Change log for AVANAN_EMAIL

Date	Changes
2025-11-17	Enhancement: - Added support for JSON log format. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped eventValue.metadata.event_timestamp raw log field to event.idm.read_only_udm.metadata.event_timestamp. - event.idm.read_only_udm.metadata.product_name: Newly mapped eventValue.metadata.product_name raw log field to event.idm.read_only_udm.metadata.product_name. - event.idm.read_only_udm.metadata.vendor_name: Newly mapped eventValue.metadata.vendor_name raw log field to event.idm.read_only_udm.metadata.vendor_name. - event.idm.read_only_udm.principal.user.product_object_id: Newly mapped eventValue.principal.user.product_object_id raw log field to event.idm.read_only_udm.principal.user.product_object_id. - event.idm.read_only_udm.principal.user.user_display_name: Newly mapped eventValue.principal.user.user_display_name raw log field to event.idm.read_only_udm.principal.user.user_display_name. - event.idm.read_only_udm.principal.user.userid: Newly mapped eventValue.principal.user.userid raw log field to event.idm.read_only_udm.principal.user.userid. - event.idm.read_only_udm.principal.user.title: Newly mapped eventValue.principal.user.title raw log field to event.idm.read_only_udm.principal.user.title. - event.idm.read_only_udm.principal.user.department: Newly mapped eventValue.principal.user.department raw log field to event.idm.read_only_udm.principal.user.department. - event.idm.read_only_udm.target.application: Newly mapped eventValue.target.application raw log field to event.idm.read_only_udm.target.application. - event.idm.read_only_udm.target.user.product_object_id: Newly mapped eventValue.target.user.product_object_id raw log field to event.idm.read_only_udm.target.user.product_object_id. - event.idm.read_only_udm.target.user.user_display_name: Newly mapped eventValue.target.user.user_display_name raw log field to event.idm.read_only_udm.target.user.user_display_name. - event.idm.read_only_udm.target.user.userid: Newly mapped eventValue.target.user.userid raw log field to event.idm.read_only_udm.target.user.userid. - event.idm.read_only_udm.target.user.title: Newly mapped eventValue.target.user.title raw log field to event.idm.read_only_udm.target.user.title. - event.idm.read_only_udm.target.user.department: Newly mapped eventValue.target.user.department raw log field to event.idm.read_only_udm.target.user.department. - event.idm.read_only_udm.target.user.email_addresses: Newly mapped eventValue.target.user.email_addresses raw log field to event.idm.read_only_udm.target.user.email_addresses. - event.idm.read_only_udm.target.user.email_addresses: Newly mapped eventValue.additional.entityValue.entity_payload.recipients raw log field to event.idm.read_only_udm.target.user.email_addresses. - event.idm.read_only_udm.observer.application: Newly mapped eventValue.observer.application raw log field to event.idm.read_only_udm.observer.application. - event.idm.read_only_udm.network.email.from: Newly mapped eventValue.network.email.from raw log field to event.idm.read_only_udm.network.email.from. - event.idm.read_only_udm.network.email.reply_to: Newly mapped eventValue.network.email.reply_to raw log field to event.idm.read_only_udm.network.email.reply_to. - event.idm.read_only_udm.network.email.to: Newly mapped eventValue.network.email.to raw log field to event.idm.read_only_udm.network.email.to. - event.idm.read_only_udm.network.email.mail_id: Newly mapped eventValue.network.email.mail_id raw log field to event.idm.read_only_udm.network.email.mail_id. - event.idm.read_only_udm.network.email.subject: Newly mapped eventValue.network.email.subject raw log field to event.idm.read_only_udm.network.email.subject. - event.idm.read_only_udm.security_result.category: Newly mapped `sec_res.category raw log field to event.idm.read_only_udm.security_result.category. - event.idm.read_only_udm.security_result.rule_id: Newly mapped sec_res.rule_id raw log field to event.idm.read_only_udm.security_result.rule_id. - event.idm.read_only_udm.security_result.description: Newly mapped sec_res.description raw log field to event.idm.read_only_udm.security_result.description. - event.idm.read_only_udm.security_result.severity: Newly mapped sec_res.severity raw log field to event.idm.read_only_udm.security_result.severity. - event.idm.read_only_udm.security_result.confidence: Newly mapped sec_res.confidence raw log field to event.idm.read_only_udm.security_result.confidence. - event.idm.read_only_udm.security_result.action: Newly mapped sec_res.action raw log field to event.idm.read_only_udm.security_result.action. - event.idm.read_only_udm.about.ip: Newly mapped about_1.ip raw log field to event.idm.read_only_udm.about.ip. - event.idm.read_only_udm.additional.fields: Newly mapped fields from eventValue.metadata.event_type raw log field to event.idm.read_only_udm.additional.fields. - event.idm.read_only_udm.additional.fields: Newly mapped fields from eventValue.additional.entityValue.entity_info raw log field to event.idm.read_only_udm.additional.fields. - event.idm.read_only_udm.additional.fields: Newly mapped fields from eventValue.additional.entityValue.entity_payload and eventValue.additional.entityValue.time raw log field to event.idm.read_only_udm.additional.fields. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped fields from eventValue.additional.entityValue.entity_security_result and its nested fields to event.idm.read_only_udm.security_result.detection_fields. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped fields from eventValue.additional.security_event and its nested fields to event.idm.read_only_udm.security_result.detection_fields. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped fields from eventValue.additional.security_event.security_event_action and its nested fields to event.idm.read_only_udm.security_result.detection_fields.
2022-07-12	Enhancement: - Mapped id to metadata.product_log_id. - Mapped description to metadata.description. - Mapped entity_link to principal.process.file.full_path. - Mapped user_id to principal.user.userid. - Mapped Size to target.file.size. - Mapped severity to security_result.severity. - Mapped matched_security_tool to additional.fields. - Mapped customer_domain to additional.fields. - Mapped current_state to additional.fields. - Mapped policy_rule_id to security_result.rule_id. - Mapped Body_ContentType to security_result.detection_fields. - Mapped aggregation_id to security_result.detection_fields. - Mapped entity_source to security_result.detection_fields. - Mapped av_mail_hash to security_result.detection_fields. - Mapped entity_type to security_result.detection_fields. - Mapped InternetMessageIdHash to security_result.detection_fields. - Mapped recipients_hash to target.process.file.sha256. - Mapped From to target.process.product_specific_process_id. - Added for loop for recipients. - Added for loop for recipient_emails. - Mapped av_file_hash_md5 to principal.process.file.md5. - Mapped av_file_hash_sha256 to principal.process.file.sha256. - Mapped av_file_hash_sha1 to principal.process.file.sha1. - Mapped av_file_mime to principal.process.file.mime_type.