Normalization Change History
This page lists log normalization changes made by AWS app updates. After upgrading to a version with normalization changes, field names or value meanings differ from data collected by earlier versions, so review your existing queries and detection rules.
Changes apply only to logs collected after the upgrade. Logs already collected are not changed.
1.11.2610.0
AWS Network Firewall
| Original log item | 1.10.2607.1 or earlier | 1.11.2610.0 or later |
|---|---|---|
| firewall_name (firewall name) | bucket_name | firewall_name |
| availability_zone (availability zone) | region | availability_zone |
| S3 bucket name in the logger settings | Not stored | bucket_name |
| Firewall region in the S3 path | Not stored | region |
| event.alert.action | action (allowed, blocked) | action (DETECT, BLOCK) |
| event.alert.action original value | Not stored (action holds the original) | raw_action (allowed, blocked) |
| event.timestamp (event time) | timestamp (_time is the collection time) | timestamp, _time |
bucket_name and region are added by the logger.
Caution
bucket_name, region, and action keep the same field names, but their values mean different things in 1.10.2607.1 or earlier and 1.11.2610.0 or later. If data from before and after the upgrade is mixed in the same table, query results can be misread.
After upgrading, check the following.
- Change queries and detection rules that look up the firewall name or availability zone with bucket_name or region to use firewall_name or availability_zone.
- Change queries and detection rules that filter action by allowed or blocked to use DETECT or BLOCK, or filter by raw_action.
- When querying or aggregating across the upgrade, split the time range at the upgrade time.
- Because the _time basis changed, the same time range can return a different set of logs before and after the upgrade.
- The field name and action value changes also apply when the AWS Network Firewall parser is used with another logger in a custom logger model, and bucket_name and region are not created in that case.