October 8th, 2026 - Content Release

This content release includes:

• New support for AWS Config and AWS Health findings in OCSF format, normalizing the finding description, severity, affected resource, account, and region
• Expanded Citrix NetScaler visibility: the syslog parser now handles Application Firewall (AppFW), system event, routing, and IPsec messages that were previously dropped, with new log mappers for AppFW detections such as cross-site scripting and SQL injection, device and monitor state changes, and routing commands executed on the appliance. AppFW events with IPv6 source addresses are now also parsed correctly
• Enhanced AWS S3 Server Access Logs parsing and mapping to capture the requested object path, application user ID, and session ID

Changes are enumerated below.

Log Mappers

• [New] AWS Config - OCSF Finding Events
• [New] AWS Health - OCSF Finding Events
• [New] Citrix NetScaler - AppFW
• [New] Citrix NetScaler - NetScaler Event
• [New] Citrix NetScaler - Routing Command Executed
• [Updated] AWS S3 Server Access Log - Custom Parser
• [Updated] Citrix NetScaler - MESSAGE

Parsers

• [Updated] /Parsers/System/AWS/AWS S3 Server Access Logs
• [Updated] /Parsers/System/Citrix/Citrix NetScaler Syslog