October 28, 2025 - Content Release

This content release includes:

• New mappers for Crowdstrike Falcon events.
• Updates to existing mappers for Crowdstrike Falcon, F5, and Okta events to support additional fields and events.
• Updates to F5 Networks and Okta SSO parsers.

This new and updated content is effective as of October 22, 2025. Changes are enumerated below.

Log Mappers

• [New] CrowdStrike Falcon Host API IdpDetectionSummaryEvent
• [New] CrowdStrike Falcon Identity Protection
• [Updated] CrowdStrike UserActivity Logs
• [Updated] F5 Authentication Catch All
• [Updated] F5 HTTPd Audit - Custom Parser
• [Updated] F5 Session and adfs proxy - Custom Parser
• [Updated] Okta Authentication - auth_via_AD_agent
• [Updated] Okta Authentication - auth_via_mfa
• [Updated] Okta Authentication - auth_via_radius
• [Updated] Okta Authentication - sso
• [Updated] Okta Authentication Events
• [Updated] Okta Catch All
• [Updated] Okta Security Threat Events

Parsers

• [Updated] /Parsers/System/F5/F5 Syslog
• [Updated] /Parsers/System/Okta/Okta