<html lang="en">
<body>
 
<p>
	<b>[OOTB] PTsecurity Sandbox. Version 1</b><br>
	This is the first version of the package.<br>
	Change log:
		<ul>
        	<li>The description in the main normalizer has been changed.</li>
        	<li>The main normalizer has been changed. One new regular expression has been added.  One old regular expression has been removed. The mutations for the mapping of source field "hostname" to KUMA field "DeviceHostName" have been changed. The mutation of type "lower" has been deleted. The mapping of the source field "cat" has been changed from KUMA field "DeviceEventCategory" to KUMA field "DeviceEventClassID". The mapping of the source field "app" to the KUMA field "DeviceProduct" has been removed. The enrichment of type "event" for the target field "DestinationNtDomain" has been added. The enrichment of type "event" for the target field "DestinationUserName" has been added. The enrichment of type "event" for the target field "DestinationAddress" has been added. The enrichment of type "event" for the target field "DeviceHostName" has been added. </li>
        	<li>New extra normalizers "new_artifact", "scan_machine.file_result.melded", "scan_machine.file_result.av", "scan_machine.final_result", "user_scan.start", "user_scan.finish", "av.update", "scan_machine.new_object", "audit.event", "other event types" have been added.</li>
        	<li>Extra normalizer "PT Sandbox JSON" has been removed.</li>
		</ul>
</p>

</body>
</html>