We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for BOMGAR

Date	Changes
2026-07-13	Enhancement: - Added a Grok pattern to parse the raw log fields. - Modified the condition for mapping `event.idm.read_only_udm.metadata.event_type` to `USER_UNCATEGORIZED` to include cases where `_userid` is present.
2026-03-13	Enhancement: - `event.idm.read_only_udm.principal.process.pid`: Newly mapped `exc` raw log field with `event.idm.read_only_udm.principal.process.pid` UDM field. - `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `loggerHost` raw log field with `event.idm.read_only_udm.principal.asset.hostname` UDM field. - `event.idm.read_only_udm.intermediary.hostname` and `event.idm.read_only_udm.intermediary.asset.hostname`: Newly mapped `loggerHost` raw log field with `event.idm.read_only_udm.intermediary.hostname` and `event.idm.read_only_udm.intermediary.asset.hostname` UDM fields. - `event.idm.read_only_udm.additional.fields`: Newly mapped `product`, `sequenceId`, and a combination of `site_id`, `segment`, and `total_segment` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field.
2025-12-17	Enhancement: - event.idm.read_only_udm.metadata.vendor_name: Updated mapping for event.idm.read_only_udm.metadata.vendor_name from `BeyondTrust` to `BeyondTrust Bomgar`.
2024-04-15	Enhancement: - event.idm.read_only_udm.principal.user.userid: Newly mapped `who` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field.
2024-01-12	Enhancement: - Removed the drop statement with tag `TAG_NO_SECURITY_VALUE` when `status` is `challenge`. - Added an email check for `temp_email` before mapping to `target.user.email_addresses`.
2022-11-24	Bug-Fix: - Modified a Grok pattern that parses `who` to correctly parse the fields `_user_display_name`, `_userid`, and `_method`. - If `event.idm.read_only_udm.metadata.event_type` is `USER_LOGIN` then set `event.idm.read_only_udm.extensions.auth.type` to `AUTHTYPE_UNSPECIFIED`.
2022-10-13	Enhancement: - Merged customer specific parser to default.
2022-09-26	Enhancement: - Merged customer specific parser to default.
2022-08-19	Enhancement: - Migrated the custom parsers into default parser and deleted the custom parsers.