We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for CIPHERTRUST_MANAGER

Date	Changes
2025-11-20	- Added a grok pattern to parse the new log format. - `event.idm.read_only_udm.target.hostname`: Newly mapped `details.host` raw log field with `event.idm.read_only_udm.target.hostname` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `details.messageFormat` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.network.ip_protocol`: Newly mapped `details.transport` raw log field with `event.idm.read_only_udm.network.ip_protocol` UDM field. - `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `syslog_timestamp` raw log field with `event.idm.read_only_udm.metadata.collected_timestamp` UDM field. - `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `syslog_host` raw log field with `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname` UDM field. - `event.idm.read_only_udm.metadata.product_name`: Newly mapped `product` raw log field with `event.idm.read_only_udm.metadata.product_name` UDM field. - `event.idm.read_only_udm.metadata.event_type`: If `has_principal` is true and `has_target` is true, updated to `NETWORK_CONNECTION`.
2025-10-13	- Added a new grok pattern to support new format of SYSLOG logs. - event.idm.read_only_udm.security_result.action_details: Newly mapped `details.errorMessage` raw log field with `event.idm.read_only_udm.security_result.action_details` UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `uid` field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `sev` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.metadata.product_name: Newly mapped `product_name` field with `event.idm.read_only_udm.metadata.product_name` UDM field. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `event_time` field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field.
2025-09-16	- event.idm.read_only_udm.additional.fields: Newly mapped details.format, details.requestIdentifier, details.requestIdentifierType, details.version, details.app_connector_type, details.meta, details.interfaceName, details.interfaceType, and service raw log field(s) with event.idm.read_only_udm.additional.fields UDM field. - event.idm.read_only_udm.target.port: Newly mapped details.port raw log field(s) with event.idm.read_only_udm.target.port UDM field. - Added conditional check for cef_message field. Logic that populates event.idm.read_only_udm.principal.user.userid now also executes if cef_message contains `Export Key`. - Added conditional check for message field. If message is `SSL Handshake failed`, `Terminating KMIP Connection`, `ADPReadClientProfile`, or `Update License Usage`, client_ip is mapped to event.idm.read_only_udm.principal.ip. Otherwise, client_ip is mapped to event.idm.read_only_udm.src.ip. - event.idm.read_only_udm.metadata.event_type: If message is SSL Handshake failed or Terminating KMIP Connection, updated to NETWORK_CONNECTION. - event.idm.read_only_udm.metadata.event_type: If message is ADPReadClientProfile or Reject access, updated to USER_RESOURCE_ACCESS. - event.idm.read_only_udm.metadata.event_type: If message is Export Key, updated to USER_RESOURCE_UPDATE_CONTENT. - Updated Grok patterns to support new log formats.
2025-04-23	- Added a Grok pattern to parse the unparsed logs. - Added a gsub to parse the unparsed logs. - `event.idm.read_only_udm.src.user.product_object_id`: Newly mapped `cust_client_id `raw log field with` event.idm.read_only_udm.src.user.product_object_id' UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `user_id `raw log field with` event.idm.read_only_udm.principal.user.userid' UDM field. - Added `has_user` flag as a conditional check for `user_id` raw log field to populate `USER_UNCATEGORIZED` event_type. - `event.idm.read_only_udm.target.application`: Newly mapped `service_name `raw log field with` event.idm.read_only_udm.target.application' UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `record_type_id`, `details.aliases`, `details_algorithm`, `details_assignSelfAsOwner`, `details_emptyMaterial`, `details_feature`, `details_undeletable`, `details_unexportable`, `details_xts`, `details_padded`, `details_generateKeyId`, `details_id`, `details_objectType` and `details_ownerId` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels` - Newly mapped `details_name`, `details_uri` and `details_usageMask` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.target.file.size` - Newly mapped `details.size` raw log field with `event.idm.read_only_udm.target.file.size` UDM field. - Added a gsub to map the `principal` raw log field to 'log_principal. - `event.idm.read_only_udm.additional.fields`: Mapped `details.label`, `details.domain`, `details.switch_domain_id`, `details.user_id`, `details.refresh_token_id`, `details.renew_refresh_token`, `details.user_metadata_current_persistedData`, `details.refresh_token_counts.labels`, `details_scope`, `details.refresh_token_counts.no_label`, `details.refresh_token_counts.total`, `details.user_metadata.current_domain.id`, `details.user_metadata.current_domain.name`, `details.meta.permissions`, `details.meta.ownerId`, `details.meta.customAttributes`, `details.errorMessage`, `details.zone_id`, `details.client_type`, `details.grant_type`, `details.client_name`, `details.username`, `details.idType`, `details.identifier`, `details.client_id`, `details.auth_domain`, `details.connection`, `details.userid`, `details.codeDesc`, `details.code` and `details.Internal` raw log fields with third variable to map to `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.security_result.description`: Newly mapped `prev_msg` raw log field with `event.idm.read_only_udm.security_result.description` UDM field. - `event.idm.read_only_udm.security_result.severity_details`: Newly mapped `severity` raw log field with `event.idm.read_only_udm.security_result.severity_details` UDM field. - `event.idm.read_only_udm.security_result.action`: Newly mapped `success` raw log field with `event.idm.read_only_udm.security_result.action` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `details.usage` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field.
2024-06-24	Newly created parser.