Change log for CYOLO_OT

Date	Changes
2025-12-22	Enhancement: - event.idm.read_only_udm.intermediary.hostname,event.idm.read_only_udm.intermediary.asset.hostname: Newly mapped inter_host raw log field(s) with event.idm.read_only_udm.intermediary.hostname and event.idm.read_only_udm.intermediary.asset.hostname UDM field. - event.idm.read_only_udm.principal.user.userid: Newly mapped cyolosubjectname raw log field(s) with event.idm.read_only_udm.principal.user.userid UDM field. - event.idm.read_only_udm.principal.location.country_or_region: Newly mapped cyolocountrycode raw log field(s) with event.idm.read_only_udm.principal.location.country_or_region UDM field. - event.idm.read_only_udm.principal.user.product_object_id: Newly mapped cyolosubjectid raw log field(s) with event.idm.read_only_udm.principal.user.product_object_id UDM field. - event.idm.read_only_udm.target.ip,event.idm.read_only_udm.target.asset.ip: Newly mapped dst raw log field(s) with event.idm.read_only_udm.target.ipand event.idm.read_only_udm.target.asset.ip UDM field. - event.idm.read_only_udm.target.application: Newly mapped cyoloobjname raw log field(s) with event.idm.read_only_udm.target.application UDM field. - event.idm.read_only_udm.target.resource.product_object_id: Newly mapped cyoloobjid raw log field(s) with event.idm.read_only_udm.target.resource.product_object_id UDM field. - event.idm.read_only_udm.network.session_id: Newly mapped cyolosessionid raw log field(s) with event.idm.read_only_udm.network.session_id UDM field. - event.idm.read_only_udm.network.http.user_agent,event.idm.read_only_udm.network.http.parsed_user_agent: Newly mapped cyolouagent raw log field(s) with event.idm.read_only_udm.network.http.user_agent and event.idm.read_only_udm.network.http.parsed_user_agent UDM field. - event.idm.read_only_udm.security_result.rule_id: Newly mapped cyoloauthid raw log field(s) with event.idm.read_only_udm.security_result.rule_id UDM field. - event.idm.read_only_udm.security_result.rule_name: Newly mapped cyoloauthname raw log field(s) with event.idm.read_only_udm.security_result.rule_name UDM field. - event.idm.read_only_udm.principal.resource.resource_subtype: Newly mapped cyolosubjectkind raw log field(s) with event.idm.read_only_udm.principal.resource.resource_subtype UDM field. - event.idm.read_only_udm.target.resource.resource_subtype: Newly mapped cyoloobjkind raw log field(s) with event.idm.read_only_udm.target.resource.resource_subtype UDM field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped prod_type raw log field(s) with event.idm.read_only_udm.metadata.product_event_type UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped cyoloauthkind, cyolokind, cyoloresult raw log field(s) with event.idm.read_only_udm.security_result.detection_fields UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped cyolodstid raw log field(s) with event.idm.read_only_udm.target.resource.attribute.labels UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped cef_version, Signature_id, cef_severity, start, act, cyolotransid, cyolocredentialsorigin, cyolocredentialsid, cyolocredentialsname raw log field(s) with event.idm.read_only_udm.additional.fields UDM field. - Assigned the values of certain fields to a third variable and used it as conditional check to prevent future errors. - event.idm.read_only_udm.metadata.event_type: Modified the condition for USER_LOGOUT event type, if message =~ user disconnected and has_user == true and has_target == true, updated to USER_LOGOUT. - Modified the grok pattern to parse raw log correctly. - Removed unnecessary gsub blocks and used single gsub to split the field in kv_data and kv_data1. - Added a conditional check before mapping duration_str field to event.idm.read_only_udm.additional.fields. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped time raw log field(s) with event.idm.read_only_udm.metadata.event_timestamp UDM field.
2025-10-14	Enhancement: - Added support for new log format. - event.idm.read_only_udm.security_result.outcome: Newly mapped result to event.idm.read_only_udm.security_result.outcome and event.idm.read_only_udm.security_result.action. - event.idm.read_only_udm.principal.user.attribute.labels: Newly mapped credentials_origin, credentials_id, and credentials_name to event.idm.read_only_udm.principal.user.attribute.labels. - event.idm.read_only_udm.target.asset.asset_id: Newly mapped asset_id to event.idm.read_only_udm.target.asset.asset_id. - event.idm.read_only_udm.target.asset.product_object_id: Newly Mapped asset_name to event.idm.read_only_udm.target.asset.product_object_id. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped id raw log field(s) with event.idm.read_only_udm.metadata.product_log_id UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped remote_address raw log field(s) with event.idm.read_only_udm.principal.ip UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped remote_address raw log field(s) with event.idm.read_only_udm.principal.asset.ip UDM field. - event.idm.read_only_udm.principal.location.country_or_region: Newly mapped country_code raw log field(s) with event.idm.read_only_udm.principal.location.country_or_region UDM field. - event.idm.read_only_udm.target.hostname: Newly mapped destination_host raw log field(s) with event.idm.read_only_udm.target.hostname UDM field. - event.idm.read_only_udm.target.asset.hostname: Newly mapped destination_host raw log field(s) with event.idm.read_only_udm.target.asset.hostname UDM field. - event.idm.read_only_udm.target.port: Newly mapped destination_port raw log field(s) with event.idm.read_only_udm.target.port UDM field. - event.idm.read_only_udm.metadata.description: Newly mapped message raw log field(s) with event.idm.read_only_udm.metadata.description UDM field. - event.idm.read_only_udm.principal.user.userid: Newly mapped subject_name raw log field(s) with event.idm.read_only_udm.principal.user.userid UDM field. - event.idm.read_only_udm.principal.user.product_object_id: Newly mapped subject_id raw log field(s) with event.idm.read_only_udm.principal.user.product_object_id UDM field. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped timestamp raw log field(s) with event.idm.read_only_udm.metadata.event_timestamp UDM field. - event.idm.read_only_udm.target.application: Newly mapped object_name raw log field(s) with event.idm.read_only_udm.target.application UDM field. - event.idm.read_only_udm.target.resource.product_object_id: Newly mapped object_id raw log field(s) with event.idm.read_only_udm.target.resource.product_object_id UDM field. - event.idm.read_only_udm.network.session_id: Newly mapped session_id raw log field(s) with event.idm.read_only_udm.network.session_id UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped duration_str (from message), subject_kind, authority_kind, log_level, object_kind raw log field(s) with event.idm.read_only_udm.additional.fields UDM field. - event.idm.read_only_udm.network.http.user_agent: Newly mapped client raw log field(s) with event.idm.read_only_udm.network.http.user_agent UDM field. - event.idm.read_only_udm.network.http.parsed_user_agent: Newly mapped client raw log field(s) with event.idm.read_only_udm.network.http.parsed_user_agent UDM field. - event.idm.read_only_udm.security_result.rule_id: Newly mapped authority_id raw log field(s) with event.idm.read_only_udm.security_result.rule_id UDM field. - event.idm.read_only_udm.security_result.rule_name: Newly mapped authority_name raw log field(s) with event.idm.read_only_udm.security_result.rule_name UDM field. - event.idm.read_only_udm.security_result.severity: Newly mapped severity raw log field(s) with event.idm.read_only_udm.security_result.severity UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped fields from the rules array raw log field(s) with event.idm.read_only_udm.security_result.detection_fields UDM field. - event.idm.read_only_udm.observer.hostname: Newly mapped hostname raw log field(s) with event.idm.read_only_udm.observer.hostname UDM field. - event.idm.read_only_udm.observer.resource.product_object_id: Newly mapped node_id raw log field(s) with event.idm.read_only_udm.observer.resource.product_object_id UDM field. - event.idm.read_only_udm.observer.resource.attribute.labels: Newly mapped site_id, log_source, site_name, container_id, transaction_id, event_id raw log field(s) with event.idm.read_only_udm.observer.resource.attribute.labels UDM field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped kind raw log field(s) with event.idm.read_only_udm.metadata.product_event_type UDM field. - event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped syslog_timestamp raw log field(s) with event.idm.read_only_udm.metadata.collected_timestamp UDM field. - event.idm.read_only_udm.extensions.auth.type: Newly mapped hardcoded value MACHINE with event.idm.read_only_udm.extensions.auth.type UDM field. - event.idm.read_only_udm.network.application_protocol: Newly mapped hardcoded value RDP with event.idm.read_only_udm.network.application_protocol UDM field. - Renamed from observer to event.idm.read_only_udm.observer. - Renamed from network to event.idm.read_only_udm.network. - event.idm.read_only_udm.metadata.event_type: If message contains user disconnected and has_user is true, updated to USER_LOGOUT. - Added a new grok pattern to support parsing for a new JSON-based log format in addition to the existing key-value format.
2025-02-21	- Newly created parser.