Upcoming EoL for Some SubTypes of Cato Event Data

From January 2, 2025, Cato is announcing the End of Life (EoL) for some SubType values used in the event consumption APIs. After January 2, 2025, the values below will no longer be reported and will be unavailable for queries and scripts.

This table shows the impacted values and a value you can use as a replacement. 

What Changes Do We Need to Make?

If you are using these values in your automation flows, for example in an integration to push events to cloud storage or to query events to a SIEM solution, you must update the flows to use the replacement values in the table above.    

For example, if you use the Reconnected value in a filter, you need to change this filter to the Connected or Disconnected value.  

If you are not using any values that will be declared EoL, no changes are required and there is no impact on your account.  

What is the Impact on My Account?

After the EoL date, VPN Never-Off-Bypass, Reconnected, and Changed PoP SubType values will no longer be available.  You can use the alternative values listed above to accurately retrieve the relevant data.

What Happens if I Do Not Make Any Changes? 

If you do not make any changes before the EoL date, you could experience the following impact with the Cato API:   

• Running an API query with EoL values will likely return an error. For example, in the EventFieldName query, if you use the VPN Never-Off-Bypass value in a filter, the query will fail and will return an error.    
• If you have analytics or workflows that rely on these EoL values, there could be changes in behavior. For example, a SIEM widget doesn’t display accurate data.

Who Do I Talk to If I Have Questions? 

Please contact your account representative or Support.