Change log for EXTREME_SWITCH

Date Changes
2025-09-01 Enhancement:
- event.idm.read_only_udm.principal.hostname: Newly mapped host raw log field(s) with event.idm.read_only_udm.principal.hostname UDM field.
- event.idm.read_only_udm.principal.asset.hostname: Newly mapped host raw log field(s) with event.idm.read_only_udm.principal.asset.hostname UDM field.
- event.idm.read_only_udm.principal.ip: Newly mapped src_ip raw log field(s) with event.idm.read_only_udm.principal.ip UDM field.
- event.idm.read_only_udm.principal.asset.ip: Newly mapped src_ip raw log field(s) with event.idm.read_only_udm.principal.asset.ip UDM field.
- event.idm.read_only_udm.principal.mac: Newly mapped client_mac raw log field(s) with event.idm.read_only_udm.principal.mac UDM field.
- event.idm.read_only_udm.principal.asset.mac: Newly mapped client_mac raw log field(s) with event.idm.read_only_udm.principal.asset.mac UDM field.
- event.idm.read_only_udm.target.ip: Newly mapped dst_ip raw log field(s) with event.idm.read_only_udm.target.ip UDM field.
- event.idm.read_only_udm.target.asset.ip: Newly mapped dst_ip raw log field(s) with event.idm.read_only_udm.target.asset.ip UDM field.
- event.idm.read_only_udm.network.dhcp.chaddr: Newly mapped client_mac raw log field(s) with event.idm.read_only_udm.network.dhcp.chaddr UDM field.
- event.idm.read_only_udm.network.dhcp.giaddr: Newly mapped gateway_ip raw log field(s) with event.idm.read_only_udm.network.dhcp.giaddr UDM field.
- event.idm.read_only_udm.security_result.summary: Newly mapped summary raw log field(s) with event.idm.read_only_udm.security_result.summary UDM field.
- event.idm.read_only_udm.additional.fields: Newly mapped vlan_name, Port, slot, packet_type raw log field(s) with event.idm.read_only_udm.additional.fields UDM field.
- event.idm.read_only_udm.metadata.event_type: If has_principal is true, has_target is true, has_network_dhcp is true, updated to NETWORK_DHCP.
- Added new Grok patterns to parse DHCP-related log messages.
2023-12-19 Enhancement:
- Added a new Grok pattern to support new type of SYSLOG logs.
- Added new Grok patterns to parse description.
- Mapped protocol, VrId, SlppRxVlan, SlppIncomingVlanId, Type, Cause to additional.fields.
- Mapped session_id to network.session_id
- Mapped SlppSrcMacAddress to principal.mac.
- Mapped intermediary_ip to "intermediary.ip.
- Mapped ver to metadata.version.
- Mapped rcPortVLacpAdminEnable, rcSyslogHostMapFatalSeverity, rcSyslogHostMapWarningSeverity, rcSyslogHostRowStatus, rcSyslogHostFacility, rcSyslogHostAddressType, rcSyslogHostMapErrorSeverity, rcSyslogHostMapInfoSeverity, rcSyslogHostSeverity, rcSyslogHostEnable to security_result.detection_fields.
- Mapped port to principal.port.
- Mapped rcSyslogHostAddress to principal.hostname.
2023-12-11 - Newly created parser.