Announcing Graylog Illuminate 3.3.1
- This version of Illuminate requires Graylog Server version 5.0.3 or later
- Converted Fortigate from using event_code to event_id
- While the Fortigate field is numeric it contains leading 0’s and is not intended to be used as a literal numeric value
- event_code is used for numeric fields to allow ranged searches and other numeric operators
- Defined static mappings for the fields event_code and event_id
- These fields previously relied on dynamic mappings but this caused mapping conflict errors
GRAYLOG ILLUMINATE 3.3.1
Released: 2023-06-02
Fixes
- event_code and event_id not mapped (#920)
- pfSense dashboard widgets not aligned (#1310)
- pfSense dashboard time series graphs not displaying correctly (#1316)
- Checkpoint event_action value using allowed and not allow (#1321)
- Checkpoint event_severity_level not always defined (#1325)
- Watchguard not identifying some message formats (#1331)
- Snort Spotlight IDS tab missing widget title (#1328)
Enhancements
- Additional field renaming for Snort 3 IDS logs (#1304)
- Improved Cisco ASA saved search (#1306)
Known Issues
- Auditbeat cannot process events with multiple values assigned to vendor_event_action (#622)
Let us know what you’d like to have included in our GitHub issue tracker.
