We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for EXTREME_WIRELESS

Date Changes

2025-11-20 - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped timestamp raw log field to event.idm.read_only_udm.metadata.event_timestamp UDM field.
- event.idm.read_only_udm.principal.mac: Newly mapped mu_mac, hname raw log field to event.idm.read_only_udm.principal.mac UDM field.
- event.idm.read_only_udm.principal.asset.mac: Newly mapped mu_mac, hname raw log field to event.idm.read_only_udm.principal.asset.mac UDM field.
- event.idm.read_only_udm.target.mac: Newly mapped client_mac, ap raw log fields to event.idm.read_only_udm.target.mac UDM field.
- event.idm.read_only_udm.target.asset.mac: Newly mapped client_mac, ap raw log fields to event.idm.read_only_udm.target.asset.mac UDM field.
- event.idm.read_only_udm.principal.ip: Newly mapped ip4 raw log field to event.idm.read_only_udm.principal.ip UDM field.
- event.idm.read_only_udm.principal.asset.ip: Newly mapped ip4 raw log field to event.idm.read_only_udm.principal.asset.ip UDM field.
- event.idm.read_only_udm.additional.fields: Newly mapped wlanvalue, ssidvalue, radioID, role raw log fields to event.idm.read_only_udm.additional.fields UDM field.
- event.idm.read_only_udm.security_result.detection_fields: Newly mapped uname, wlname, devt, os, bssid, conn_cap, client_contd raw log fields to event.idm.read_only_udm.security_result.detection_fields UDM field.
- Newly added grok pattern for the message data field to parse the logs in the correct format.
- Newly added KV filter for the kvdata data field to parse the logs in the correct format.

2024-02-28 - Newly created parser.

Date	Changes
2025-11-20	- `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `timestamp` raw log field to `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.principal.mac`: Newly mapped `mu_mac`, `hname` raw log field to event.idm.read_only_udm.principal.mac UDM field. - `event.idm.read_only_udm.principal.asset.mac`: Newly mapped `mu_mac`, `hname` raw log field to event.idm.read_only_udm.principal.asset.mac UDM field. - `event.idm.read_only_udm.target.mac`: Newly mapped `client_mac`, ap raw log fields to event.idm.read_only_udm.target.mac UDM field. - `event.idm.read_only_udm.target.asset.mac`: Newly mapped `client_mac`, ap raw log fields to event.idm.read_only_udm.target.asset.mac UDM field. - `event.idm.read_only_udm.principal.ip`: Newly mapped `ip4` raw log field to event.idm.read_only_udm.principal.ip UDM field. - `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `ip4` raw log field to event.idm.read_only_udm.principal.asset.ip UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `wlanvalue`, `ssidvalue`, `radioID`, role raw log fields to event.idm.read_only_udm.additional.fields UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `uname`, `wlname`, `devt`, `os`, `bssid`, `conn_cap`, `client_contd` raw log fields to event.idm.read_only_udm.security_result.detection_fields UDM field. - Newly added grok pattern for the `message` data field to parse the logs in the correct format. - Newly added KV filter for the `kvdata` data field to parse the logs in the correct format.
2024-02-28	- Newly created parser.