Google Security Operations release notes

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

• AIX system (OS)
• Apache Tomcat (Web server)
• Apigee (Google Cloud Specific)
• Aqua Security (IaaS Applications)
• Aruba Switch (Network Infrastructure)
• Auth0 (Authentication log)
• AWS Cloudtrail (Cloud Log Aggregator)
• AWS GuardDuty (IDS/IPS)
• AWS RDS (Database)
• AWS Route 53 DNS (AWS Specific)
• AWS VPC Flow (AWS Specific)
• Azure AD (LDAP)
• Azure AD Sign-In (Misc Windows Specific)
• Azure VPN (VPN)
• Blue Coat Proxy (Web Proxy)
• BMC Client Management (Security)
• Checkpoint Audit (AUDIT)
• Chrome Management (Browser)
• Cisco ASA (firewall)
• Cisco Internetwork Operating System (Network Infrastructure)
• Cisco IronPort (Gateway Security)
• Cisco Meraki (Wireless)
• Cisco Router (Switches, Routers)
• Cisco Switch (Switches, Routers)
• Cisco UCM (Communication Manager)
• Cisco Unity Connection (Administration and Management)
• Citrix Netscaler (Load Balancer, Traffic Shaper, ADC)
• Claroty Continuous Threat Detection (IoT)
• Cloud Audit Logs (Google Cloud Specific)
• Cloudflare (SaaS Application)
• CommVault (Alert System)
• CrowdStrike Detection Monitoring (EDR)
• CrowdStrike Falcon (EDR)
• Darktrace (NDR)
• Dell Switch (Switches, Routers)
• Druva Backup (Security)
• Entrust nShield HSM (Hardware Security Module)
• F5 ASM (WAF)
• F5 BIGIP LTM (Load Balancer, Traffic Shaper, ADC)
• Fidelis Network (NDR)
• FireEye (Alerts)
• FireEye HX (EDR)
• FireEye NX (NDR)
• FortiGate (Firewall)
• Fortinet FortiAnalyzer (Fortinet FortiAnalyzer)
• GitGuardian Enterprise (SaaS Applications)
• Guardicore Centra (Deception Software)
• Halcyon Anti Ransomware (AV and endpoint logs)
• Hashicorp Vault (Privileged Account Activity)
• HP Linux (OS)
• IBM Mainframe Storage (Monitoring)
• IBM OpenPages (Data Security)
• IBM Security QRadar SOAR (Security)
• Imperva (WAF)
• Imperva Advanced Bot Protection (Bot Protection)
• Imperva Audit Trail (IT infrastructure)
• Infoblox DHCP (DHCP)
• INTEL471 Watcher Alerts (Data Security)
• Jamf Protect Alerts (Endpoint Security)
• Juniper (Firewall)
• KnowBe4 PhishER (Email server log types.)
• Kubernetes Node (Kubernetes Container)
• Linux Auditing System (AuditD) (OS)
• McAfee ePolicy Orchestrator (Policy Management)
• Microsoft AD (LDAP)
• Microsoft Azure Resource (Log Aggregator)
• Microsoft Defender for Identity (EDR)
• Microsoft Defender for Office 365 (Email server log types.)
• Microsoft Graph Activity Logs (AUDIT)
• Microsoft Netlogon (Authentication)
• Microsoft SQL Server (Database)
• Microsoft System Center Endpoint Protection (Malware Detection)
• Netscope Client (CASB)
• Office 365 (SaaS Application)
• Okta User Context (Identity and Access Management)
• One Identity Identity Manager (unified identity security)
• Opswat Metadefender (Threat Protection)
• Palo Alto Networks Firewall (Firewall)
• Palo Alto Prisma Cloud Alert payload (Cloud Security)
• pfSense (FIREWALL)
• Ping Federate (Authentication)
• Proofpoint Observeit (Email Server)
• ProofPoint Secure Email Relay (Email server)
• Pure Storage (Data Storage)
• Red Hat Directory Server LDAP (Identity and Access Management)
• Salesforce (SaaS Application)
• Salesforce Commerce Cloud (SaaS Application)
• Security Command Center Threat (Google Cloud Specific)
• ServiceNow CMDB (Policy Management)
• Sophos UTM (Unified Threat Management)
• Symantec Endpoint Protection (AV / Endpoint)
• Sysdig (Security)
• Tanium Threat Response (Tanium Specific)
• ThreatX WAF (WAF)
• Thycotic (Identity and Access Management)
• Tines (Data Security)
• Trend Micro (SMS, UNITY_ONE)
• Trend Micro Deep Security (AV / Endpoint)
• Trend Micro Vision One (AV and endpoint logs)
• Twingate (VPN)
• Unix system (OS)
• Velo Firewall (FIREWALL)
• VMware AirWatch (Wireless)
• Windows Defender ATP (AV / Endpoint)
• Windows Event (Endpoint)
• Windows Event (XML) (AV / Endpoint)
• Windows Local Administrator Password Solution (Local Administrator Password Solution)
• Windows Sysmon (DNS)
• Workday Audit Logs (Audit And Compliance)
• Workspace Activities (Google Cloud Specific)
• Workspace Alerts (Google Cloud Specific)
• Zscaler (Web Proxy)
• Zscaler Tunnel (N/A)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

• Adobe I/O Runtime (ADOBE_IO_RUNTIME)
• Amazon VPC Transit Gateway Flow Logs (AWS_VPC_TRANSIT_GATEWAY)
• Appsentinels (APPSENTINELS)
• Asset Panda (ASSET_PANDA)
• AstriX (ASTRIX)
• Atlan (ATLAN)
• Azure Container Registry (AZURE_CONTAINER_REGISTRY)
• Backbase Engagement Banking Platform (BACKBASE)
• Barracuda Incident Response (BARRACUDA_INCIDENTRESPONSE)
• Cloudflare Access (CLOUDFLARE_ACCESS)
• Control D DNS (CONTROL_D)
• Digicert (DIGICERT)
• Elastic Defend (ELASTIC_DEFEND)
• FingerprintJS (FINGERPRINT_JS)
• Hashicorp Nomad (HASHICORP_NOMAD)
• IBM NS1 (IBM_NS1)
• Intel 471 Malware Intelligence (INTEL471_MALWARE_INTEL)
• MacStadium (MACSTADIUM)
• N-Able N-Central RMM (N_ABLE_N_CENTRAL_RMM)
• Opentext Exstream (OPENTEXT_EXSTREAM)
• OVHcloud (OVHCLOUD)
• OX Security (OX_SECURITY)
• Pharos (PHAROS)
• ReliaQuest (RELIAQUEST)
• Rublon (RUBLON)
• Snyk Group level audit/issues logs (SNYK_ISSUES)
• SolarWinds Network Performance Monitor (SOLARWINDS_NPM)
• StackHawk (STACKHAWK)
• Tencent Cloud Firewall (TENCENT_CLOUD_FIREWALL)
• Tencent Cloud Waf (TENCENT_CLOUD_WAF)
• Tencent Cloud Workload Protection (TENCENT_CLOUD_WORKLOAD_PROTECTION)
• Trend Micro Server Protect (TRENDMICRO_SERVER_PROTECT)
• UKG (UKG)
• Uptivity (UPTIVITY)
• USBAV Koramis (USBAV_KORAMIS)
• Virtual Network Flow Logs (VIRTUAL_NETWORK_FLOW_LOGS)
• Windows Performance Monitor (MS_PERFMON)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

• Abnormal Security (Email Server)
• AIX system (OS)
• Akamai DNS (DNS)
• Akamai WAF (WAF)
• Apache (Security)
• Apigee (Google Cloud Specific)
• Apple macOS (AV / Endpoint)
• Archer Integrated Risk Management (Risk Management Solution)
• Area1 Security (Email server)
• Aruba (Wireless)
• Aruba Switch (Network Infrastructure)
• Auth0 (Authentication log)
• AWS CloudFront (CDN)
• AWS Cloudtrail (Cloud Log Aggregator)
• AWS CloudWatch (Cloud service monitoring)
• AWS EMR (AWS Specific)
• AWS VPN (VPN)
• Azure AD (LDAP)
• Azure AD Directory Audit (Audit)
• Azure Firewall (Azure Firewall Application Rule)
• Azure Key Vault logging (Audit)
• Barracuda Firewall (Firewall)
• Barracuda WAF (Firewall)
• BeyondTrust Endpoint Privilege Management (Privileged Account Activity)
• Blue Coat Proxy (Web Proxy)
• BMC Client Management (Security)
• Check Point (Firewall)
• Chrome Management (Browser)
• Cisco IronPort (Gateway Security)
• Cisco ISE (Identity and Access Management)
• Cisco Meraki (Wireless)
• Cisco Router (Switches, Routers)
• Cisco Stealthwatch (Log Aggregator)
• Cisco Switch (Switches, Routers)
• Cisco TACACS+ (Authentication)
• Cisco Umbrella Web Proxy (Web Proxy)
• Cisco WLC/WCS (Wireless)
• Citrix Netscaler (Load Balancer, Traffic Shaper, ADC)
• Claroty Continuous Threat Detection (IoT)
• Cloud Audit Logs (Google Cloud Specific)
• Cloud Data Loss Prevention (Google Cloud Specific)
• Cloud SQL (Google Cloud Specific)
• Cohesity (Backup Software)
• Corelight (NDR)
• CrowdStrike Detection Monitoring (EDR)
• CrowdStrike Falcon (EDR)
• CrushFTP (Application server)
• Darktrace (NDR)
• Delinea Secret Server (Privileged Account Activity)
• Dell EMC Data Domain (Storage system)
• Druva Backup (Security)
• Duo Activity Logs (Activity)
• Duo Administrator Logs (Authentication)
• Elastic Windows Event Log Beats (Log Aggregator)
• Ergon Informatik Airlock IAM (Application Whitelisting)
• F5 BIGIP Access Policy Manager (Access Policy Manager)
• F5 BIGIP LTM (Load Balancer, Traffic Shaper, ADC)
• FireEye HX (EDR)
• FortiGate (Firewall)
• Fortinet FortiAnalyzer (Fortinet FortiAnalyzer)
• Fortinet FortiAuthenticator (Security)
• Fortinet FortiEDR (EDR)
• Fortinet Fortimanager (Network Management and Optimization software)
• GitHub (SaaS Application)
• GMV Checker ATM Security (ATM Audit)
• Guardicore Centra (Deception Software)
• Hashicorp Vault (Privileged Account Activity)
• HP Aruba (ClearPass) (Identity and Access Management)
• IBM Cloud Activity Tracker (Security Log)
• IBM DB2 (Database)
• IBM Mainframe Storage (Monitoring)
• IBM OpenPages (Data Security)
• Imperva (WAF)
• Imperva CEF (CEF)
• Imperva DRA (Data Security)
• Infoblox (DHCP, DNS)
• Infoblox DNS (DNS)
• JAMF Pro (Mac Endpoint Management System)
• Keycloak (Identity and Access Management)
• Lacework Cloud Security (Cloud Security)
• Linux Auditing System (AuditD) (OS)
• Linux DHCP (DHCP)
• ManageEngine Log360 (Alert Log)
• McAfee ePolicy Orchestrator (Policy Management)
• Microsoft AD FS (LDAP)
• Microsoft Azure Activity (Misc Windows Specific)
• Microsoft Azure Resource (Log Aggregator)
• Microsoft Defender For Cloud (Automation and DevOps Tools)
• Microsoft Defender for Endpoint (EDR)
• Microsoft Defender for Identity (EDR)
• Microsoft Graph Activity Logs (AUDIT)
• Microsoft Graph API Alerts (Gateway to data and intelligence)
• Microsoft Intune Context (Mobile Device Management)
• Microsoft SQL Server (Database)
• Mimecast URL Logs (Email server log types)
• MISP Threat Intelligence (Cybersecurity)
• Mobile Endpoint Security (Mobile Endpoint Security)
• NetApp ONTAP (Rest api)
• Netskope V2 (Cloud Security)
• Office 365 (SaaS Application)
• Okta (Identity and Access Management)
• One Identity Identity Manager (unified identity security)
• Opengear Remote Management (Secure Remote Access)
• Oracle (DATABASE)
• Oracle Cloud Infrastructure VCN Flow Logs (Oracle Cloud Infrastructure)
• Palo Alto Networks Firewall (Firewall)
• Palo Alto Panorama (Firewall)
• Palo Alto Prisma Cloud Alert payload (Cloud Security)
• Proofpoint CASB (CASB)
• Proofpoint Email Filter (Email Server)
• Proofpoint On Demand (Email Server)
• Proofpoint Threat Response (Email Server)
• Pulse Secure (VPN)
• Radware Web Application Firewall (Firewall)
• SailPoint IAM (Identity and Access Management)
• Saiwall VPN (VPN)
• Salesforce (SaaS Application)
• Sentinelone Alerts (Endpoint Security)
• SonicWall (Firewall)
• Sophos Central (AV / Endpoint)
• Sophos Firewall (Next Gen) (Firewall)
• Squid Web Proxy (Web Proxy)
• STIX Threat Intelligence (Cybersecurity Threats)
• Suricata EVE (IPS IDS)
• Symantec DLP (DLP)
• Symantec Endpoint Protection (AV / Endpoint)
• Symantec Web Security Service (Web Proxy)
• TINTRI (Data Security)
• Trend Micro Apex one (Endpoint Security)
• TrendMicro Apex Central (Endpoint)
• UberAgent (Security)
• Veeam (Backup software)
• Velo Firewall (FIREWALL)
• VMware AirWatch (Wireless)
• VMware NSX (Network and Security Virtualization)
• VMware vCenter (Server)
• WatchGuard (Syslog and KV)
• Wazuh (Log Aggregator)
• Windows Event (Endpoint)
• Windows Event (XML) (AV / Endpoint)
• Windows Sysmon (DNS)
• Workday User Activity (N/A)
• Workspace Activities (Google Cloud Specific)
• XAMS by Xiting (Log Aggregator)
• ZeroFox Platform (Database)
• Zscaler (Web Proxy)
• Zywall (Network infrastructure)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

• Adaptive Shield (ADAPTIVE_SHIELD)
• Agiloft (AGILOFT)
• Airwatch Context (AIRWATCH_CONTEXT)
• Attack IQ (ATTACK_IQ)
• AWS PY Tools (AWS_PY_TOOLS)
• Bindplane Agent (BINDPLANE_AGENT)
• BindPlane Audit Logs (BINDPLANE)
• Bitsight (BITSIGHT)
• Bitvise SFTP (BITVISE_SFTP)
• Ciena Router logs (CIENA_ROUTER)
• Cisco Viptela (CISCO_VIPTELA)
• Colinet Trotta GAUS SEGUROS (CT_GAUS_SEGUROS)
• Conductor One (CONDUCTOR_ONE)
• Crowdstrike Endpoint Security API (CS_ENDPOINT_SECURITY_API)
• Fiserv SecureNow (SECURE_NOW)
• Greenhouse Harvest (GREENHOUSE_HARVEST)
• Harness IO (HARNESS_IO)
• Hashicorp Boundary (HASHICORP_BOUNDARY)
• HP Linux (HP_LINUX)
• IBM Security Guardium Insights (IBM_INSIGHTS)
• Imperva Attack Analytics (IMPERVA_ATTACK_ANALYTICS)
• INTEL471 Watcher Alerts (INTEL471_WATCHER_ALERTS)
• JAMF Security Cloud (JAMF_SECURITY_CLOUD)
• JBoss Web (JBOSS_WEB)
• Kandji Context (KANDJI_CONTEXT)
• Lenels2 Elements Secure (LENELS2_ELEMENTS_SECURE)
• ManageEngine OpUtils (MANAGE_ENGINE_OPUTILS)
• Microsoft Graph Incident (MICROSOFT_GRAPH_INCIDENT)
• Miro (MIRO)
• Open Policy Agent (OPA)
• Oracle Access Manager (ORACLE_AM)
• Oracle Enterprise Manager (ORACLE_OEM)
• Perception Point XRay (PERCEPTION_POINT_XRAY)
• RedSift BrandTrust (REDSIFT_BRANDTRUST)
• Riverbed (RIVERBED)
• SAP Sybase Adaptive Server Enterprise Database (SAP_ASE)
• Sharefile Logs (SHAREFILE_LOGS)
• Smartsheet (SMARTSHEET)
• Statusgator (STATUSGATOR)
• Titan MFT (TITAN_MFT)
• Upwind (UPWIND)
• Vanta Context (VANTA_CONTEXT)
• Varnish Cache (VARNISH_CACHE)
• Vercel WAF (VERCEL_WAF)
• Veriato Cerebral (VERIATO_CEREBRAL)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

• Abnormal Security (ABNORMAL_SECURITY)
• Akamai DNS (AKAMAI_DNS)
• Amazon API Gateway (AWS_API_GATEWAY)
• Apache (APACHE)
• Apigee (GCP_APIGEE_X)
• Archer Integrated Risk Management (ARCHER_IRM)
• Arcsight CEF (ARCSIGHT_CEF)
• AWS Cloudtrail (AWS_CLOUDTRAIL)
• AWS VPC Flow (AWS_VPC_FLOW)
• AWS VPN (AWS_VPN)
• Azure AD (AZURE_AD)
• Azure AD Audit (AZURE_AD_AUDIT)
• Azure AD Sign-In (AZURE_AD_SIGNIN)
• Azure Storage Audit (AZURE_STORAGE_AUDIT)
• Azure WAF (AZURE_WAF)
• BeyondTrust Privileged Identity (BEYONDTRUST_PI)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• Carbon Black App Control (CB_APP_CONTROL)
• Check Point (CHECKPOINT_FIREWALL)
• Checkpoint Audit (CHECKPOINT_AUDIT)
• Cisco ASA (CISCO_ASA_FIREWALL)
• Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
• Cisco ISE (CISCO_ISE)
• Cisco Meraki (CISCO_MERAKI)
• Cisco WSA (CISCO_WSA)
• Citrix Netscaler (CITRIX_NETSCALER)
• Cloud Audit Logs (N/A)
• Cloud Data Loss Prevention (N/A)
• Cloud Load Balancing (GCP_LOADBALANCING)
• Cloud SQL (GCP_CLOUDSQL)
• Cloudflare WAF (CLOUDFLARE_WAF)
• Cohesity (COHESITY)
• Corelight (CORELIGHT)
• CrowdStrike Falcon (CS_EDR)
• Cyber 2.0 IDS (CYBER_2_IDS)
• Cyberark Privilege Cloud (CYBERARK_PRIVILEGE_CLOUD)
• CyberArk PTA Privileged Threat Analytics (CYBERARK_PTA)
• Darktrace (DARKTRACE)
• Dell Switch (DELL_SWITCH)
• Duo Administrator Logs (DUO_ADMIN)
• Duo Auth (DUO_AUTH)
• EfficientIP DDI (EFFICIENTIP_DDI)
• Elastic Audit Beats (ELASTIC_AUDITBEAT)
• Elastic Packet Beats (ELASTIC_PACKETBEATS)
• F5 ASM (F5_ASM)
• F5 Shape (F5_SHAPE)
• F5 Silverline (F5_SILVERLINE)
• FireEye (FIREEYE_ALERT)
• FireEye ETP (FIREEYE_ETP)
• FireEye HX (FIREEYE_HX)
• Forcepoint DLP (FORCEPOINT_DLP)
• Forcepoint Email Security (FORCEPOINT_EMAILSECURITY)
• Forcepoint Mail Relay (FORCEPOINT_MAIL_RELAY)
• FortiGate (FORTINET_FIREWALL)
• Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
• Fortinet Fortimanager (FORTINET_FORTIMANAGER)
• GCP_APP_ENGINE (GCP_APP_ENGINE)
• GitHub (GITHUB)
• HP Aruba (ClearPass) (CLEARPASS)
• IBM DS8000 Storage (IBM_DS8000)
• IBM Guardium (GUARDIUM)
• IBM OpenPages (IBM_OPENPAGES)
• Infoblox DNS (INFOBLOX_DNS)
• Jenkins (JENKINS)
• Layer7 SiteMinder (SITEMINDER_SSO)
• Linux Auditing System (AuditD) (AUDITD)
• Malwarebytes (MALWAREBYTES_EDR)
• McAfee ePolicy Orchestrator (MCAFEE_EPO)
• Microsoft AD FS (ADFS)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Microsoft Azure Resource (AZURE_RESOURCE_LOGS)
• Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
• Microsoft Exchange (EXCHANGE_MAIL)
• Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
• Microsoft PowerShell (POWERSHELL)
• Microsoft SQL Server (MICROSOFT_SQL)
• Microsoft System Center Endpoint Protection (MICROSOFT_SCEP)
• Mimecast (MIMECAST_MAIL)
• Nagios Infrastructure Monitoring (NAGIOS)
• Network Policy Server (MICROSOFT_NPS)
• Office 365 (OFFICE_365)
• Okta (OKTA)
• Okta User Context (OKTA_USER_CONTEXT)
• Oracle (ORACLE_DB)
• Palo Alto Cortex XDR Alerts (CORTEX_XDR)
• Palo Alto Panorama (PAN_PANORAMA)
• Ping Federate (PING_FEDERATE)
• Ping Identity (PING)
• PostgreSQL (POSTGRESQL)
• Precisely Ironstream IBM z/OS (IRONSTREAM_ZOS)
• Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
• Proofpoint Tap Alerts (PROOFPOINT_MAIL)
• Pulse Secure (PULSE_SECURE_VPN)
• Radware Web Application Firewall (RADWARE_FIREWALL)
• Rippling Activity Logs (RIPPLING_ACTIVITYLOGS)
• Sap Business Technology Platform (SAP_BTP)
• Security Command Center Threat (N/A)
• Sentinelone Alerts (SENTINELONE_ALERT)
• SentinelOne EDR (SENTINEL_EDR)
• SentinelOne Singularity Cloud Funnel (SENTINELONE_CF)
• Shibboleth IDP (SHIBBOLETH_IDP)
• Snare System Diagnostic Logs (SNARE_SOLUTIONS)
• Snowflake (SNOWFLAKE)
• Sophos AV (SOPHOS_AV)
• Sophos Intercept EDR (SOPHOS_EDR)
• Sourcefire (SOURCEFIRE_IDS)
• Splunk Attack Analyzer (SPLUNK_ATTACK_ANALYZER)
• SpyCloud (SPYCLOUD)
• Squid Web Proxy (SQUID_WEBPROXY)
• Suricata EVE (SURICATA_EVE)
• Symantec Endpoint Protection (SEP)
• Symantec Web Security Service (SYMANTEC_WSS)
• Tenable Audit (TENABLE_AUDIT)
• Thales Vormetric (VORMETRIC)
• Trend Micro Apex one (TRENDMICRO_APEX_ONE)
• Trend Micro Deep Security (TRENDMICRO_DEEP_SECURITY)
• Trend Micro Vision One (TRENDMICRO_VISION_ONE)
• TrendMicro Apex Central (TRENDMICRO_APEX_CENTRAL)
• Twingate (TWINGATE)
• Ubika Waf (UBIKA_WAF)
• Unix system (NIX_SYSTEM)
• Vectra Detect (VECTRA_DETECT)
• Vectra Stream (VECTRA_STREAM)
• Wazuh (WAZUH)
• Windows DHCP (WINDOWS_DHCP)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• Windows Local Administrator Password Solution (MICROSOFT_LAPS)
• Windows Sysmon (WINDOWS_SYSMON)
• Workspace Activities (WORKSPACE_ACTIVITY)
• Workspace Alerts (WORKSPACE_ALERTS)
• XAMS by Xiting (XITING_XAMS)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

• Active Identity HID (ACTIVE_IDENTITY_HID)
• Akamai Event Viewer (AKAMAI_EVT_VWR)
• Autodesk Vault (AUTODESK_VAULT)
• Avaza (AVAZA)
• Avigilon Access Logs (AVIGILON_ACCESS_LOGS)
• Axis Camera (AXIS_CAMERA)
• Axis License Plate Reader (AXIS_LPR)
• Azure Nix System (AZURE_NIX_SYSTEM)
• CallTower Audio Conferencing (CALLTOWER_AUDIO)
• Canon Printers (CANON_PRINTERS)
• Cisco Secure Endpoint (CISCO_SECURE_ENDPOINT)
• Control UP (CONTROL_UP)
• Cradlepoint Router Logs (CRADLEPOINT)
• Crowdstrike Spotlight (CROWDSTRIKE_SPOTLIGHT)
• CrushFTP (CRUSHFTP)
• CrowdStrike Filevantage (CS_FILEVANTAGE)
• Cybersixgill (CYBERSIXGILL)
• Cyolo Secure Remote Access for OT (CYOLO_OT)
• Dell Core Switch (DELL_EMC_NETWORKING)
• DLink Switch (DLINK_SWITCH)
• Elastic Security (ELASTIC_EDR)
• Fireblocks (FIREBLOCKS)
• Forescout eyeInspect (FORESCOUT_EYEINSPECT)
• Fortinet FortiGate IPS (FORTINET_IPS)
• H3C Router (H3C_ROUTER)
• Hackerone (HACKERONE)
• Halo Sensor (HALO_SENSOR)
• Hashcast (HASHCAST)
• Perforce Helix Core (HELIX_CORE)
• Heroku (HEROKU)
• Hillstone NDR (HILLSTONE_NDR)
• HL7 (HL7)
• HoopDev (HOOPDEV)
• Huawei Switches (HUAWEI_SWITCH)
• Identity Security Cloud (IDENTITY_SECURITY_CLOUD)
• Imperva Data Risk Analytics (IMPERVA_DATA_ANALYTICS)
• Imperva DRA (IMPERVA_DRA)
• IM Express (IM_EXPRESS)
• Intezer (INTEZER)
• Jumpcloud IAM (JUMPCLOUD_IAM)
• Maltiverse IOC (MALTIVERSE_IOC)
• ManageEngine Log360 (MANAGE_ENGINE_LOG360)
• McAfee Network Security Platform (MCAFEE_NSP)
• Miro Cloud (MIRO_CLOUD)
• Nokia Home Device Manager (NOKIA_HDM)
• Nortel Secure Router (NORTEL_SR)
• Notion (NOTION)
• One Identity Identity Manager (ONE_IDENTITY_IDENTITY_MANAGER)
• IDnomic Public Key Infrastructure (OPENTRUST)
• Outline Activity Logs (OUTLINE_ACTIVITY_LOGS)
• Prismatic IO (PRISMATIC_IO)
• ProFTPD (PROFTPD)
• Provision Asset Context (PROVISION_ASSET_CONTEXT)
• Ransomcare (RANSOMCARE)
• Rapid7 Insights Threat Command (RAPID7_INSIGHTS_THREAT_COMMAND)
• Saporo (SAPORO)
• SAS Metadata Server log (SAS_METADATA_SERVER_LOG)
• Scylla (SCYLLA)
• Senseon Alerts (SENSEON_ALERTS)
• Sonic Switch (SONIC_SWITCH)
• Symantec Data Center Security (SYMANTEC_DCS)
• Syncplify SFTP 2 Events (SYNCPLIFY_SFTP)
• Team Cymru Scout Threat Intelligence (TEAM_CYMRU_SCOUT_THREATINTEL)
• Tenable CSPM (TENABLE_CSPM)
• Teqtivity Assets (TEQTIVITY_ASSETS)
• Tines (TINES)
• TP Link Network Switches (TPLINK_SWITCH)
• TT D365 (TT_D365)
• TT MSAN DSLAM (TT_MSAN_DSLAM)
• TT Trio Chordiant (TT_TRIO_CHORDIANT)
• Tufin (TUFIN)
• Tufin Secure Track (TUFIN_SECURE_TRACK)
• UberAgent (UBERAGENT)
• Upstream Vehicle SOC Alerts (UPSTREAM_VSOC_ALERTS)
• URLScan IO (URLSCAN_IO)
• Vertiv UPS (VERTIV_UPS)
• Very Good Security (VERY_GOOD_SECURITY)
• Virtual Browser (VIRTUAL_BROWSER)
• VMWare VSphere (VMWARE_VSPHERE)
• Webroot Identity Protection (WEBROOT_IDENTITY_PROTECTION)
• WideField (WIDEFIELD_SECURITY)
• Zscaler Sandbox (ZSCALER_SANDBOX)
• Zywall (ZYWALL)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Burst limits will be rolling out over the next 90 days. This should not affect customers if sources are properly configured. Review documentation for full details.

Customers can now configure direct ingestion of Google Cloud data without using a 1-time Google Security Operations access code. This feature will be launched over a period of several weeks. For more information, see Enable direct ingestion from Google Cloud.

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable.

• Airlock Digital Application Allowlisting (AIRLOCK_DIGITAL)
• Akamai SIEM Connector (AKAMAI_SIEM_CONNECTOR)
• Apache (APACHE)
• Arcsight CEF (ARCSIGHT_CEF)
• Arista Switch (ARISTA_SWITCH)
• Aruba (ARUBA_WIRELESS)
• Aruba EdgeConnect SD-WAN (ARUBA_EDGECONNECT_SDWAN)
• Atlassian Confluence (ATLASSIAN_CONFLUENCE)
• Auth0 (AUTH_ZERO)
• AWS CloudTrail (AWS_CLOUDTRAIL)
• AWS Config (AWS_CONFIG)
• Azure AD (AZURE_AD)
• Azure AD Directory Audit (AZURE_AD_AUDIT)
• Azure App Service (AZURE_APP_SERVICE)
• Azure WAF (AZURE_WAF)
• BeyondTrust Endpoint Privilege Management (BEYONDTRUST_ENDPOINT)
• BIND (BIND_DNS)
• BloxOne Threat Defense (BLOXONE)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• Broadcom SSL Visibility Appliance (BROADCOM_SSL_VA)
• Cequence Bot Defense (CEQUENCE_BOT_DEFENSE)
• Check Point (CHECKPOINT_FIREWALL)
• Checkpoint Audit (CHECKPOINT_AUDIT)
• Checkpoint SmartDefense (CHECKPOINT_SMARTDEFENSE)
• Cimcor | File Integrity Monitoring (CIMCOR)
• CipherTrust Manager (CIPHERTRUST_MANAGER)
• Cisco ASA (CISCO_ASA_FIREWALL)
• Cisco EStreamer (CISCO_ESTREAMER)
• Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
• Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
• Cisco Internetwork Operating System (CISCO_IOS)
• Cisco IronPort (CISCO_IRONPORT)
• Cisco Meraki (CISCO_MERAKI)
• Cisco Router (CISCO_ROUTER)
• Cisco Stealthwatch (CISCO_STEALTHWATCH)
• Cisco VPN (CISCO_VPN)
• Citrix Analytics (CITRIX_ANALYTICS)
• Citrix Netscaler (CITRIX_NETSCALER)
• Cloud Audit Logs (N/A)
• Cloud Data Loss Prevention (N/A)
• Cloud Identity Devices (GCP_CLOUDIDENTITY_DEVICES)
• Cloud Load Balancing (GCP_LOADBALANCING)
• Cloud SQL (GCP_CLOUDSQL)
• Cofense (COFENSE_TRIAGE)
• Comforte SecurDPS (COMFORTE_SECURDPS)
• Compute Engine (GCP_COMPUTE)
• Corelight (CORELIGHT)
• Cribl Stream (CRIBL_STREAM)
• CrowdStrike Falcon (CS_EDR)
• CyberArk (CYBERARK)
• DigitalArts i-Filter (DIGITALARTS_IFILTER)
• Duo Auth (DUO_AUTH)
• Duo User Context (DUO_USER_CONTEXT)
• EfficientIP DDI (EFFICIENTIP_DDI)
• Elastic Audit Beats (ELASTIC_AUDITBEAT)
• Elastic Windows Event Log Beats (ELASTIC_WINLOGBEAT)
• Ergon Informatik Airlock IAM (ERGON_INFORMATIK_AIRLOCK_IAM)
• ESET AV (ESET_AV)
• F5 ASM (F5_ASM)
• F5 BIGIP LTM (F5_BIGIP_LTM)
• F5 Shape (F5_SHAPE)
• F5 Silverline (F5_SILVERLINE)
• Fidelis Network (FIDELIS_NETWORK)
• FileZilla (FILEZILLA_FTP)
• Forcepoint Email Security (FORCEPOINT_EMAILSECURITY)
• Forcepoint Proxy (FORCEPOINT_WEBPROXY)
• Forgerock OpenIdM (FORGEROCK_OPENIDM)
• Fortinet FortiAuthenticator (FORTINET_FORTIAUTHENTICATOR)
• Google App Engine (GCP_APP_ENGINE)
• GitHub (GITHUB)
• IBM DataPower Gateway (IBM_DATAPOWER)
• IBM DB2 (DB2_DB)
• IBM Guardium (GUARDIUM)
• IBM Security QRadar SIEM (IBM_QRADAR)
• Imperva Audit Trail (IMPERVA_AUDIT_TRAIL)
• Ingrian Networks DataSecure Appliance (INGRIAN_NETWORKS_DATASECURE_APPLIANCE)
• ION Spectrum (ION_SPECTRUM)
• JAMF Pro (JAMF_PRO)
• Jenkins (JENKINS)
• Juniper Junos (JUNIPER_JUNOS)
• Juniper Mist (JUNIPER_MIST)
• Juniper MX Router (JUNIPER_MX)
• Keeper Enterprise Security (KEEPER)
• Linux Auditing System (AuditD) (AUDITD)
• Linux Sysmon (LINUX_SYSMON)
• Lucid (LUCID)
• Maria Database (MARIA_DB)
• Microsoft AD (WINDOWS_AD)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Microsoft CyberX (CYBERX)
• Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
• Microsoft Defender for Identity (MICROSOFT_DEFENDER_IDENTITY)
• Microsoft Exchange (EXCHANGE_MAIL)
• Microsoft Graph Activity Logs (MICROSOFT_GRAPH_ACTIVITY_LOGS)
• Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
• Microsoft IIS (IIS)
• Microsoft SQL Server (MICROSOFT_SQL)
• Mimecast URL Logs (MIMECAST_URL_LOGS)
• Netapp Storagegrid (NETAPP_STORAGEGRID)
• Netskope (NETSKOPE_ALERT)
• Netskope Web Proxy (NETSKOPE_WEBPROXY)
• Network Policy Server (MICROSOFT_NPS)
• Noname API Security (NONAME_API_SECURITY)
• Office 365 (OFFICE_365)
• Office 365 Message Trace (OFFICE_365_MESSAGETRACE)
• Okta (OKTA)
• Okta User Context (OKTA_USER_CONTEXT)
• Open LDAP (OPENLDAP)
• Oracle (ORACLE_DB)
• Oracle Cloud Infrastructure Audit Logs (OCI_AUDIT)
• Palo Alto Cortex XDR Alerts (CORTEX_XDR)
• Palo Alto Networks Firewall (PAN_FIREWALL)
• Palo Alto Panorama (PAN_PANORAMA)
• Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
• Passwordstate (PASSWORDSTATE)
• Ping Identity (PING)
• Portnix CEF (PORTNOX_CEF)
• PostFix Mail (POSTFIX_MAIL)
• Proofpoint Email Filter (PROOFPOINT_MAIL_FILTER)
• Proofpoint Sendmail Sentrion (PROOFPOINT_SENDMAIL_SENTRION)
• Proofpoint Threat Response (PROOFPOINT_TRAP)
• Quest Change Auditor for EMC (QUEST_CHANGE_AUDITOR_EMC)
• Radware Alteon (RADWARE_ALTEON)
• Radware Web Application Firewall (RADWARE_FIREWALL)
• Red Hat Directory Server LDAP (REDHAT_DIRECTORY_SERVER)
• Riverbed Steelhead (STEELHEAD)
• RSA SecurID Access Identity Router (RSA_SECURID)
• Ruckus Networks (RUCKUS_WIRELESS)
• Salesforce (SALESFORCE)
• SentinelOne EDR (SENTINEL_EDR)
• SentinelOne Singularity Cloud Funnel (SENTINELONE_CF)
• SEPPmail Secure Email (SEPPMAIL)
• ServiceNow CMDB (SERVICENOW_CMDB)
• SiteMinder Web Access Management (CA_SSO_WEB)
• Snare System Diagnostic Logs (SNARE_SOLUTIONS)
• Solarwinds Kiwi Syslog Server (SOLARWINDS_KSS)
• SonicWall (SONIC_FIREWALL)
• Sonrai Enterprise Cloud Security Solution (SONRAI)
• Symantec DLP (SYMANTEC_DLP)
• Symantec Endpoint Protection (SEP)
• Symantec VIP Authentication Hub (SYMANTEC_VIP_AUTHHUB)
• Symantec Web Security Service (SYMANTEC_WSS)
• Sysdig (SYSDIG)
• Tableau (TABLEAU)
• Terraform Enterprise Audit (TERRAFORM_ENTERPRISE)
• Thinkst Canary (THINKST_CANARY)
• Thycotic (THYCOTIC)
• Trend Micro (TIPPING_POINT)
• Ubika WAAP (UBIKA_WAAP)
• Ubika Waf (UBIKA_WAF)
• UPX AntiDDoS (UPX_ANTIDDOS)
• Vectra Stream (VECTRA_STREAM)
• Velo Firewall (VELO_FIREWALL)
• VeridiumID by Veridium (VERIDIUM_ID)
• Versa Firewall (VERSA_FIREWALL)
• Virtru Email Encryption (VIRTRU_EMAIL_ENCRYPTION)
• VMware ESXi (VMWARE_ESX)
• VMware NSX (VMWARE_NSX)
• VMware vCenter (VMWARE_VCENTER)
• Windows DNS (WINDOWS_DNS)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• Windows Local Administrator Password Solution (MICROSOFT_LAPS)
• Workday (WORKDAY)
• Workspace Activities (WORKSPACE_ACTIVITY)
• Zscaler (ZSCALER_WEBPROXY)
• Zscaler CASB (ZSCALER_CASB)
• Zscaler Internet Access Audit Logs (ZSCALER_INTERNET_ACCESS)
• Zscaler Private Access (ZSCALER_ZPA)
• Zscaler Secure Private Access Audit Logs (ZSCALER_ZPA_AUDIT)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

• Backstage (BACKSTAGE)
• Bitwarden Password Manager User Context (BITWARDEN_USER_CONTEXT)
• Boomi App (BOOMI_APP)
• ChatGPT Audit Logs (CHATGPT_AUDIT_LOGS)
• Cloudflare Warp (CLOUDFLARE_WARP)
• Coda Io (CODA_IO)
• Fortinet Fortimanager (FORTINET_FORTIMANAGER)
• Fusion Auth (FUSION_AUTH)
• Google Cloud Abuse Events (GCP_ABUSE_EVENTS)
• Google Cloud Monitoring Alerts (GCP_MONITORING_ALERTS)
• Gong (GONG)
• Grafana (GRAFANA)
• IBM Cloud Activity Tracker (IBM_CLOUD_ACTIVITY_TRACKER)
• IBM Cloud System (IBM_CLOUD_SYSTEM)
• Incident Io (INCIDENT_IO)
• Kentik DDoS Detection (KENTIK_ALERTS)
• Lockself Lockpass (LOCKSELF_LOCKPASS)
• Magic Collaboration Studio (MAGIC_CS)
• Metaswitch Perimeta (METASWITCH_PERIMETA)
• Microsoft Defender Endpoint for iOS Logs (MICROSOFT_DEFENDER_ENDPOINT_IOS)
• 9NowAudit (NINENOW_AUDIT)
• Oracle Cloud Guard (OCI_CLOUDGUARD)
• Oort Security Tool (OORT)
• OpsRamp (OPSRAMP)
• Ops Genie (OPS_GENIE)
• People Strong (PEOPLE_STRONG)
• Pingdom (PINGDOM)
• Proofpoint Tap Campaign (PROOFPOINT_TAP_CAMPAIGN)
• Proofpoint Tap Forensics (PROOFPOINT_TAP_FORENSICS)
• Proofpoint Tap People (PROOFPOINT_TAP_PEOPLE)
• Proofpoint Tap Threats (PROOFPOINT_TAP_THREATS)
• Proofpoint Tis IOC (PROOFPOINT_TIS_IOC)
• Push Security (PUSH_SECURITY)
• Recordedfuture Alerts (RECORDEDFUTURE_ALERTS)
• Rippling Activity Logs (RIPPLING_ACTIVITYLOGS)
• Sentry (SENTRY)
• Servertech PDUs (SERVERTECH_PDUS)
• Sprinkledata(DWH) (SPRINKLEDATA_DWH)
• Tenable Audit (TENABLE_AUDIT)
• TINTRI (TINTRI)
• WPass (WPASS)
• WPEngine (WPENGINE)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

When you migrate an existing Google SecOps instance so that it is bound to a Google Cloud project, you can also use auto-generated commands to migrate your existing feature RBAC configuration to IAM permissions and roles. For more information, see Migrate existing permissions to IAM.

You can now configure Cloud Identity or Google Workspace as an identity provider during the Google Security Operations onboarding steps. For more information about onboarding, see Onboarding or migrating a Google Security Operations instance.

During the Google Security Operations onboarding steps, you can now specify identity provider groups that include administrators who configure user access to SOAR-related features. For more information, see Link Google SecOps to Google Cloud services.

lastAlertStatusChangeTime is added to the response of the GetRule Detection Engine API. This indicates when alertingEnabled was last updated from true to false or from false to true.

The field is also added to RuleDeployment of Chronicle API v1 alpha.

The syntax for placeholders in UDM saved searches is updated. See Save a search for the new syntax.

The following supported default parsers have changed. Each is listed by product name and log_type value, if applicable.

• Abnormal Security (ABNORMAL_SECURITY)
• Akamai DNS (AKAMAI_DNS)
• Akamai WAF (AKAMAI_WAF)
• Apigee (GCP_APIGEE_X)
• Array Networks SSL VPN (ARRAYNETWORKS_VPN)
• AWS CloudFront (AWS_CLOUDFRONT)
• AWS Cloudtrail (AWS_CLOUDTRAIL)
• Azure AD (AZURE_AD)
• Azure AD Directory Audit (AZURE_AD_AUDIT)
• Azure AD Sign-In (AZURE_AD_SIGNIN)
• Barracuda Email (BARRACUDA_EMAIL)
• Barracuda Firewall (BARRACUDA_FIREWALL)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• BMC AMI Defender (BMC_AMI_DEFENDER)
• Carbon Black (CB_EDR)
• Check Point (CHECKPOINT_FIREWALL)
• Check Point Sandblast (CHECKPOINT_EDR)
• Checkpoint Audit (CHECKPOINT_AUDIT)
• Cisco AMP (CISCO_AMP)
• Cisco EStreamer (CISCO_ESTREAMER)
• Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
• Cisco ISE (CISCO_ISE)
• Cisco Router (CISCO_ROUTER)
• Cisco Switch (CISCO_SWITCH)
• Cisco Umbrella DNS (UMBRELLA_DNS)
• Cisco VPN (CISCO_VPN)
• Cisco WLC/WCS (CISCO_WIRELESS)
• Citrix Netscaler (CITRIX_NETSCALER)
• Cloud Audit Logs (N/A)
• Cloud SQL (GCP_CLOUDSQL)
• Cloud Storage Context (N/A)
• Cohesity (COHESITY)
• CrowdStrike Falcon (CS_EDR)
• CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)
• ESET AV (ESET_AV)
• F5 ASM (F5_ASM)
• F5 BIGIP LTM (F5_BIGIP_LTM)
• F5 VPN (F5_VPN)
• Forcepoint DLP (FORCEPOINT_DLP)
• FortiGate (FORTINET_FIREWALL)
• GMAIL Logs (GMAIL_LOGS)
• HID DigitalPersona (HID_DIGITALPERSONA)
• Honeyd (HONEYD)
• HP Aruba (ClearPass) (CLEARPASS)
• IBM AS/400 (IBM_AS400)
• IBM DS8000 Storage (IBM_DS8000)
• IBM Security Verify (IBM_SECURITY_VERIFY)
• Infoblox (INFOBLOX)
• Island Browser logs (ISLAND_BROWSER)
• JAMF CMDB (JAMF)
• JumpCloud Directory Insights (JUMPCLOUD_DIRECTORY_INSIGHTS)
• Juniper Mist (JUNIPER_MIST)
• Kubernetes Node (KUBERNETES_NODE)
• Linux Auditing System (AuditD) (AUDITD)
• ManageEngine ADAudit Plus (ADAUDIT_PLUS)
• Microsoft AD FS (ADFS)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Microsoft Azure Resource (AZURE_RESOURCE_LOGS)
• Microsoft CyberX (CYBERX)
• Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
• Microsoft Graph Activity Logs (MICROSOFT_GRAPH_ACTIVITY_LOGS)
• Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
• Microsoft SQL Server (MICROSOFT_SQL)
• Mikrotik Router (MIKROTIK_ROUTER)
• NetDocuments Solutions (NETDOCUMENTS)
• Netwrix (NETWRIX)
• Office 365 (OFFICE_365)
• Office 365 Message Trace (OFFICE_365_MESSAGETRACE)
• Okta (OKTA)
• OneLogin (ONELOGIN_SSO)
• Opengear Remote Management (OPENGEAR)
• Palo Alto Networks Firewall (PAN_FIREWALL)
• pfSense (PFSENSE)
• PostFix Mail (POSTFIX_MAIL)
• Proofpoint Sendmail Sentrion (PROOFPOINT_SENDMAIL_SENTRION)
• Proofpoint Tap Alerts (PROOFPOINT_MAIL)
• Pulse Secure (PULSE_SECURE_VPN)
• Qumulo FS (QUMULO_FS)
• Rapid7 (RAPID7_NEXPOSE)
• Rapid7 Insight (RAPID7_INSIGHT)
• Rubrik Polaris (RUBRIK_POLARIS)
• SailPoint IAM (SAILPOINT_IAM)
• SAP SuccessFactors (SAP_SUCCESSFACTORS)
• Semperis DSP (SEMPERIS_DSP)
• Sentinelone Alerts (SENTINELONE_ALERT)
• SentinelOne EDR (SENTINEL_EDR)
• Signal Sciences WAF (SIGNAL_SCIENCES_WAF)
• Snare System Diagnostic Logs (SNARE_SOLUTIONS)
• SonicWall (SONIC_FIREWALL)
• Sophos Central (SOPHOS_CENTRAL)
• Sophos UTM (SOPHOS_UTM)
• Spur data feeds (SPUR_FEEDS)
• Suricata EVE (SURICATA_EVE)
• Symantec DLP (SYMANTEC_DLP)
• Symantec Endpoint Protection (SEP)
• Symantec VIP Authentication Hub (SYMANTEC_VIP_AUTHHUB)
• Tanium Audit (TANIUM_AUDIT)
• Thinkst Canary (THINKST_CANARY)
• Trend Micro Vision One (TRENDMICRO_VISION_ONE)
• Twingate (TWINGATE)
• Unix system (NIX_SYSTEM)
• Vectra Detect (VECTRA_DETECT)
• Veeam (VEEAM)
• Verba Recording System (VERBA_REC)
• VeridiumID by Veridium (VERIDIUM_ID)
• VMware ESXi (VMWARE_ESX)
• Windows Defender ATP (WINDOWS_DEFENDER_ATP)
• Windows DNS (WINDOWS_DNS)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• Winscp (WINSCP)
• WordPress (WORDPRESS_CMS)
• Workspace Activities (WORKSPACE_ACTIVITY)
• Zeek TSV (BRO_TSV)
• Zix Email Encryption (ZIX_EMAIL_ENCRYPTION)
• Zscaler (ZSCALER_WEBPROXY)
• ZScaler DNS (ZSCALER_DNS)
• Zscaler Private Access (ZSCALER_ZPA)

The following log types, without a default parser, were added. Each is listed by product name and log_type value, if applicable.

• Akamai Log Delivery Service (AKAMAI_LDS)
• AudioCodes Voice DNA (AUDIOCODES)
• Amazon API Gateway (AWS_API_GATEWAY)
• Axway (AXWAY)
• Biztalk (BIZTALK)
• Check Point FDE (CHECKPOINT_FDE)
• Cimcor | File Integrity Monitoring (CIMCOR)
• CS Alerts (CS_ALERTS)
• Custom CSV Log (CUSTOM_CSV_LOG)
• Cyral (CYRAL)
• Druva (DRUVA)
• Entrust DataControl Audit (ENTR_DATACTRL_AUDIT)
• Ergon Informatik Airlock IAM (ERGON_INFORMATIK_AIRLOCK_IAM)
• Eset Protect Platform (ESET_PROTECT_PLATFORM)
• Exim Internet Mailer (EXIM_INTERNET_MAILER)
• FM Systems Workplace Management (FM_SYSTEMS)
• GluWare Network Automation (GLUWARE_NETWORK_AUTOMATION)
• Guidewire Billing Center (GUIDEWIRE_BILLING_CENTER)
• Guidewire Claim Center (GUIDEWIRE_CLAIM_CENTER)
• Guidewire Policy Center (GUIDEWIRE_POLICY_CENTER)
• HAVI Connect (HAVI_CONNECT)
• IBM OpenPages (IBM_OPENPAGES)
• Ingrian Networks DataSecure Appliance (INGRIAN_NETWORKS_DATASECURE_APPLIANCE)
• iSecurity | Security Services and Remediation (ISECURITY)
• iTop (ITOP)
• Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
• Microsoft Graph Risky Users (MICROSOFT_GRAPH_RISKY_USERS)
• NetApp BlueXP (NETAPP_BLUEXP)
• Netgate Firewall (NETGATE_FIREWALL)
• 1KOSMOS | Identity and Authentication (ONEKOSMOS)
• Palo Alto Global Protect SVC (PAN_GPSVC)
• Palo Alto SSLVPN Access (PAN_SSLVPN_ACCESS)
• Palo Alto Telemetry (PAN_TELEMETRY)
• Proofpoint Endpoint Data Loss Prevention (PROOFPOINT_ENDPOINT_DLP)
• SAP ERP (SAP_ERP)
• Ubika WAAP (UBIKA_WAAP)
• Webroot Endpoint Protection (WEBROOT)
• Wolters Kluwer Teammate (WOLTERS_KLUWER_TEAMMATE)
• Xirrus Wireless Controller (XIRRUS)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Google SecOps now supports the following functions in Detection Engine rules:

• fingerprint
• sample_rate

For more information about these functions, see YARA-L 2.0 language syntax.

When Applied Threat Intelligence is enabled, it ingests IOCs curated by Mandiant Threat Intelligence with an IC-Score greater than 80 and generates an alert when a match is found.

The following supported default parsers have changed. Each is listed by product name and log_type value, if applicable.

• AIX system (AIX_SYSTEM)
• Arcsight CEF (ARCSIGHT_CEF)
• Arista Switch (ARISTA_SWITCH)
• Aruba (ARUBA_WIRELESS)
• Aruba Switch (ARUBA_SWITCH)
• Attivo Networks (ATTIVO)
• AWS Cloudtrail (AWS_CLOUDTRAIL)
• AWS Control Tower (AWS_CONTROL_TOWER)
• AWS Elastic Load Balancer (AWS_ELB)
• AWS WAF (AWS_WAF)
• Azure AD (AZURE_AD)
• Azure AD Directory Audit (AZURE_AD_AUDIT)
• Azure AD Organizational Context (AZURE_AD_CONTEXT)
• Azure Application Gateway (AZURE_GATEWAY)
• Azure Storage Audit (AZURE_STORAGE_AUDIT)
• Azure WAF (AZURE_WAF)
• Barracuda Firewall (BARRACUDA_FIREWALL)
• BeyondTrust Endpoint Privilege Management (BEYONDTRUST_ENDPOINT)
• BigQuery (N/A)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• Brocade Switch (BROCADE_SWITCH)
• Check Point (CHECKPOINT_FIREWALL)
• Cisco ASA (CISCO_ASA_FIREWALL)
• Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
• Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
• Cisco Internetwork Operating System (CISCO_IOS)
• Cisco ISE (CISCO_ISE)
• Cisco Meraki (CISCO_MERAKI)
• Cisco VPN (CISCO_VPN)
• Cisco WLC/WCS (CISCO_WIRELESS)
• Citrix Netscaler (CITRIX_NETSCALER)
• Claroty Enterprise Management Console (CLAROTY_EMC)
• Cloud Audit Logs (N/A)
• Cloud Intrusion Detection System (GCP_IDS)
• Corelight (CORELIGHT)
• CrowdStrike Detection Monitoring (CS_DETECTS)
• CrowdStrike Falcon (CS_EDR)
• CyberArk (CYBERARK)
• Cyberark Privilege Cloud (CYBERARK_PRIVILEGE_CLOUD)
• Cybergatekeeper NAC (CYBERGATEKEEPER_NAC)
• Darktrace (DARKTRACE)
• Dell ECS Enterprise Object Storage (DELL_ECS)
• Dell Switch (DELL_SWITCH)
• Elastic Packet Beats (ELASTIC_PACKETBEATS)
• ESET (ESET_EDR)
• ESET AV (ESET_AV)
• F5 Advanced Firewall Management (F5_AFM)
• F5 ASM (F5_ASM)
• F5 BIGIP LTM (F5_BIGIP_LTM)
• FireEye HX (FIREEYE_HX)
• FireEye NX Audit (FIREEYE_NX_AUDIT)
• Firewall Rule Logging (N/A)
• Forcepoint DLP (FORCEPOINT_DLP)
• Forescout NAC (FORESCOUT_NAC)
• Forgerock OpenIdM (FORGEROCK_OPENIDM)
• FortiGate (FORTINET_FIREWALL)
• Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
• Fortra Powertech SIEM Agent (FORTRA_POWERTECH_SIEM_AGENT)
• Cloud NAT (N/A)
• GCP_SWP (GCP_SWP)
• Gitlab (GITLAB)
• GMAIL Logs (GMAIL_LOGS)
• GMV Checker ATM Security (GMV_CHECKER)
• Guardicore Centra (GUARDICORE_CENTRA)
• HPE BladeSystem C7000 (HPE_BLADESYSTEM_C7000)
• HYPR MFA (HYPR_MFA)
• IBM AS/400 (IBM_AS400)
• IBM DS8000 Storage (IBM_DS8000)
• IBM Guardium (GUARDIUM)
• IBM Tape Storages (IBM_LTO)
• IBM Tivoli (IBM_TIVOLI)
• IBM-i Operating System (IBM_I)
• Illumio Core (ILLUMIO_CORE)
• Imperva (IMPERVA_WAF)
• Imperva Advanced Bot Protection (IMPERVA_ABP)
• Imperva SecureSphere Management (IMPERVA_SECURESPHERE)
• Infoblox (INFOBLOX)
• ION Spectrum (ION_SPECTRUM)
• Ipswitch MOVEit Transfer (IPSWITCH_MOVEIT_TRANSFER)
• Jamf Protect Alerts (JAMF_PROTECT)
• Jamf Protect Telemetry (JAMF_TELEMETRY)
• Juniper Junos (JUNIPER_JUNOS)
• Juniper MX Router (JUNIPER_MX)
• Kubernetes Node (KUBERNETES_NODE)
• LastPass Password Management (LASTPASS)
• Linux Auditing System (AuditD) (AUDITD)
• McAfee Enterprise Security Manager (MCAFEE_ESM)
• Medigate IoT (MEDIGATE_IOT)
• Microsoft AD (WINDOWS_AD)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
• Microsoft Defender for Identity (MICROSOFT_DEFENDER_IDENTITY)
• Microsoft Exchange (EXCHANGE_MAIL)
• Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
• Microsoft IAS Server (MICROSOFT_IAS)
• Microsoft Intune (AZURE_MDM_INTUNE)
• Microsoft SQL Server (MICROSOFT_SQL)
• Mongo Database (MONGO_DB)
• Netscout Arbor Sightline (ARBOR_SIGHTLINE)
• Netskope Web Proxy (NETSKOPE_WEBPROXY)
• NGFW Enterprise (GCP_NGFW_ENTERPRISE)
• Office 365 (OFFICE_365)
• Office 365 Message Trace (OFFICE_365_MESSAGETRACE)
• Opengear Remote Management (OPENGEAR)
• Oracle (ORACLE_DB)
• OSQuery (OSQUERY_EDR)
• OSSEC (OSSEC)
• Palo Alto Cortex XDR Alerts (CORTEX_XDR)
• Palo Alto Networks Firewall (PAN_FIREWALL)
• Palo Alto Prisma Cloud (PAN_PRISMA_CLOUD)
• PerimeterX Bot Protection (PERIMETERX_BOT_PROTECTION)
• Phishlabs (PHISHLABS)
• Proofpoint Tap Alerts (PROOFPOINT_MAIL)
• Pulse Secure (PULSE_SECURE_VPN)
• Riverbed Steelhead (STEELHEAD)
• RSA SecurID Access Identity Router (RSA_SECURID)
• SAP SM20 (SAP_SM20)
• SAP SuccessFactors (SAP_SUCCESSFACTORS)
• SAP Webdispatcher (SAP_WEBDISP)
• Security Command Center Posture Violation (GCP_SECURITYCENTER_POSTURE_VIOLATION)
• Security Command Center Threat (N/A)
• Security Command Center Toxic Combination (GCP_SECURITYCENTER_TOXIC_COMBINATION)
• Sentinelone Alerts (SENTINELONE_ALERT)
• SentinelOne EDR (SENTINEL_EDR)
• SentinelOne Singularity Cloud Funnel (SENTINELONE_CF)
• Snare System Diagnostic Logs (SNARE_SOLUTIONS)
• Solaris system (SOLARIS_SYSTEM)
• SonicWall (SONIC_FIREWALL)
• Sonicwall Secure Mobile Access (SONICWALL_SMA)
• Splunk Platform (SPLUNK)
• Squid Web Proxy (SQUID_WEBPROXY)
• Suricata EVE (SURICATA_EVE)
• Suricata IDS (SURICATA_IDS)
• Swift Alliance Messaging Hub (SWIFT_AMH)
• Symantec CloudSOC CASB (SYMANTEC_CASB)
• Symantec DLP (SYMANTEC_DLP)
• Tenable OT (TENABLE_OT)
• Tetragon Ebpf Audit Logs (TETRAGON_EBPF_AUDIT_LOGS)
• Trellix HX Event Streamer (TRELLIX_HX_ES)
• Trend Micro (TIPPING_POINT)
• Trend Micro Cloud one (TRENDMICRO_CLOUDONE)
• Trend Micro Deep Security (TRENDMICRO_DEEP_SECURITY)
• TrendMicro Apex Central (TRENDMICRO_APEX_CENTRAL)
• TrendMicro Web Proxy (TRENDMICRO_WEBPROXY)
• Unifi AP (UNIFI_AP)
• Unix system (NIX_SYSTEM)
• Vectra Detect (VECTRA_DETECT)
• VeridiumID by Veridium (VERIDIUM_ID)
• VPC Flow Logs (GCP_VPC_FLOW)
• Windows Defender ATP (WINDOWS_DEFENDER_ATP)
• Windows DNS (WINDOWS_DNS)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• Windows Network Policy Server (WINDOWS_NET_POLICY_SERVER)
• Windows Sysmon (WINDOWS_SYSMON)
• Workspace Activities (WORKSPACE_ACTIVITY)
• Workspace Alerts (WORKSPACE_ALERTS)
• Workspace ChromeOS Devices (WORKSPACE_CHROMEOS)
• Workspace Groups (WORKSPACE_GROUPS)
• Workspace Mobile Devices (WORKSPACE_MOBILE)
• Workspace Privileges (WORKSPACE_PRIVILEGES)
• Workspace Users (WORKSPACE_USERS)
• YAMAHA ROUTER RTX1200 (YAMAHA_ROUTER)
• Zeek JSON (BRO_JSON)
• Zimperium (ZIMPERIUM)
• Zscaler (ZSCALER_WEBPROXY)
• Zscaler CASB (ZSCALER_CASB)
• ZScaler NGFW (ZSCALER_FIREWALL)

The following log types, without a default parser, were added. Each is listed by product name and log_type value, if applicable.

• Adaxes (ADAXES)
• Air Table (AIR_TABLE)
• Alert Enterprise Guardian (ALERT_GUARDIAN)
• Amavis (AMAVIS)
• Atlassian Beacon (ATLASSIAN_BEACON)
• Banner dd (BANNER_DD)
• BetterStack Uptime (BETTERSTACK_UPTIME)
• BloodHound (BLOODHOUND)
• Core Privileged Access Manager (BoKS) (BOKS)
• Cisco Secure Access (CISCO_SECURE_ACCESS)
• Cleafy (CLEAFY)
• Clear Bank Portal Audit (CLEARBANK_PORTAL)
• CloudBees (CLOUDBEES)
• Comforte SecurDPS (COMFORTE_SECURDPS)
• Control Plane (CONTROL_PLANE)
• Corrata (CORRATA)
• Cubist Audit (CUBIST_AUDIT)
• C Zentrix (C_ZENTRIX)
• DefectDojo (DEFECTDOJO)
• Dmarcian (DMARCIAN)
• DocuSign (DOCUSIGN)
• Duo Activity Logs (DUO_ACTIVITY)
• E2 Guardian (E2_GUARDIAN)
• Egress Defend (EGRESS_DEFEND)
• Egress Prevent (EGRESS_PREVENT)
• Emsisoft AntiVirus (EMSISOFT_ANTIVIRUS)
• F5 System Logs (F5_SYSTEM_LOGS)
• Fastly CDN (FASTLY_CDN)
• FireEye CMS (FIREEYE_CMS)
• Forcepoint Mail Relay (FORCEPOINT_MAIL_RELAY)
• Google Ads (GOOGLE_ADS)
• H3C Comware Platform Switch
• Halcyon Anti Ransomware (HALCYON)
• Halo (HALO)
• HP Poly (HP_POLY)
• Huawei CloudEngine (HUAWEI_CLOUDENGINE)
• Intruder.IO (INTRUDER_IO)
• Ivanti Connect Secure (IVANTI_CONNECT_SECURE)
• Keyfactor (KEYFACTOR)
• Kyverno (KYVERNO)
• LaunchDarkly (LAUNCH_DARKLY)
• LeanIX Enterprise (LEANIX)
• Leanix CMDB (LEANIX_CMDB)
• Lucid (LUCID)
• Lumeta Spectre (LUMETA)
• ManageEngine Asset Explorer (MANAGE_ENGINE_ASSET_EXPLR)
• ManageEngine Endpoint Central (MANAGE_ENGINE_ENDPT_CNTRL)
• Mandiant Digital Threat Monitoring (MANDIANT_DTM_ALERTS)
• Manhattan Warehouse Management System (MANHATTAN_WMS)
• Mend IO (MEND_IO)
• Meta Marketing (META_MARKETING)
• Miasma SecretScanner (MIASMA_SECRETSCANNER)
• Microsoft Ads (MICROSOFT_ADS)
• Microsoft Purview (MICROSOFT_PURVIEW)
• ModSecurity (MODSECURITY)
• Netapp Storagegrid (NETAPP_STORAGEGRID)
• NetBrain (NETBRAIN)
• Netenrich Entity Context (NETENRICH_ENTITY_CONTEXT)
• Netwrix Activity Monitor (NETWRIX_ACTIVITY_MONITOR)
• Netwrix Stealth Intercept (NETWRIX_STEALTH_INTERCEPT)
• Netwrix Threat Manager (NETWRIX_THREAT_MANAGER)
• Nexus Sonatype (NEXUS_SONATYPE)
• Oracle Fusion (ORACLE_FUSION)
• PAGELY (PAGELY)
• Palantir (PALANTIR)
• Proofpoint Meta (PROOFPOINT_META)
• Qumulo FS (QUMULO_FS)
• Radware Alteon (RADWARE_ALTEON)
• SailPoint IdentityIQ (SAILPOINT_IIQ)
• Sentinelone Activity (SENTINELONE_ACTIVITY)
• Siga Level Zero OT Resilience (SIGA)
• Site24x7 (SITE24X7)
• Winevtlog Snare (SNARE_WINEVTLOG)
• Solar System (SOLAR_SYSTEM)
• Stealthbits DLP (STEALTHBITS_DLP)
• Symantec VIP Authentication Hub (SYMANTEC_VIP_AUTHHUB)
• Temenos Journey Manager System Event Publisher (TEMENOS_MANAGER_SYSTEMEVENT)
• Teradata Aster (TERADATA_ASTER)
• Tiktok for Developers (TIKTOK)
• Transmit BindID (TRANSMIT_BINDID)
• Trend Micro Vision One Audit (TRENDMICRO_VISION_ONE_AUDIT)
• Trend Micro Vision One Observerd Attack Techniques (TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES)
• Trend Micro Vision One Workbench (TRENDMICRO_VISION_ONE_WORKBENCH)
• TrueNAS (TRUENAS)
• E-Motional Transparent Screen Lock TSL RFID (TSL_PRO)
• UPX AntiDDoS (UPX_ANTIDDOS)
• Verba Recording System (VERBA_REC)
• Vercara (VERCARA)
• Veza Access Control Platform (VEZA)
• Web Methods Api Gateway (WEBMETHODS_API_GATEWAY)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

The feed management feature is now enhanced to include the following:

• Feed names: You can assign custom names to new and existing data feeds.
• Troubleshooting information: You can diagnose error feeds by accessing detailed information about the cause of an issue and recommended actions.
• Last succeeded time: Stay informed about the status of a feed, with a timestamp identifying when data was last successfully fetched by each feed.

There is no longer a limit on the number of feeds you can create for the same log type in Feed Management.

Case filter and URL now in a reciprocal relationship

In the Cases page, the filter and the URL now directly affect each other. Changing the filter changes the URL, and conversely, changing the URL changes the filter. You can take advantage of this feature by setting a filter for cases and putting the newly created URL in an external dashboard. Clicking on this link would then take you directly to the filtered case queue.

The following supported default parsers have changed. Each is listed by product name and log_type value, if applicable.

• Akamai WAF (AKAMAI_WAF)
• Alcatel Switch (ALCATEL_SWITCH)
• Arcsight CEF (ARCSIGHT_CEF)
• Auth0 (AUTH_ZERO)
• AWS Cloudtrail (AWS_CLOUDTRAIL)
• AWS Config (AWS_CONFIG)
• AWS GuardDuty (GUARDDUTY)
• Azure AD (AZURE_AD)
• Azure AD Directory Audit (AZURE_AD_AUDIT)
• Azure App Service (AZURE_APP_SERVICE)
• Azure Key Vault logging (AZURE_KEYVAULT_AUDIT)
• BIND (BIND_DNS)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• Box (BOX)
• Chrome Management (N/A)
• Cisco AMP (CISCO_AMP)
• Cisco Umbrella DNS (UMBRELLA_DNS)
• Cisco VPN (CISCO_VPN)
• Citrix Netscaler (CITRIX_NETSCALER)
• Cloud Audit Logs (N/A)
• Cloudflare (CLOUDFLARE)
• Cofense (COFENSE_TRIAGE)
• Corelight (CORELIGHT)
• CrowdStrike Falcon (CS_EDR)
• CSV Custom IOC (CSV_CUSTOM_IOC)
• Custom Application Access Logs (CUSTOM_APPLICATION_ACCESS)
• Cybergatekeeper NAC (CYBERGATEKEEPER_NAC)
• Extreme Wireless (EXTREME_WIRELESS)
• F5 ASM (F5_ASM)
• F5 BIGIP LTM (F5_BIGIP_LTM)
• Falco IDS (FALCO_IDS)
• FireEye (FIREEYE_ALERT)
• FireEye ETP (FIREEYE_ETP)
• ForgeRock Identity Cloud (FORGEROCK_IDENTITY_CLOUD)
• FortiGate (FORTINET_FIREWALL)
• GCP_APP_ENGINE (GCP_APP_ENGINE)
• HP Procurve Switch (HP_PROCURVE)
• IAM Context (N/A)
• IBM DB2 (DB2_DB)
• IBM Mainframe Storage (IBM_MAINFRAME_STORAGE)
• IBM Security Access Manager (IBM_SAM)
• Illumio Core (ILLUMIO_CORE)
• Imperva (IMPERVA_WAF)
• Infoblox (INFOBLOX)
• JAMF CMDB (JAMF)
• KerioControl Firewall (KERIOCONTROL)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Microsoft Azure Resource (AZURE_RESOURCE_LOGS)
• Microsoft Defender For Cloud (MICROSOFT_DEFENDER_CLOUD_ALERTS)
• Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
• Microsoft Exchange (EXCHANGE_MAIL)
• Microsoft Graph Activity Logs (MICROSOFT_GRAPH_ACTIVITY_LOGS)
• Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
• Microsoft IIS (IIS)
• Microsoft System Center Endpoint Protection (MICROSOFT_SCEP)
• Mobile Endpoint Security (LOOKOUT_MOBILE_ENDPOINT_SECURITY)
• Mongo Database (MONGO_DB)
• Netscout OCI (NETSCOUT_OCI)
• Netskope (NETSKOPE_ALERT)
• Netskope Web Proxy (NETSKOPE_WEBPROXY)
• Network Policy Server (MICROSOFT_NPS)
• Nutanix Prism (NUTANIX_PRISM)
• Office 365 (OFFICE_365)
• Okta (OKTA)
• OpenCanary (OPENCANARY)
• Ordr IoT (ORDR_IOT)
• Palo Alto Cortex XDR Alerts (CORTEX_XDR)
• Palo Alto Networks Firewall (PAN_FIREWALL)
• Palo Alto Prisma Cloud (PAN_PRISMA_CLOUD)
• PerimeterX Bot Protection (PERIMETERX_BOT_PROTECTION)
• Phishlabs (PHISHLABS)
• Proofpoint Sendmail Sentrion (PROOFPOINT_SENDMAIL_SENTRION)
• Pulse Secure (PULSE_SECURE_VPN)
• RH-ISAC (RH_ISAC_IOC)
• SailPoint IAM (SAILPOINT_IAM)
• Salesforce (SALESFORCE)
• Sap Business Technology Platform (SAP_BTP)
• Security Command Center Threat (N/A)
• Sentinelone Alerts (SENTINELONE_ALERT)
• Shibboleth IDP (SHIBBOLETH_IDP)
• Sourcefire (SOURCEFIRE_IDS)
• Splunk Attack Analyzer (SPLUNK_ATTACK_ANALYZER)
• STIX Threat Intelligence (STIX)
• Symantec CloudSOC CASB (SYMANTEC_CASB)
• Symantec DLP (SYMANTEC_DLP)
• Tanium Asset (TANIUM_ASSET)
• Thinkst Canary (THINKST_CANARY)
• Trend Micro Deep Security (TRENDMICRO_DEEP_SECURITY)
• Vectra Detect (VECTRA_DETECT)
• Vectra Stream (VECTRA_STREAM)
• VeridiumID by Veridium (VERIDIUM_ID)
• Wazuh (WAZUH)
• Windows Defender ATP (WINDOWS_DEFENDER_ATP)
• Windows DNS (WINDOWS_DNS)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• Windows Local Administrator Password Solution (MICROSOFT_LAPS)
• wiz.io (WIZ_IO)
• Workspace Activities (WORKSPACE_ACTIVITY)
• XAMS by Xiting (XITING_XAMS)
• Zscaler CASB (ZSCALER_CASB)
• Zscaler DLP (ZSCALER_DLP)
• Zscaler Internet Access Audit Logs (ZSCALER_INTERNET_ACCESS)

The following log types, without a default parser, were added. Each is listed by product name and log_type value, if applicable.

• Aruba Switch (ARUBA_SWITCH)
• Azure AD Password Protection (AZURE_AD_PASSWORD_PROTECTION)
• Azure Front Door (AZURE_FRONT_DOOR)
• Babelforce (BABELFORCE)
• Cloudaware (CLOUDAWARE)
• Coalition Control API (COALITION)
• Crowdstrike Identity Protection Services (CS_IDP)
• Cymulate (CYMULATE)
• Dell ECS Enterprise Object Storage (DELL_ECS)
• Google Cloud NGFW Enterprise (GCP_NGFW_ENTERPRISE)
• Google Cloud Secure Web Proxy (GCP_SWP)
• HaveIBeenPwned (HIBP)
• HPE BladeSystem C7000 (HPE_BLADESYSTEM_C7000)
• HP OpenView (HP_OPENVIEW)
• IBM DS8000 Storage (IBM_DS8000)
• IBM-i Operating System (IBM_I)
• Multicom Switch (MULTICOM_SWITCH)
• Nextthink Finder (NEXTTHINK_FINDER)
• Palo Alto Cortex XDR Management Audit (PAN_XDR_MGMT_AUDIT)
• PingIdentity Directory Server Logs (PING_DIRECTORY)
• Prisma SD-WAN (PRISMA_SD_WAN)
• Redhat Jboss (REDHAT_JBOSS)
• SafeBreach (SAFEBREACH)
• Scality Ring Audit (SCALITY_RING_AUDIT)
• Sendsafely (SENDSAFELY)
• Solace Pub Sub Cloud (SOLACE_AUDIT)
• Sonicwall Secure Mobile Access (SONICWALL_SMA)
• Sonrai Enterprise Cloud Security Solution (SONRAI)
• Tenemos Journey Manager System Event Publisher (TENEMOS_MANAGER_SYSTEMEVENT)
• TrueFort Platform (TRUEFORT)
• Ubiquiti Accesspoint (UBIQUITI_ACCESSPOINT)
• WithSecure Cloud Protection (WITHSECURE_CLOUD)
• WithSecure Elements Connector (WITHSECURE_ELEMENTS)
• YAMAHA ROUTER RTX1200 (YAMAHA_ROUTER)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

In the Entity Explorer page, Case Distribution has been renamed to Alert Distribution.

The following supported default parsers have changed. Each is listed by product name and log_type value, if applicable.

• A10 Load Balancer (A10_LOAD_BALANCER)
• Anomali (ANOMALI_IOC)
• Apache (APACHE)
• Arcsight CEF (ARCSIGHT_CEF)
• AWS CloudWatch (AWS_CLOUDWATCH)
• AWS EC2 Hosts (AWS_EC2_HOSTS)
• AWS EC2 Instances (AWS_EC2_INSTANCES)
• AWS EC2 VPCs (AWS_EC2_VPCS)
• Azure AD (AZURE_AD)
• Azure AD Directory Audit (AZURE_AD_AUDIT)
• Azure DevOps Audit (AZURE_DEVOPS)
• Azure Firewall (AZURE_FIREWALL)
• BIND (BIND_DNS)
• BloxOne Threat Defense (BLOXONE)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• Carbon Black (CB_EDR)
• Cato Networks (CATO_NETWORKS)
• CENSYS (CENSYS)
• Check Point (CHECKPOINT_FIREWALL)
• Chrome Management (N/A)
• Cisco IronPort (CISCO_IRONPORT)
• Cisco Meraki (CISCO_MERAKI)
• Cisco Prime (CISCO_PRIME)
• Cisco Secure Workload (CISCO_SECURE_WORKLOAD)
• Citrix Netscaler (CITRIX_NETSCALER)
• Cloud Audit Logs (N/A)
• Cloud Load Balancing (GCP_LOADBALANCING)
• Cloud Run (GCP_RUN)
• Cloudflare (CLOUDFLARE)
• CommVault Commcell (COMMVAULT_COMMCELL)
• Compute Context (N/A)
• Corelight (CORELIGHT)
• CrowdStrike Detection Monitoring (CS_DETECTS)
• CSV Custom IOC (CSV_CUSTOM_IOC)
• Cybereason EDR (CYBEREASON_EDR)
• Dataminr Alerts (DATAMINR_ALERT)
• Elastic Windows Event Log Beats (ELASTIC_WINLOGBEAT)
• F5 BIGIP LTM (F5_BIGIP_LTM)
• FireEye ETP (FIREEYE_ETP)
• Forescout NAC (FORESCOUT_NAC)
• ForgeRock OpenAM (OPENAM)
• IBM WebSEAL (IBM_WEBSEAL)
• Imperva (IMPERVA_WAF)
• Imperva Database (IMPERVA_DB)
• Infoblox RPZ (INFOBLOX_RPZ)
• ISC DHCP (ISC_DHCP)
• Juniper (JUNIPER_FIREWALL)
• Linux Sysmon (LINUX_SYSMON)
• LogonBox (LOGONBOX)
• ManageEngine ADAudit Plus (ADAUDIT_PLUS)
• Micro Focus iManager (MICROFOCUS_IMANAGER)
• Microsoft AD (WINDOWS_AD)
• Microsoft ATA (MICROSOFT_ATA)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Microsoft Defender For Cloud (MICROSOFT_DEFENDER_CLOUD_ALERTS)
• Microsoft Exchange (EXCHANGE_MAIL)
• Microsoft IIS (IIS)
• Netskope (NETSKOPE_ALERT)
• Netskope CASB (NETSKOPE_CASB)
• Ntopng (NTOPNG)
• Office 365 (OFFICE_365)
• OpenCanary (OPENCANARY)
• OpenSSH (OPENSSH)
• OSSEC (OSSEC)
• Palo Alto Cortex XDR Alerts (CORTEX_XDR)
• Palo Alto Networks Firewall (PAN_FIREWALL)
• Palo Alto Panorama (PAN_PANORAMA)
• Quest Active Directory (QUEST_AD)
• Recordia (RECORDIA)
• Sangfor Next Generation Firewall (SANGFOR_NGAF)
• SAP SM20 (SAP_SM20)
• Security Command Center Threat (N/A)
• SEPPmail Secure Email (SEPPMAIL)
• ServiceNow CMDB (SERVICENOW_CMDB)
• Snare System Diagnostic Logs (SNARE_SOLUTIONS)
• Solaris system (SOLARIS_SYSTEM)
• STIX Threat Intelligence (STIX)
• Symantec CloudSOC CASB (SYMANTEC_CASB)
• Symantec Web Security Service (SYMANTEC_WSS)
• Trend Micro Deep Security (TRENDMICRO_DEEP_SECURITY)
• Veritas NetBackup (VERITAS_NETBACKUP)
• VMware ESXi (VMWARE_ESX)
• Watchguard EDR (WATCHGUARD_EDR)
• WindChill (WINDCHILL)
• Windows Defender AV (WINDOWS_DEFENDER_AV)
• Windows DNS (WINDOWS_DNS)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• wiz.io (WIZ_IO)
• Zeek JSON (BRO_JSON)
• Zscaler (ZSCALER_WEBPROXY)
• Zscaler CASB (ZSCALER_CASB)
• Zscaler Internet Access Audit Logs (ZSCALER_INTERNET_ACCESS)
• Zscaler Private Access (ZSCALER_ZPA)

The following log types, without a default parser, were added. Each is listed by product name and log_type value, if applicable.

• Arista Guardian For Network Identity (ARISTA_AGNI)
• HPE Aruba Networking Central (ARUBA_CENTRAL)
• Blackberry Workspaces (BLACKBERRY_WORKSPACES)
• Barracuda CloudGen Firewall (BARRACUDA_CLOUDGEN_FIREWALL)
• Blackberry Workspaces (BLACKBERRY_WORKSPACES)
• Cisco EStreamer (CISCO_ESTREAMER)
• Cyderes IOC (CYDERES_IOC)
• Dataiku DSS Logging (DATAIKU_DSS_LOGS)
• Edgecore Networks (EDGECORE_NETWORKS)
• Fisglobal Quantum (FISGLOBAL_QUANTUM)
• ForgeRock Identity Cloud (FORGEROCK_IDENTITY_CLOUD)
• Forgerock OpenIdM (FORGEROCK_OPENIDM)
• FS-ISAC IOC (FS_ISAC_IOC)
• Genetec Audit (GENETEC_AUDIT)
• HiBob (HIBOB)
• Imperva Audit Trail (IMPERVA_AUDIT_TRAIL)
• KerioControl Firewall (KERIOCONTROL)
• Looker Audit (LOOKER_AUDIT)
• Mobile Endpoint Security (LOOKOUT_MOBILE_ENDPOINT_SECURITY)
• ManageEngine PAM360 (MANAGE_ENGINE_PAM360)
• Melissa (MELISSA)
• Microsoft CASB Files & Entities (MICROSOFT_CASB_CONTEXT)
• Windows Local Administrator Password Solution (MICROSOFT_LAPS)
• Network Policy Server (MICROSOFT_NPS)
• Power BI Activity Log (MICROSOFT_POWERBI_ACTIVITY_LOG)
• Nxlog Agent (NXLOG_AGENT)
• Nxlog Fim (NXLOG_FIM)
• Opus Codec (OPUS)
• Oracle NetSuite (ORACLE_NETSUITE)
• Pega Automation (PEGA)
• Qualys Knowledgebase (QUALYS_KNOWLEDGEBASE)
• RealiteQ (REALITEQ)
• SAP Webdispatcher (SAP_WEBDISP)
• Serpico (SERPICO)
• Software House Ccure9000 (SOFTWARE_HOUSE_CCURE9000)
• Spirion (SPIRION)
• Spur data feeds (SPUR_FEEDS)
• Swift (SWIFT)
• Technitium DNS (TECHNITIUM_DNS)
• Tetragon Ebpf Audit Logs (TETRAGON_EBPF_AUDIT_LOGS)
• Trend Micro Email Security Advanced (TRENDMICRO_EMAIL_SECURITY)
• Tridium Niagara Framework (TRIDIUM_NIAGARA_FRAMEWORK)
• VeridiumID by Veridium (VERIDIUM_ID)
• Wallarm Webhook Notifications (WALLARM_NOTIFICATIONS)
• Winscp (WINSCP)
• XAMS by Xiting (XITING_XAMS)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Chronicle requires a minimum Transport Layer Security (TLS) version of 1.2 to maintain security compliance. Ingestion routing connections that use lower TLS versions are automatically blocked. Upgrade any custom ingestion mechanisms to adhere to TLS 1.2 or higher.

When the data ingestion rate for a tenant reaches a certain threshold, Chronicle controls the rate of ingestion for new data feeds to prevent a source with a high ingestion rate from affecting the ingestion rate of another data source. The ingestion volume and tenant's usage history determine the threshold. If the rate of ingestion does not deviate greatly then there is no effect on the ingestion rate.

Chronicle Curated Detections has been enhanced with new detection content for Linux Threats. These new rule sets help identify malware and suspicious activity in Linux environments.

The following supported default parsers have changed. Each is listed by product name and log_type value, if applicable.

• ADVA Fiber Service Platform (ADVA_FSP)
• Anomali (ANOMALI_IOC)
• Apache (APACHE)
• AWS EMR (AWS_EMR)
• AWS Route 53 DNS (AWS_ROUTE_53)
• AWS WAF (AWS_WAF)
• Azure AD Directory Audit (AZURE_AD_AUDIT)
• Azure Application Gateway (AZURE_GATEWAY)
• BIND (BIND_DNS)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• Carbon Black (CB_EDR)
• Check Point (CHECKPOINT_FIREWALL)
• Cisco ASA (CISCO_ASA_FIREWALL)
• Cisco DNA Center Platform (CISCO_DNAC)
• Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
• CrowdStrike Falcon (CS_EDR)
• Darktrace (DARKTRACE)
• Deep Instinct EDR (DEEP_INSTINCT_EDR)
• Elastic Windows Event Log Beats (ELASTIC_WINLOGBEAT)
• Extreme Networks Switch (EXTREME_SWITCH)
• F5 ASM (F5_ASM)
• F5 BIGIP LTM (F5_BIGIP_LTM)
• Forescout NAC (FORESCOUT_NAC)
• Fortinet FortiClient (FORTINET_FORTICLIENT)
• GitHub (GITHUB)
• GMAIL Logs (GMAIL_LOGS)
• IBM DB2 (DB2_DB)
• IBM Guardium (GUARDIUM)
• Jamf Protect Alerts (JAMF_PROTECT)
• Juniper (JUNIPER_FIREWALL)
• Kubernetes Node (KUBERNETES_NODE)
• Mandiant Custom IOC (MANDIANT_CUSTOM_IOC)
• Mattermost (MATTERMOST)
• Microsoft Exchange (EXCHANGE_MAIL)
• Microsoft IIS (IIS)
• Microsoft SQL Server (MICROSOFT_SQL)
• Nutanix Prism (NUTANIX_PRISM)
• Office 365 (OFFICE_365)
• Okta (OKTA)
• Palo Alto Cortex XDR Events (PAN_CORTEX_XDR_EVENTS)
• Palo Alto Networks Firewall (PAN_FIREWALL)
• Proofpoint Observeit (OBSERVEIT)
• RH-ISAC (RH_ISAC_IOC)
• SAP SAST Suite (SAP_SAST)
• Security Command Center Threat (N/A)
• SentinelOne Singularity Cloud Funnel (SENTINELONE_CF)
• Symantec DLP (SYMANTEC_DLP)
• Talon (TALON)
• Tanium Stream (TANIUM_TH)
• Trend Micro Apex one (TRENDMICRO_APEX_ONE)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• wiz.io (WIZ_IO)
• Zscaler (ZSCALER_WEBPROXY)
• Zscaler CASB (ZSCALER_CASB)
• Zscaler Tunnel (ZSCALER_TUNNEL)

The following log types, without a default parser, were added. Each is listed by product name and log_type value, if applicable.

• Asimily (ASIMILY)
• Checkpoint Gaia (CHECKPOINT_GAIA)
• Cisco Cyber Vision (CISCO_CYBER_VISION)
• Cisco IronPort (CISCO_IRONPORT)
• Cyber 2.0 IDS (CYBER_2_IDS)
• CypherTrust Manager (CYPHERTRUST_MANAGER)
• Duo Trust Monitor (DUO_TRUST_MONITOR)
• Extreme Wireless (EXTREME_WIRELESS)
• FireEye PX (FIREEYE_PX)
• Harfanglab EDR (HARFANGLAB_EDR)
• ImageNow (IMAGENOW)
• INFINICO NetWyvern Series Appliance (INFINICO_NETWYVERN)
• Quest CA Audit (QUEST_CA_AUDIT)
• Quest Change Auditor for EMC (QUEST_CHANGE_AUDITOR_EMC)
• Quest File Access Audit (QUEST_FILE_AUDIT)
• RadiFlow IDS (RADIFLOW_IDS) rigo (SENTRIGO)
• SEPPmail Secure Email (SEPPMAIL)
• SpecterX (SPECTERX)
• ViaControl Server Application (VIACONTROL)
• WindChill (WINDCHILL)
• WS Ftp (WS_FTP)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

The following changes are available in the Unified Data Model.

• New objects were added:

  • DNSRecord
  • Favicon
  • ThreatVerdict
  • PopularityRank
  • SSLCertificate
  • SSLCertificate.AuthorityKeyId
  • SSLCertificate.CertSignature
  • SSLCertificate.DSA
  • SSLCertificate.EC
  • SSLCertificate.Extension
  • SSLCertificate.PublicKey
  • SSLCertificate.RSA
  • SSLCertificate.Subject
  • SSLCertificate.Validity
  • Tracker
  • Url
  • SecurityResult.AnalyticsMetadata

• A new field was added to Noun: url_metadata.

• New fields were added to SecurityResult:

  • ruleset_category_display_name
  • confidence_score
  • analytics_metadata
  • threat_verdict
  • last_discovered_time

• New fields were added to Domain:

  • last_dns_records
  • categories
  • favicon
  • jarm
  • last_dns_records
  • last_dns_records_time
  • last_https_certificate
  • last_https_certificate_time
  • popularity_ranks
  • tags
  • whois_time

• New fields were added to File: security_result and main_icon.

• New fields were added to SecurityResult.Association: sponsor_region, targeted_regions, and tags.

• New values were added to File.FileType:

  FILE_TYPE_DWG	FILE_TYPE_DXF
  FILE_TYPE_THREEDS	FILE_TYPE_WEBM
  FILE_TYPE_MKV	FILE_TYPE_ONE_NOTE
  FILE_TYPE_OOXML	FILE_TYPE_ZST
  FILE_TYPE_LZFSE	FILE_TYPE_PYTHON_WHL
  FILE_TYPE_PYTHON_PKG	FILE_TYPE_M4
  FILE_TYPE_OBJETIVEC	FILE_TYPE_JMOD
  FILE_TYPE_MAKEFILE	FILE_TYPE_INI
  FILE_TYPE_CLJ	FILE_TYPE_PDB
  FILE_TYPE_SQL	FILE_TYPE_NEKO
  FILE_TYPE_WER	FILE_TYPE_GOLANG
  FILE_TYPE_SGML	FILE_TYPE_JSON
  FILE_TYPE_CSV	FILE_TYPE_SQUASHFS
  FILE_TYPE_VHD	FILE_TYPE_IPS
  FILE_TYPE_PEM	FILE_TYPE_PGP
  FILE_TYPE_CRT	FILE_TYPE_PYC

• New values were added to Metric.Dimension:

  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME

• A new value was added to Metric.MetricName: ALERT_EVENT_NAME_COUNT.

• A new value was added to SecurityResult.ProductSeverity: NONE.

For a list of all fields in the Unified Data Model, and their descriptions, see the Unified Data Model field list.