log.update.timestamp

The date and time at which the file analysis for the file is complete.

date

cisco_secure_email_gateway.log.upload.action

The upload action value recommended by the file reputation server to take on the given file 0 - Need not send for upload. 1 - Send file for upload. Note The email gateway uploads the file when the upload action value is ‘1.’. 2 - Do not send file for upload. 3 - Send only metadata for upload.

keyword

cisco_secure_email_gateway.log.upload.priority

Upload priority values are: High - For all selected file types, except PDF file type. Low - For only PDF file types.

keyword

cisco_secure_email_gateway.log.vendor_action

keyword

cisco_secure_email_gateway.log.verdict

The file retrospective verdict value is malicious or clean.

keyword

cisco_secure_email_gateway.log.verdict_scale

Verdict is negative or positive.

keyword

cisco_secure_email_gateway.log.verdict_source

Verdict source.

keyword

cisco_secure_email_gateway.log.verified

keyword

cisco_secure_email_gateway.log.work_queue

This is the number of messages currently in the work queue.

long

cisco_secure_email_gateway.log.zone

keyword

client.ip

IP address of the client (IPv4 or IPv6).

ip

cloud.account.id

The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.

keyword

cloud.availability_zone

Availability zone in which this host is running.

keyword

cloud.image.id

Image ID for the cloud instance.

keyword

cloud.instance.id

Instance ID of the host machine.

keyword

cloud.instance.name

Instance name of the host machine.

keyword

cloud.machine.type

Machine type of the host machine.

keyword

cloud.project.id

Name of the project in Google Cloud.

keyword

cloud.provider

Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.

keyword

cloud.region

Region in which this host is running.

keyword

container.id

Unique container id.

keyword

container.image.name

Name of the image the container was built on.

keyword

container.labels

Image labels.

object

container.name

Container name.

keyword

data_stream.dataset

Data stream dataset.

constant_keyword

data_stream.namespace

Data stream namespace.

constant_keyword

data_stream.type

Data stream type.

constant_keyword

destination.ip

IP address of the destination (IPv4 or IPv6).

ip

destination.port

Port of the destination.

long

dns.question.name

The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.

keyword

ecs.version

ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices — which may conform to slightly different ECS versions — this field lets integrations adjust to the schema version of the events.

keyword

email.attachments.file.hash.sha256

SHA256 hash.

keyword

email.attachments.file.mime_type

The MIME media type of the attachment. This value will typically be extracted from the Content-Type MIME header field.

keyword

email.attachments.file.name

Name of the attachment file including the file extension.

keyword

email.attachments.file.size

Attachment file size in bytes.

long

email.content_type

Information about how the message is to be displayed. Typically a MIME type.

keyword

email.direction

The direction of the message based on the sending and receiving domains.

keyword

email.from.address

The email address of the sender, typically from the RFC 5322 From: header field.

keyword

email.message_id

Identifier from the RFC 5322 Message-ID: email header that refers to a particular email message.

wildcard

email.subject

A brief summary of the topic of the message.

keyword

email.subject.text

Multi-field of email.subject.

match_only_text

email.to.address

The email address of recipient

keyword

event.dataset

Event dataset.

constant_keyword

event.end

event.end contains the date when the event ended or when the activity was last observed.

date

event.id

Unique ID to describe the event.

keyword

event.module

Event module.

constant_keyword

event.outcome

This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. event.outcome simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of event.outcome, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with event.type:info, or any events for which an outcome does not make logical sense.

keyword

event.reason

Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where event.action captures the action from the event, event.reason describes why that action was taken. For example, a web proxy with an event.action which denied the request may also populate event.reason with the reason why (e.g. blocked site).

keyword

event.start

event.start contains the date when the event started or when the activity was first observed.

date

file.extension

File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").

keyword

file.hash.sha256

SHA256 hash.

keyword

file.name

Name of the file including the extension, without the directory.

keyword

host.architecture

Operating system architecture.

keyword

host.containerized

If the host is a container.

boolean

host.domain

Name of the domain of which the host is a member. For example, on Windows this could be the host’s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host’s LDAP provider.

keyword

host.hostname

Hostname of the host. It normally contains what the hostname command returns on the host machine.

keyword

host.id

Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name.

keyword

host.ip

Host ip addresses.

ip

host.mac

Host mac addresses.

keyword

host.name

Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.

keyword

host.os.build

OS build information.

keyword

host.os.codename

OS codename, if any.

keyword

host.os.family

OS family (such as redhat, debian, freebsd, windows).

keyword

host.os.kernel

Operating system kernel version as a raw string.

keyword

host.os.name

Operating system name, without the version.

keyword

host.os.name.text

Multi-field of host.os.name.

text

host.os.platform

Operating system platform (such centos, ubuntu, windows).

keyword

host.os.version

Operating system version as a raw string.

keyword

host.type

Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment.

keyword

http.request.method

HTTP request method. The value should retain its casing from the original event. For example, GET, get, and GeT are all considered valid values for this field.

keyword

http.response.status_code

HTTP response status code.

long

http.version

HTTP version.

keyword

input.type

Input type.

keyword

log.file.path

File path from which the log event was read / sent from.

keyword

log.level

Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in log.level. If your source doesn’t specify one, you may put your event transport’s severity here (e.g. Syslog severity). Some examples are warn, err, i, informational.

keyword

log.offset

Log offset.

long

log.source.address

Source address from which the log event was read / sent from.

keyword

log.syslog.priority

Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191.

long

network.protocol

In the OSI Model this would be the Application Layer protocol. For example, http, dns, or ssh. The field value must be normalized to lowercase for querying.

keyword

observer.vendor

Vendor name of the observer.

keyword

process.pid

Process id.

long

related.hash

All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you’re unsure what the hash algorithm is (and therefore which key name to search).

keyword

related.ip

All of the IPs seen on your event.

ip

related.user

All the user names or other user identifiers seen on the event.

keyword

source.domain

The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.

keyword

source.ip

IP address of the source (IPv4 or IPv6).

ip

source.port

Port of the source.

long

tags

List of keywords used to tag each event.

keyword

url.path

Path of the request, such as "/search".

wildcard

user.name

Short name or login of the user.

keyword

user.name.text

Multi-field of user.name.

match_only_text

user_agent.device.name

Name of the device.

keyword

user_agent.name

Name of the user agent.

keyword

user_agent.original

Unparsed user_agent string.

keyword

user_agent.original.text

Multi-field of user_agent.original.

match_only_text

user_agent.os.full

Operating system name, including the version or code name.

keyword

user_agent.os.full.text

Multi-field of user_agent.os.full.

match_only_text

user_agent.os.name

Operating system name, without the version.

keyword

user_agent.os.name.text

Multi-field of user_agent.os.name.

match_only_text

user_agent.os.version

Operating system version as a raw string.

keyword

user_agent.version

Version of the user agent.

keyword

1.24.2

Bug fix (View pull request)
Fix parsing the text_mail log lines for file uploads.

8.11.0 or higher

1.24.1

Bug fix (View pull request)
Use triple-brace Mustache templating when referencing variables in ingest pipelines.

8.11.0 or higher

1.24.0

Enhancement (View pull request)
Allow @custom pipeline access to event.original without setting preserve_original_event.

8.11.0 or higher

1.23.3

Bug fix (View pull request)
Fix parsing bug that was too greedy and fail to parse if too many colons were in log

8.7.1 or higher

1.23.2

Bug fix (View pull request)
Fix ingest pipeline warnings

8.7.1 or higher

1.23.1

Bug fix (View pull request)
Improve extraction and parsing of fields for consolidated events.

8.7.1 or higher

1.23.0

Enhancement (View pull request)
Update package spec to 3.0.3.

8.7.1 or higher

1.22.2

Bug fix (View pull request)
Fix grok if hostname appears before category.name

8.7.1 or higher

1.22.1

Enhancement (View pull request)
Changed owners

8.7.1 or higher

1.22.0

Bug fix (View pull request)
Fix handling of Consolidated Events when end and start time are missing.

Bug fix (View pull request)
Fix handling of AMP logs when filenames contain a comma.

Enhancement (View pull request)
Parse fields Analysis Source and verdict_source from AMP logs.

8.7.1 or higher

1.21.0

Enhancement (View pull request)
Handle and record log host origin filepaths.

8.7.1 or higher

1.20.1

Bug fix (View pull request)
Fix exclude_files pattern.

8.7.1 or higher

1.20.0

Bug fix (View pull request)
Fix wrong grok for mail_logs.

Enhancement (View pull request)
Add new field cisco_secure_email_gateway.log.email_participants.

8.7.1 or higher

1.19.0

Enhancement (View pull request)
ECS version updated to 8.11.0.

8.7.1 or higher

1.18.0

Enhancement (View pull request)
Support new format for mail category of logs and add pipeline for antivirus category.

8.7.1 or higher

1.17.0

Enhancement (View pull request)
Improve event.original check to avoid errors if set.

8.7.1 or higher

1.16.0

Enhancement (View pull request)
Update ingest pipeline to handle v15.

Bug fix (View pull request)
Fix handling of logs without a syslog priority.

Bug fix (View pull request)
Fix handling of event.start and event.end for consolidated events.

8.7.1 or higher

1.15.0

Enhancement (View pull request)
ECS version updated to 8.10.0.

8.7.1 or higher

1.14.0

Enhancement (View pull request)
The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added owner.type: elastic to package manifest.

8.7.1 or higher

1.13.1

Bug fix (View pull request)
Remove the unused mappings for type and filepath.

8.7.1 or higher

1.13.0

Enhancement (View pull request)
Add tags.yml file so that integration’s dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.

8.7.1 or higher

1.12.0

Enhancement (View pull request)
Update package-spec to 2.10.0.

8.7.1 or higher

1.11.2

Bug fix (View pull request)
Match both Unix and Windows-style paths, correctly.

8.7.1 or higher

1.11.1

Bug fix (View pull request)
Match both Unix and Windows-style paths

8.7.1 or higher

1.11.0

Enhancement (View pull request)
Update package to ECS 8.9.0.

8.7.1 or higher

1.10.1

Bug fix (View pull request)
Fix grok timeout on expensive consolidated events logs.

8.7.1 or higher

1.10.0

Enhancement (View pull request)
Convert dashboard to lens.

8.7.1 or higher

1.9.0

Enhancement (View pull request)
Ensure event.kind is correctly set for pipeline errors.

7.17.0 or higher
8.0.0 or higher

1.8.2

Bug fix (View pull request)
Fix grok pattern in AMP pipeline.

7.17.0 or higher
8.0.0 or higher

1.8.1

Bug fix (View pull request)
Fix consolidated event pipeline

7.17.0 or higher
8.0.0 or higher

1.8.0

Enhancement (View pull request)
Update package to ECS 8.8.0.

7.17.0 or higher
8.0.0 or higher

1.7.1

Bug fix (View pull request)
Fix grok pattern and timezone in consolidated pipeline.

7.17.0 or higher
8.0.0 or higher

1.7.0

Enhancement (View pull request)
Update package to ECS 8.7.0.

7.17.0 or higher
8.0.0 or higher

1.6.2

Bug fix (View pull request)
Fix grok pattern in AMP pipeline.

7.17.0 or higher
8.0.0 or higher

1.6.1

Enhancement (View pull request)
Added categories and/or subcategories.

7.17.0 or higher
8.0.0 or higher

1.6.0

Enhancement (View pull request)
Allow configuration of time zones.

7.17.0 or higher
8.0.0 or higher

1.5.1

Enhancement (View pull request)
Add trim processor to remove white spaces in message.

7.17.0 or higher
8.0.0 or higher

1.5.0

Enhancement (View pull request)
Update package to ECS 8.6.0.

7.17.0 or higher
8.0.0 or higher

1.4.0

Enhancement (View pull request)
Add udp_options to the UDP input.

7.17.0 or higher
8.0.0 or higher

1.3.1

Bug fix (View pull request)
Fix grok pattern to extract additional fields

7.17.0 or higher
8.0.0 or higher

1.3.0

Enhancement (View pull request)
Add an on_failure processor to the date processor.

7.17.0 or higher
8.0.0 or higher

1.2.0

Enhancement (View pull request)
Update package to ECS 8.5.0.

7.17.0 or higher
8.0.0 or higher

1.1.0

Enhancement (View pull request)
Improve error message for incorrect log filepath configuration.

Bug fix (View pull request)
Fix grok pattern for extracting log category from filepath.

7.17.0 or higher
8.0.0 or higher

1.0.1

Bug fix (View pull request)
Remove duplicate fields.

7.17.0 or higher
8.0.0 or higher

1.0.0

Enhancement (View pull request)
Make GA

7.17.0 or higher
8.0.0 or higher

0.3.0

Enhancement (View pull request)
Update package to ECS 8.4.0

—

0.2.1

Enhancement (View pull request)
Improve SSL config description and example.

—

0.2.0

Enhancement (View pull request)
Update package to ECS 8.3.0.

—

0.1.0

Enhancement (View pull request)
Initial draft of the package

—