<html lang="en">
<body>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 14</b><br>
	Change list:
		<ul>
			<li>New extra normalizers were added: 33205, "33205 data KV part", "33205 additional_information xml parsing", 4902.</li>
			<li>New event names for evend ID 33205 was added to the dictionary "[OOTB] Windows. EventIDs and Event Names mapping".</li>
		</ul>
</p>


<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 13</b><br>
	Change list:
		<ul>
			<li>Filter of the extra normalizer "Extra 5136" was fixed (space symbol was removed).</li>
			<li>Dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was edited. Symbol " was removed from the description of event with ID 1317. Event name was added for event with ID 1535.</li>
			<li>Normalizer "4701" was edited. Mapping of event field "Task.version" was changed from KUMA field DeviceVersion to DeviceCustomFloatingPoint1. Mapping of event field "Task.Settings.StopIfGoingOnBatteries" as removed from event field DeviceCustomString5. Mapping of event field "Task.Actions.Exec.Aruments" was mapped to the KUMA field DeviceCustomString5. Mapping of event field "Task.Settings.DisallowStartIfOnBatteries" was removed from event field DeviceCustomString4. Mapping of event field "Task.Actions.Exec.Command" was mapped from the KUMA field DeviceAction to the KUMA field DeviceCustomString4. Mapping of event field "Task.Settings.ExecutionTimeLimit" was removed from event field DeviceCustomString2. Mapping of event field "Task.RegistrationInfo.URI" was changed fom KUMA field SourceProcessId to the KUMA field DeviceCustomString2. Mapping of event field "Task.Settings.MultipleInstancesPolicy" was removed from event field DeviceCustomString3. Mapping of event field "Task.RegistrationInfo.Author" was changed fom KUMA field SourceProcessName to the KUMA field DeviceCustomString3. Mapping of event field "Task.Settings.StartWhenAvailable" was removed from event field DeviceCustomString6.</li>
			<li>Extra normalizer "6144,6145" was changed. Event field "Event.EventData.Data.ErrorCode" was mapped to the KUMA field Reason. Event field "Event.EventData.Data.GPOList" was mapped from the KUMA field "DeviceCustomString1" to the KUMA field "S.GPOList". Event enrichment was added to the KUMA field "DeviceCustomString1"(data from the S.GPOList field copied to the KUMA field DeviceCustomString1). Event enrichment with constant was added to the KUMA field DeviceCustomString1Label.</li>
			<li>Extra normalizer "5145" was changed. Mutation was removed from the event field "Event.EventData.Data.ShareName". New enrichment was added. Data from KUMA field DeviceCustomString2 was duplicated to the KUMA field DeviceCustomString6.</li>
			<li>New enrichment with template was added to the KUMA field SourceHostName in the extra normalizer "5156".</li>
			<li>Extra normalizer 4662 was edited. Mapping of event field "Event.EventData.Data.ObjectType" was removed from the KUMA field DeviceCustomString5.</li>
			<li>Event enrichment (template) in the KUMA field DeviceCustomString6 was updated in the extra normalizer "User Account Management".</li>
			<li>New extra normalizers were added "1535", "4886", "4887", "4900", "4882", "4899", "5827 5829 5830", "5828 5831".</li>
			<li>Extra normalizer was edited "4898". Event field "Event.EventData.Data.TemplateInternalName" was mapped to the KUMA field FileName. Event field "Event.EventData.Data.TemplateOID" was mapped to the KUMA field DeviceCustomString4.</li>
			<li>Extra normalizer "4882 4883 4884 4885" was renamed to "4883 4884 4885". Event ID 4882 was removed from the extra normalizer "4883 4884 4885" condition.</li>
			<li>Extra normalizer "5168" was changed. Event name "Event.EventData.Data.ConfiguredNames" was mapped to the KUMA field DeviceCustomString1. Event field "Event.EventData.Data.SpnName" was mapped to the KUMA field DeviceCustomString2. Event field "Event.EventData.Data.ErrorCode" was mapped from the KUMA field DeviceCustomString4 to the KUMA field Reason. Event field "Event.EventData.Data.IpAddresses" was mapped to the KUMA field DeviceCustomString4. Event field "Event.EventData.Data.SubjectUserSid" was mapped from the KUMA field SourceUserName to the KUMA field SourceUserID. Event field "Event.EventData.Data.SubjectLogonId" was mapped from the KUMA field SourceUserID to the KUMA field FlexString1.</li>
			<li>Additional regular expression was added to the extra normalizer "4103 ContextInfo regexp".</li>
			<li>Extra normalizer "System" was edited. Value of parameter "Use raw event" was changed to "yes".</li>
			<li>New table "[OOTB] Windows. GroupPolicy EventIDs and Event Names mapping" with event ID and event names was added.</li>
			<li>Description of the dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was updated.</li>
			<li>Description of the dictionary "[OOTB] Windows Hyper-V EventID-Name" was updated.</li>
			<li>Description of the dictionary "[OOTB] Windows. Validate Cred. Error Codes" was updated.</li>
			<li>Description of the dictionary "[OOTB] Windows_Terminal Server. EventIDs and Event Names mapping" was updated.</li>
			<li>Description of the dictionary "[OOTB] Windows.Codes (4719)" was updated.</li>
			<li>Support of some event types from the Microsoft Windows Group Policy operational log (Applications and Services Logs – Microsoft – Windows - Group Policy - Operational) was added.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 12</b><br>
	Change list:
		<ul>
			<li>Extra normalizer "Windows Filtering Platform actions" was changed. Mutation with replace function was added to the KUMA field "DeviceDirection". Event enrichment was removed from the field "FileType". Event enrichment witch dictionary "[OOTB] IANAProtocolNumbers" was added to the KUMA field "TransportProtocol". Event field "Event.EventData.Data.ProcessID" was added to the KUMA field "DeviceCustomString3". Event ID "5156" was removed from extra normalizer condition.</li>
			<li>Extra normalizer "5159" was changed. Event field "Event.EventData.Data.Protocol" was mapped from KUMA field "ApplicationProtocol" to the KUMA field "TransportProtocol". Target field of event enrichment with dictionary "[OOTB] IANAProtocolNumbers" was changed from KUMA field "ApplicationProtocol" to KUMA field "TransportProtocol".</li>
			<li>Extra normalizer "4103" was changed. Event field "Event.EventData.Data.Payload" was mapped from the KUMA field "Message" to extended field "S.ScriptBlockText". Event enrichment was added to the KUMA field “Message”. Event mutation was added to the event field "Event.EventData.Data.Payload" (replace symbols "\r\n" with "").</li>
			<li>Extra normalizer "4103 ContextInfo regexp" was changed. Event mutation was added to the event field " Event.EventData.Data.ContextInfo" (replace symbols "\r\n" with "").</li>
			<li>Extra normalizer "User Account Management" was changed. Labels were added to the KUMA fields "DeviceCustomString3", "DeviceCustomString2", "DeviceCustomString1", "FlexString2". Event field "Event.EventData.Data.LogonHours" was mapped from the KUMA field "SourceMacAddress" to the KUMA field "OldFilePermission". Event field "Event.EventData.Data.AccountExpires" was mapped from the KUMA field "DeviceCustomIpv6Address1" to the KUMA field "FilePermission". Event field "Event.EventData.Data.SidHistory" was mapped from the KUMA field "DestinationMacAddress" to the KUMA field "OldFileType". Event field "Event.EventData.Data.UserAccountControl" was mapped from the KUMA field " DeviceCustomIpv6Address4" to the KUMA field "OldFileId". Event field "Event.EventData.Data.UserParameters" was mapped from the KUMA field "DeviceMacAddress" to the KUMA field "FileId". Event field "Event.EventData.Data.AllowedToDelegateTo" was mapped from the KUMA field "DeviceCustomIPv6Address3" to the KUMA field "FileType". Event field "Event.EventData.Data.PrimaryGroupId" was mapped from the KUMA field "DeviceCustomIpv6Address2" was mapped to the KUMA field "DeviceCustomNumber1".</li>
			<li>New extra normalizer "5156" was added.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 11</b><br>
	Change list:
		<ul>
			<li>Support of some events in xml format from the event log «Microsoft - Windows - DNS-Server – Audit» was added.</li>
			<li>New extra normalizers were added: «Microsoft-Windows-DNSServer», «DNS Server 519 520 521», «DNS Server 515 516», «DNS Server 518», «DNS Server 561», «DNS Server 517», «DNS Server 546», «DNS Server 514», «DNS Server 536», «DNS Server 537», «DNS Server 573», «DNS Server 541».</li>
			<li>New dictionary «[OOTB] Microsoft DNS Server. EventIDs and Event Names» was added.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 10</b><br>
	Change list:
		<ul>
			<li>Support of some event types (event ID 7000, 7009, 7023, 7034, 7031, 7011, 7001, 7043) generated by "Service Control Manager" was added.</li>
			<li>New extra normalizers were added: "Service Control Manager", "7000 7009 7023 7034", "7031", "7011", "7001", "7043".</li>
			<li>Event names for events with ID 7009, 7023, 7034, 7031, 7011, 7001, 7043 were added to the dictionary "[OOTB] Windows. EventIDs and Event Names mapping".</li>
			<li>New regular expression was added to the extra normalizer "4103 ContextInfo regexp".</li>
			<li>Event enrichment with dictionary was removed from the extra normalizer "4738".</li>
			<li>New event enrichments were added to the "4738" (replace, replace with regexp).</li>
			<li>Extra normalizer "4742" was removed.</li>
			<li>Event enrichment to the KUMA field "DeviceAction" in the extra normalizer "4657" was changed. Text of event enrichment "New Registry Value created" was replaced with text "New registry value created".  Text of event enrichment "Existing Registry Value modified" was replaced with text "Existing registry value modified". Text of event enrichment "Registry Value Deleted" was replaced with text "Registry value deleted".</li>
			<li>New event enrichment was added in the extra normalizer "Extra 5136". Data from the KUMA field "DeviceCustomString4" copied to the KUMA field "DeviceAction".</li>
			<li>Field mapping was changed in the extra normalizer "A computer account management". Event field "Event.EventData.Data.TargetDomainName" mapped from the KUMA field "DeviceCustomString6" to the KUMA field "DestinationNtDomain". Event field "Event.EventData.Data.TargetUserName" was mapped from the KUMA field "DeviceCustomString1" to the KUMA field to the KUMA field "DestinationUserName". Event field "Event.EventData.Data.NewUacValue" was mapped to the KUMA field "DeviceCustomString5". Event field "Event.EventData.Data.OldUacValue" was mapped to the KUMA field "DeviceCustomString4". Event field "Event.EventData.Data.UserAccountControl"was mapped to the KUMA field "DeviceCustomString6". Event field "Event.EventData.Data.HomeDirectory" was mapped to the KUMA field "FileName". Event field "Event.EventData.Data.HomePath" was mapped to the KUMA field "FilePath". Event field "Event.EventData.Data.PasswordLastSet" was mapped to the KUMA field "DeviceCustomDate1".</li>
			<li>Event enrichment was changed in the extra normalizer "A computer account management". Event enrichment with constant was removed from the KUMA field "DeviceCustomString6Label". Event enrichment with template was removed from the KUMA field "DeviceCustomString6"</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 9</b><br>
	Change list:
		<ul>
			<li>In the extra normalizer "Terminal Server" filter parameters were updated. Logical condition was changed to "OR", new condition "Microsoft-Windows-TerminalServices-LocalSessionManager" was added.</li>
			<li>New extra normalizer "23 (TerminalServer)" was added.</li>
			<li>Normalizer structure optimization. Extra normalizers 21(TerminalServer), 22(TerminalServer), 24(TerminalServer), 25(TerminalServer) were combined to extra normalizer "21 22 24 25(TerminalServer)". </li>
			<li>Parameter "XML Atributes" was disabled in the extra normalizer "1149 (TerminalServer)".</li>
			<li>Event name was added for the event with ID 23 (TerminalServer) to the dictionary "22(TerminalServer)".</li>
			<li>Event enrichment with constant to the KUMA field "Message" was updated in the extra normalizers "21 22 24 25(TerminalServer)", "39 (TerminalServer), "1149 (TerminalServer)".</li>
			<li>Event enrichment to the KUMA field "OldFileType" was removed from the extra normalizer "Terminal Server".</li>
			<li>Regular expression in the event enrichment to the KUMA field "DestinationUserName" in the extra normalizer "21 22 24 25(TerminalServer)" was updated.</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 8</b><br>
	Change list:
		<ul>
			<li>Extra normalizer "4104" was changed. Event enrichment from the KUMA field "Message" to the KUMA field "FileName" was deleted. Event field "Event.EventData.Data.ScriptBlockText" was mapped to the KUMA extended event schema field "S.ScriptBlockText".</li>
			<li>New extra normalizers were added: "Microsoft-Windows-SMBServer", "SMBServer 3000", "SMBServer 3000 RenderingInfo.Message parsing".</li>
			<li>Field mapping was changed in the extra normalizer "5145" . Event field "Event.EventData.Data.RelativeTargetName" was mapped from the KUMA field "DestinationServiceName" to the KUMA field "FileName".</li>
			<li>Mapping in the extra normalizer "4624" was changed. Event field "Event.EventData.Data.LmPackageName" was mapped to the KUMA field "FlexString2".</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 7</b><br>
	Change list:
		<ul>
			<li>Support of some event types from the event log "Microsoft Windows PowerShell" were added.</li>
			<li>New extra normalizers were added: "Windows PowerShell journal", "Windows PowerShell 400 403", "Windows PowerShell 400 403 regexp", "Windows PowerShell 800", "Windows PowerShell 800 regexp", "Windows PowerShell 600", "Windows PowerShell 600 regexp", "4610".</li>
			<li>Mapping in the main normalizer was changed. Mapping of the event field "Event.EventData.Data.AuthenticationPackageName" was removed from the KUMA field "DeviceCustomString5".</li>
		</ul>
</p>

<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 6</b><br>
	Change list:
		<ul>
			<li>Parsing of some events generated by the Microsoft Skype for business was added.</li>
			<li>Parsing of the event ID 4898 from the Windows Security log was added. New extra normalizer "4898" was added.</li>
			<li>Field mapping was changed in the extra normalizers 4618, 4626, 4634, 4647, "WS or ScreenSaver Operations". Event field "Event.EventData.Data.TargetLogonId" was mapped to the KUMA field "FlexString2".</li>
			<li>Field mapping was changed in the extra normalizers 6416, 5381, 4826, 5382, 5379. Event field "Event.EventData.Data.SubjectUserSid" was mapped to the KUMA field "SourceUserID". Event field "Event.EventData.Data.SubjectLogonId" was mapped to the KUMA field "FlexString1".</li>
			<li>Field mapping was changed in the extra normalizers 4719, 5051, "5888 5889 5890". Event field "Event.EventData.Data.SubjectUserSid" was mapped to the KUMA field "DestinationUserID".</li>
			<li>Dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was updated. Name of the event with ID 6272 was changed to "Network Policy Server granted access to a user".</li>
			<li>Field mapping was changed in main normalizer. Event field "Event.EventData.Data.IpAddress" was mapped from the KUMA field "DeviceCustomIPv6Address2" to the KUMA field "SourceAddress".</li>
			<li>Event enrichment was changed in main normalizer. Source of the enrichment with regular expression to the KUMA field "SourceAddress" was changed from the KUMA field "DeviceCustomIPv6Address2" to the KUMA field "SourceAddress".</li>
			<li>Field mapping was changed in the extra normalizers 4821, 5145, 4771, 4769, 4820, 5140, 4648, 4625. Event field "Event.EventData.Data.IpAddress" mapping was removed from the KUMA field "SourceAddress".</li>
			<li>Field mapping was changed in the extra normalizers 5145, 4771, 4769, 5140, 4624, 4770, 4768. Event field "Event.EventData.Data.IpAddress" mapping was removed from the KUMA field "DeviceCustomIPv6Address2".</li>
			<li>Field mapping was changed in the extra normalizers 4771, 4770. Event field "Event.EventData.Data.IpAddress" mapping was removed from the KUMA field "DeviceCustomString3".</li>
			<li>Field mapping was changed in the extra normalizers "KRB ticket request failed". Event field "Event.EventData.Data.IpAddress" mapping was removed from the KUMA field "DeviceCustomIPv6Address1".</li>
			<li>Field mapping was changed in the extra normalizers "Windows Filtering Platform actions". Event field "Event.EventData.Data.SourceAddress" mapping was removed from the KUMA field "DeviceCustomIPv6Address2". Event field "Event.EventData.Data.DestAddress" mapping was removed from the KUMA field "DeviceCustomIPv6Address3".</li>
			<li>Event enrichments were changed in the extra normalizers 5, 18, 15, 10, 7, 11, 13, 17, 22, 23, 25. Type of event enrichment to the KUMA field "FileName" was changed from the "replacewithregexp" to the "regexp". Regular expressions in the event enrichments to the KUMA fields "FileName" and "FilePath" were fixed.</li>
			<li>Event enrichments were changed in the extra normalizer 11. Type of event enrichment to the KUMA field "OldFileName" was changed from the "replacewithregexp" to the "regexp". Regular expressions in the event enrichments to the KUMA fields "OldFileName" and "OldFilePath" were fixed.</li>
		</ul>
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 5</b><br>
	Change list:<br>
	Extra normalizer 1102 was updated:
		<ul>
			<li>Event field "Event.UserData.LogFileCleared.SubjectDomainName" was mapped to the SourceNtDomaint KUMA field.</li>
			<li>Event field "Event.UserData.LogFileCleared.SubjectUserName" was mapped to the SourceUserName KUMA field.</li>
		</ul>
  	</p>


	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 4</b><br>
	Change list:
	<ul>
		<li>Type of the main normalizer was changed from "regexp" to "xml".</li>
		<li>Removed support of MS SQL events 33205, 18453, 18456. Some of this events was not in the xml format.</li>
		<li>Extra normalizer "2889" was changed. Event mapping to the KUMA field DeviceCustomString2 was changed from "Event.EventData.Data0" to "Event.EventData.Data.0".</li>
		<li>Extra normalizer "1644" was changed. Event mapping of the event field "Event.EventData.Data.16" was changed from the KUMA field SourceHostName to the SourceUserName.</li>
	</ul>
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 3</b><br>
		In the extra normalizer 424 value of the parameter "Use raw event" was changed to "yes".
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 2</b><br>
	Change list:
	<ul>
		<li>Normalizer name was changed to the "[OOTB] Microsoft Products for KUMA 3".</li>
		<li>Type of the main normalizer was changed from "xml" to "regexp".</li>
		<li>Parsing of the events from the Microsoft Hyper-V was added.</li>
		<li>New dictionary "[OOTB] Windows Hyper-V EventID-Name" was added.</li>
		<li>Normalizer structure optimization. Extra normalizers were combined with other extra normalizers: 4106, 4660, 4661, 4823, 4866, 4867, 4868, 4869, 4870, 4871, 4873,4874, 4875, 4876, 4877, 4882, 4883, 4884, 4885, 4890, 4891, 4892, 4896, 4902, 4909, 5056, 5059, 5888, 5889, 5890, 6272, 6278, 6279, 6280, "22 (TerminalServer)", "24 (TerminalServer)", "25 (TerminalServer)".</li>		
		<li>Event field mapping in the main normalizer was fixed. Event field name was changed from the "Event.System.Keyword" to the "Event.System.Keywords" (this field mapped the KUMA field EventOutcome).</li>
		
		<li>Extra normalizer "4663" was updated:
			<ul>
				<li>Event field "Event.System.Task" was mapped to the KUMA field DeviceCustomString6.</li>
				<li>Event enrichment with dictionary "[OOTB] Windows. Task category codes" was added to the field DeviceCustomString6.</li>
				<li>Enrichment with a dictionary "[OOTB] Windows.Codes (4663)" in extra normalizer 4663 (in the field DeviceCustomString1) was replaced with event enrichment (replace operation).</li>
			</ul>
		</li>
		<li>New dictionary "[OOTB] Windows. Task category codes" was added. The dictionary contains the IDs of the Task Category parameter of Windows OS audit events and their corresponding names.</li>
		
		<li>Extra normalizer "4103" was updated:
		<ul>
			<li>Parsing of the event field "Event.EventData.Data.ContextInfo" was moved from the extra normalizer "4103" to the extra normalizer "4103 ContextInfo regexp".</li>
			<li>New event mapping was added in the extra normalizer 4103 to the KUMA fields SourceUserName, DestinationUserName, FlexString2, DeviceCustomString4.</li>
		</ul>
		</li>		
		
		<li>Extra normalizer "4662" was updated:
			<ul>
				<li>Event field "Event.EventData.Data.AccessMask" was mapped from the KUMA field DeviceCustomString1 to the KUMA field DeviceCustomString2.</li>
				<li>Event enrichment with dictionary of the KUMA field FilePermission was removed.</li>
				<li>Event field "Event.EventData.Data.Properties" was additional mapped to the KUMA field DeviceCustomString6.</li>
			</ul>
		</li>
		<li>Dictionary "[OOTB] Windows.Codes (4662)" was updated:
			<ul>
				<li>Additional operation codes were added.</li>
				<li>Description of the dictionary "[OOTB] Windows.Codes (4662)" was updated.</li>
			</ul>
		</li>
		
		<li>Extra normalizer "1" was updated:
			<ul>
				<li>Event field "Event.EventData.Data.Image" was mapped from the KUMA field FilePath to the KUMA field OldFilePath.</li>
				<li>Event enrichment with regular expressions were mapped to the KUMA fields OldFileName and OldFilePath. Regular expressions were updated.</li>
			</ul>
		</li>
		
		<li>Extra normalizer "7" was updated:
			<ul>
				<li>Event enrichment with regular expressions were added for the fields OldFileName and OldFilePath.</li>
				<li>Regular expressions that used in event enrichment in the KUMA fields FileName and FilePath were updated.</li>
			</ul>
		</li>
		
		<li>Extra normalizer "4104" was updated:
			<ul>
				<li>Event field "Event.EventData.Data.ScriptBlockText" mapping to the KUMA field Message was fixed.</li>
				<li>Event field "Event.EventData.Data.ScriptBlockId" mapping to the KUMA field DeviceCustomString2 was removed. This field still mapped to the KUMA field FileId.</li>
			</ul>
		</li>
		
		<li>Option "Keep extra fields" was disabled for the extra normalizers: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 255.</li>
						
		<li>Event field Event.EventData.Data.SubjectLogonId was added to the KUMA field FlexSting1 in the extra normalizers: 4658, 4618, 4870, 4877, 5377, 5058, 4871, 4869, 4661, 4662, 4865, 5140, 4818, 4918, 4659, 4904, 5122, 5123, 4672, 4875, 4696, 4615, 5633, 4819, 5888, 5889, 4905, 4670, 4866, 4912, 4890, 4891, "Kerberos or DRA group for EFS or The audit policy (SACL) on an object policy was changed.", 5632, 4626, 4873, 4907, 5890, 4876, 5376, 4884, 4867, 4892, 5378, 4657, 4664, 4882, 5059, 4896, 4624, 4691, 4874, 4660, 4868, 5039.</li>
		<li>Event field Event.EventData.Data.SubjectUserSid was mapped to the KUMA field DestinationUserID in the extra normalizers: 4615, 4657, 4658, 4662, 4670, 4672, 4691, 4818, 4819, 4904, 4905, 4907, 4912, 4913, 5039, 5058, 5376, 5377, 5378.</li>
		<li>Additional field mapping was added in the extra normalizer 5632: "Event.EventData.Data.SSID" to the KUMA field DeviceCustomString3, "Event.EventData.Data.LocalMac" to the KUMA field DeviceMacAddress, "Event.EventData.Data.PeerMac" to the KUMA field DestinationMacAddress. Field mapping was changed in the extra normalizer: event field "Event.EventData.Data.ReasonText" mapped to the KUMA field DeviceCustomString4, event field "Event.EventData.Data.ErrorCode" mapped to the KUMA field DeviceCustomString5.</li>
				
		<li>Change list for the Microsoft SQL Sever events:
		<ul>
			<li>Parsing of the events with ID 18456, 33205, 18453 was added.</li>
			<li>Names for the events with ID 33205 and 18453 was added to the dictionary "[OOTB] Microsoft SQL Server codes".</li>
			<li>Event mapping was changed for event with ID 18456. Event field Event.EventData.Data.2 to the KUMA field DeviceHostName.</li>
		</ul>
		</li>
		
		<li>Option "Keep extra fields" was disabled for the extra normalizer "AD FS".</li>
		<li>Other minor improvements.</li>
	</ul>
  	</p>

	<p>
	<b>[OOTB] Microsoft Products for KUMA 3. Version 1</b><br>
	This is the first version of the package "[OOTB] Microsoft Products" for the KUMA 3.<br>
	Change list:<br>
	Parsing of additional Microsoft products events have been added to the normalizer:
	<ul>
		<li>Microsoft Active Directory Federation Service (AD FS)</li>
		<li>Microsoft Active Directory Domain Service (AD DS)</li>
		<li>Microsoft SQL Server</li>
	</ul>
	Other minor improvements.
  	</p>

</body>
</html>
