We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for AIX_SYSTEM

Date	Changes
2026-07-23	Enhancement: - Added a new grok pattern to parse the new format of SYSLOG logs. - `event.idm.read_only_udm.metadata.event_type`: Removed the `USER_RESOURCE_ACCESS` from `event.idm.read_only_udm.metadata.event_type` UDM field. - `event.idm.read_only_udm.metadata.event_type`: Setting the value of `event.idm.read_only_udm.metadata.event_type` to `FILE_UNCATEGORIZED` when principal machine data is present and target file data are present. - `event.idm.read_only_udm.security_result.action`: Setting the value of `event.idm.read_only_udm.security_result.action` to `ALLOW` when action is `OK`. - `event.idm.read_only_udm.metadata.collected_timestamp`: Added support for new timestamp format for `internal_timestamp` log field with `event.idm.read_only_udm.metadata.collected_timestamp` UDM field.
2026-07-13	Enhancement: - Added new grok patterns to parse the SYSLOG raw logs with correct event_type. - event.idm.read_only_udm.src.file.full_path: Newly mapped `frompath` raw log field with `event.idm.read_only_udm.src.file.full_path` UDM field. - event.idm.read_only_udm.target.file.full_path: Newly mapped `filename`, `topath` raw log fields with `event.idm.read_only_udm.target.file.full_path` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `additional_description` field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `linkname` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.ip, event.idm.read_only_udm.principal.asset.ip: Newly mapped `src_ip` field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM fields. - event.idm.read_only_udm.principal.port: Newly mapped `src_port` field with `event.idm.read_only_udm.principal.port` UDM field. - event.idm.read_only_udm.metadata.event_type: Updated the `event.idm.read_only_udm.metadata.event_type` to `FILE_CREATION`, `FILE_DELETION`, `FILE_MOVE`, `FILE_READ`, `FILE_MODIFICATION`, `USER_CHANGE_PASSWORD`, `USER_RESOURCE_DELETION`, `FILE_UNCATEGORIZED` when necessary raw log fields are present.
2026-06-16	Enhancement: - Added new grok patterns to parse the SYSLOG raw logs with correct event_type. - `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `internal_timestamp`, `internal_timestamp1` raw log fields with event.idm.read_only_udm.metadata.collected_timestamp UDM field. - `event.idm.read_only_udm.target.group.group_display_name`: Newly mapped `tar_dis_name` raw log field with `event.idm.read_only_udm.target.group.group_display_name` UDM field. - `event.idm.read_only_udm.target.user.group_identifiers`: Newly mapped `tar_identifier` raw log field with `event.idm.read_only_udm.target.user.group_identifiers` UDM field. - `event.idm.read_only_udm.principal.process.file.names`: Newly mapped `file_name` raw log field with `event.idm.read_only_udm.principal.process.file.names` UDM field. - `event.idm.read_only_udm.principal.process.pid`: Newly mapped `process_pid` raw log field with `event.idm.read_only_udm.principal.process.pid` UDM field. - `event.idm.read_only_udm.metadata.event_type`: Updated the `event.idm.read_only_udm.metadata.event_type` to `FILE_CREATION`, `GROUP_DELETION`, `GROUP_MODIFICATION`, `GROUP_CREATION`, `USER_CHANGE_PERMISSIONS`, `USER_DELETION`, `USER_RESOURCE_ACCESS` when necessary raw log fields are present. - `event.idm.read_only_udm.additional.fields`: Newly mapped `roles`, `mode`, `command`, `admin`, `command_option` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field.
2026-05-20	Enhancement: - Added a Grok pattern to parse the raw log fields. - When the `type` field is `failed login attempt`, Set the value of `event.idm.read_only_udm.extensions.auth.type` to AUTHTYPE_UNSPECIFIED.
2026-03-10	Enhancement: - `event.idm.read_only_udm.principal.hostname`: Removed mapping of hostname value (extracted from the SYSLOG message) from `event.idm.read_only_udm.principal.hostname` UDM field as it corresponds to the target device. - `event.idm.read_only_udm.principal.asset.hostname`: Removed mapping of hostname value (extracted from the SYSLOG message) from `event.idm.read_only_udm.principal.asset.hostname` UDM field as it corresponds to the target device. - `event.idm.read_only_udm.target.hostname`: Mapped hostname value (extracted from the SYSLOG message as `dst_host`) with `event.idm.read_only_udm.target.hostname` UDM field. - `event.idm.read_only_udm.target.asset.hostname`: Mapped hostname value (extracted from the SYSLOG message as `dst_host`) with `event.idm.read_only_udm.target.asset.hostname` UDM field. - `event.idm.read_only_udm.target.hostname`: Removed mapping of `devname` from `event.idm.read_only_udm.target.hostname` UDM field as it was a duplicate mapping. - `event.idm.read_only_udm.target.asset.hostname`: Removed mapping of `devname` from `event.idm.read_only_udm.target.asset.hostname` UDM field as it was a duplicate mapping. - `event.idm.read_only_udm.security_result.action`: Updated the value of `event.idm.read_only_udm.security_result.action` to `ALLOW` when `action` contains `Accepted`. - Added and modified a grok pattern to parse the raw log fields correctly. Due to such changes, the following UDM fields are now parsed correctly: - `event.idm.read_only_udm.extensions.auth.mechanism` - `event.idm.read_only_udm.metadata.product_event_type` - `event.idm.read_only_udm.principal.asset.ip` - `event.idm.read_only_udm.principal.ip` - `event.idm.read_only_udm.principal.port` - `event.idm.read_only_udm.principal.user.userid` - `event.idm.read_only_udm.security_result.action_details` - `event.idm.read_only_udm.security_result.summary` (Being removed as it was being mapped redundantly) - `event.idm.read_only_udm.target.application` - `event.idm.read_only_udm.target.process.pid` - `event.idm.read_only_udm.target.user.userid` - `event.idm.read_only_udm.network.application_protocol`
2026-01-28	Enhancement: - Added a Grok pattern for `description` raw log field to parse the raw log fields to its respective UDM fields. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `timestamp_data` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - event.idm.read_only_udm.security_result.action_details: Newly mapped `security_action_details` raw log field with `event.idm.read_only_udm.security_result.action_details` UDM field. - event.idm.read_only_udm.security_result.about.resource.name: Newly mapped `security_resource_name` raw log field with `event.idm.read_only_udm.security_result.about.resource.name` UDM field. - event.idm.read_only_udm.security_result.description: Newly mapped `security_result_description` raw log field with `event.idm.read_only_udm.security_result.description` UDM field. - Added a conditional check before the already existing mapping of `has_principal`, `has_target_user`, `has_user`, `event_type_details`. Based on the condition, set the event.idm.read_only_udm.metadata.event_type to `USER_CREATION`. - `event.idm.read_only_udm.security_result.detection_fields` : Newly mapped `root_data` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field.
2026-01-04	Enhancement: - Added new grok patterns to `description` field to parse new formats of syslog logs. - event.idm.read_only_udm.security_result.about.file.full_path: Newly mapped `library_path` raw log field to `event.idm.read_only_udm.security_result.about.file.full_path` UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `template_id` raw log field to `event.idm.read_only_udm.metadata.product_log_id` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `error_code1`, `error_code2`, `ffdc_info`, `location` raw log fields to `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `sap_instance_id` raw log field to `event.idm.read_only_udm.target.resource.attribute.labels` UDM field.
2025-12-11	Enhancement: - Added new grok patterns to parse new formats of syslog logs. - event.idm.read_only_udm.security_result.description: Newly mapped `sec_result_description` raw log field with `event.idm.read_only_udm.security_result.description` UDM field. - event.idm.read_only_udm.network.http.user_agent: Newly mapped `user_agent` raw log field with `event.idm.read_only_udm.network.http.user_agent` UDM field. - event.idm.read_only_udm.security_result.severity: If `severity` is warn, then mapped `event.idm.read_only_udm.security_result.severity` to `MEDIUM`. - Added new grok patterns to parse new formats of field `description`.
2025-12-10	Enhancement: - Enhanced grok patterns to parse new log formats. - event.idm.read_only_udm.metadata.description: Newly mapped `description` raw log field to `event.idm.read_only_udm.metadata.description` UDM field.
2025-11-20	Enhancement: - Enhanced grok patterns to parse new log formats. - Added conditional mapping to set `event.idm.read_only_udm.security_result.action` to `FAIL` when the raw action field is `fail` or `failed`. - `event.idm.read_only_udm.principal.process.file.names`: Newly mapped `process_name` raw log field to `event.idm.read_only_udm.principal.process.file.names` UDM field. - `event.idm.read_only_udm.target.hostname`: Newly mapped `target_hostname` raw log field to `event.idm.read_only_udm.target.hostname` UDM field. - `event.idm.read_only_udm.target.asset.hostname`: Newly mapped `target_hostname` raw log field to `event.idm.read_only_udm.target.asset.hostname` UDM field. - `event.idm.read_only_udm.security_result.summary`: Newly mapped `Error_Type` raw log field to `event.idm.read_only_udm.security_result.summary` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `sendmail_queue_id` raw log field to `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `ini_parameter`, `ini_section`, `backup_ini_file`, `return_code`, `instance_name`, `node_number`, `edu_id`, `edu_name_base`, `edu_db`, `edu_num`, `thread_id`, `db_name`, `probe_number`, `product_name`, `component_name`, `function_name`, `called_product`, `called_component` and `called_function` raw log fields to `event.idm.read_only_udm.additional.fields` UDM field.
2025-08-28	Enhancement: - Added a GROK pattern to retrieve prod_type, path, user_id, command_line, process_type, username, and tty. - event.idm.read_only_udm.target.file.full_path: Newly mapped path raw log field(s) with event.idm.read_only_udm.target.file.full_path UDM field. - event.idm.read_only_udm.target.resource.name: Newly mapped process_type raw log field(s) with event.idm.read_only_udm.target.resource.name UDM field. - Consolidated all mapping for event.idm.read_only_udm.additional.fields, event.idm.read_only_udm.principal.resource.attribute.labels, and event.idm.read_only_udm.target.resource.attribute.labels.
2025-08-11	Enhancement: - Added a grok pattern to parse `user_id` field. - event.idm.read_only_udm.target.user.userid: Newly mapped `user_id` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field. - event.idm.read_only_udm.metadata.event_type: If `has_prinicpal` is true and `has_target_user` is true, updated to USER_LOGIN. - event.idm.read_only_udm.metadata.event_type: If `has_prinicpal` is true and `has_target` is true, updated to NETWORK_CONNECTION.
2025-07-10	Enhancement: - Added a Grok pattern to parse new format of logs. - Added a gsub function to parse new format of logs. -`event.idm.read_only_udm.security_result.action`: Newly mapped `action` raw log field with `event.idm.read_only_udm.security_result.action` UDM field. -`event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `date` and `time` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. -`event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname`: Newly mapped `devname` raw log field with `event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname` UDM field. -`event.idm.read_only_udm.principal.asset.hardware.serial_number`: Newly mapped `_hardware` raw log field with `event.idm.read_only_udm.principal.asset.hardware.serial_number` UDM field. -`event.idm.read_only_udm.metadata.product_event_type`: Newly mapped `type` raw log field with `event.idm.read_only_udm.metadata.product_event_type` UDM field. -`event.idm.read_only_udm.additional.fields`: Newly mapped `subtype`, `eventtime`, `poluuid`, `dstdevtype`, `dstfamily`, `trandisp`, `appcat`, `vpntype`, `sentdelta` and `rcvddelta` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. -`event.idm.read_only_udm.security_result.severity` and `event.idm.read_only_udm.security_result.severity_details`: Newly mapped `level` raw log field with `event.idm.read_only_udm.security_result.severity` and `event.idm.read_only_udm.security_result.severity_details` UDM field. -`event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `logid` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. -`event.idm.read_only_udm.principal.administrative_domain`: Newly mapped `vd` raw log field with `event.idm.read_only_udm.principal.administrative_domain` UDM field. -`event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `srcip` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field. -`event.idm.read_only_udm.principal.port`: Newly mapped `srcport` raw log field with `event.idm.read_only_udm.principal.port` UDM field. -`event.idm.read_only_udm.target.port`: Newly mapped `dstport` raw log field with `event.idm.read_only_udm.target.port` UDM field. -`event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`: Newly mapped `dstip` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM field. -`event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `srcname` raw log field with `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname` UDM field. -`event.idm.read_only_udm.principal.user.userid`: Newly mapped `unauthuser` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. -`event.idm.read_only_udm.principal.resource.attribute.labels`: Newly mapped `unauthusersource`, `srcserver`, `srcintfrole` and `srcintf` raw log field with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. -`event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `dstserver`, `dstintfrole` and `dstintf` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. -`event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac`: Newly mapped `srcmac` raw log field with `event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac` UDM field. -`event.idm.read_only_udm.target.mac` and `event.idm.read_only_udm.target.asset.mac`: Newly mapped `dstmac` raw log field with `event.idm.read_only_udm.target.mac` and `event.idm.read_only_udm.target.asset.mac` UDM field. -`event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac`: Newly mapped `mastersrcmac` raw log field with `event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac` UDM field. -`event.idm.read_only_udm.target.mac` and `event.idm.read_only_udm.target.asset.mac`: Newly mapped `masterdstmac` raw log field with `event.idm.read_only_udm.target.mac` and `event.idm.read_only_udm.target.asset.mac` UDM field. -`event.idm.read_only_udm.principal.location.country_or_region` and `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `srccountry` raw log field with `event.idm.read_only_udm.security_result.detection_fields` if `srccountry` is equal to `Reserved` else `event.idm.principal.location.country_or_region` UDM field. -`event.idm.read_only_udm.target.location.country_or_region` and `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `dstcountry` raw log field with `event.idm.read_only_udm.security_result.detection_fields` if `dstcountry` is equal to `Reserved` else `event.idm.target.location.country_or_region` UDM field. -`event.idm.read_only_udm.network.session_id`: Newly mapped `sessionid` raw log field with `event.idm.read_only_udm.network.session_id` UDM field. -`event.idm.read_only_udm.network.ip_protocol`: Newly mapped `proto` raw log field with `event.idm.read_only_udm.network.ip_protocol` UDM field. -`event.idm.read_only_udm.security_result.rule_id`: Newly mapped `policyid` raw log field with `event.idm.read_only_udm.security_result.rule_id` UDM field. -`event.idm.read_only_udm.security_result.rule_name`: Newly mapped `policyname` raw log field with `event.idm.read_only_udm.security_result.rule_name` UDM field. -`event.idm.read_only_udm.security_result.rule_type`: Newly mapped `policytype` raw log field with `event.idm.read_only_udm.security_result.rule_type` UDM field. -`event.idm.read_only_udm.network.application_protocol` and `event.idm.read_only_udm.target.application`: Newly mapped `service` raw log field with `event.idm.read_only_udm.network.application_protocol` if `service` is the `protocol name` else `event.idm.read_only_udm.target.application` UDM field. -`event.idm.read_only_udm.network.session_duration`: Newly mapped `duration` raw log field with `event.idm.read_only_udm.network.session_duration` UDM field. -`event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `dsthwvendor` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. -`event.idm.read_only_udm.network.sent_bytes`: Newly mapped `sentbyte` raw log field with `event.idm.read_only_udm.network.sent_bytes` UDM field. -`event.idm.read_only_udm.network.received_bytes`: Newly mapped `rcvdbyte` raw log field with `event.idm.read_only_udm.network.received_bytes` UDM field. -`event.idm.read_only_udm.network.sent_packets`: Newly mapped `sentpkt` raw log field with `event.idm.read_only_udm.network.sent_packets` UDM field. -`event.idm.read_only_udm.network.received_packets`: Newly mapped `rcvdpkt` raw log field with `event.idm.read_only_udm.network.received_packets` UDM field. -`event.idm.read_only_udm.principal.platform`: Newly mapped `osname` raw log field with `event.idm.read_only_udm.principal.platform` UDM field. -`event.idm.read_only_udm.target.platform`: Newly mapped `dstosname` raw log field with `event.idm.read_only_udm.target.platform` UDM field. -`event.idm.read_only_udm.principal.platform_version`: Newly mapped `srcswversion` raw log field with `event.idm.read_only_udm.principal.platform_version` UDM field. -`event.idm.read_only_udm.target.platform_version`: Newly mapped `dstswversion` raw log field with `event.idm.read_only_udm.target.platform_version` UDM field. -`event.idm.read_only_udm.security.rule_version`: Newly mapped `dsthwversion` raw log field with `event.idm.read_only_udm.security.rule_version` UDM field. -`event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`: Newly mapped `remip` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM field. -`event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `locip` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field. -`event.idm.read_only_udm.target.port`: Newly mapped `remport` raw log field with `event.idm.read_only_udm.target.port` UDM field. -`event.idm.read_only_udm.principal.port`: Newly mapped `locport` raw log field with `event.idm.read_only_udm.principal.port` UDM field. -`event.idm.read_only_udm.metadata.description`: Newly mapped `msg` raw log field with `event.idm.read_only_udm.metadata.description` UDM field. -`event.idm.read_only_udm.security_result.summary`: Newly mapped `logdesc` raw log field with `event.idm.read_only_udm.security_result.summary` UDM field. -`event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname`: Newly mapped `dst_host` raw log field with `event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname` UDM field. - Added `on_error` handling to KV filters to improve parser robustness.
2025-05-12	Enhancement: - Added grok patterns inorder to support new format of logs.
2025-02-16	Enhancement: - Added support for SYSLOG logs.
2024-10-09	Bug-Fix: - Added support for `RFC 3339` format timestamp.
2024-08-29	Enhancement: - Added a Grok pattern to parse new log type. - Mapped `dis_name` to `principal.group.group_display_name`. - Mapped `action` to `security_result.action_details`.
2024-04-30	Enhancement: - Enhanced parser to support new log format.
2023-06-21	- Newly created parser.