We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for GCP_VPC_FLOW

Date	Changes
2025-07-31	Enhancement - - Refactor the code to swap the values of principal.* and target.* fields (ip, asset.ip, port) when network.direction == `INBOUND` and jsonPayload.reporter == `DEST`. - event.idm.read_only_udm.additional.fields: Newly mapped `jsonPayload.rtt_msec` raw log field with `event.idm.read_only_udm.additional.fields`. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `jsonPayload.src_google_service.type` raw log field with `event.idm.read_only_udm.principal.resource.attribute.labels`. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `jsonPayload.dest_gke_details.service.service_name`,`jsonPayload.dest_gke_details.service.service_namespace` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels`. - Added a conditional checks of `jsonPayload.reporter` not equals to `DEST`. - event1.idm.read_only_udm.target.ip, event1.idm.read_only_udm.target.asset.ip: Newly mapped `principal.ip` field with `event1.idm.read_only_udm.target.ip` and `event1.idm.read_only_udm.target.asset.ip` if `network.direction` is `INBOUND` and `jsonPayload.reporter` is `DEST`. - event1.idm.read_only_udm.principal.ip, event1.idm.read_only_udm.principal.asset.ip: Newly mapped `target.ip` field with `event1.idm.read_only_udm.principal.ip` and `event1.idm.read_only_udm.principal.asset.ip` if `network.direction` is `INBOUND` and `jsonPayload.reporter` is `DEST`. - event1.idm.read_only_udm.target.port : Newly mapped `principal.port` field with `event1.idm.read_only_udm.target.port` if `network.direction` is `INBOUND` and `jsonPayload.reporter` is `DEST`. - event1.idm.read_only_udm.principal.port: Newly mapped `target.port` field with `event1.idm.read_only_udm.principal.port` if `network.direction` is `INBOUND` and `jsonPayload.reporter` is `DEST`. - event1.idm.read_only_udm.target.ip, event1.idm.read_only_udm.target.asset.ip: Newly mapped `target.ip` field with `event1.idm.read_only_udm.target.ip` and `event1.idm.read_only_udm.target.asset.ip` if `network.direction` is `OUTBOUND` and `jsonPayload.reporter` is `DEST`. - event1.idm.read_only_udm.principal.ip, event1.idm.read_only_udm.principal.asset.ip: Newly mapped `principal.ip` field with `event1.idm.read_only_udm.principal.ip` and `event1.idm.read_only_udm.principal.asset.ip` if `network.direction` is `OUTBOUND` and `jsonPayload.reporter` is `DEST`. - event1.idm.read_only_udm.target.port : Newly mapped `target.port` field with `event1.idm.read_only_udm.target.port` if `network.direction` is `OUTBOUND` and `jsonPayload.reporter` is `DEST`. - event1.idm.read_only_udm.principal.port: Newly mapped `principal.port` field with `event1.idm.read_only_udm.principal.port` if `network.direction` is `OUTBOUND` and `jsonPayload.reporter` is `DEST`.
2024-10-24	Enhancement - - Interchanged mapping of `principal.ip`, `principal.port` with `target.ip` and `target.port` respectively.
2024-03-15	Enhancement - - Mapped `jsonPayload.src_gke_details.pod.pod_namespace`, `jsonPayload.src_gke_details.pod.pod_name`, `jsonPayload.src_gke_details.cluster.cluster_name`, `jsonPayload.src_gke_details.cluster.cluster_location` to `principal.resource.attribute.labels`. - Mapped `jsonPayload.dest_gke_details.pod.pod_namespace`, `jsonPayload.dest_gke_details.pod.pod_name`, `jsonPayload.dest_gke_details.cluster.cluster_name`, `jsonPayload.dest_gke_details.cluster.cluster_location` to `target.resource.attribute.labels`.
2023-05-23	Enhancement - - Mapped `metadata.event_type` to `USER_RESOURCE_ACCESS` when field `logName` does not contain `vpc_flows`. - Mapped `timestamp` to `events.timestamp`. - Mapped `textPayload`, `labels.tunnel_id` to `additional.fields`. - Mapped `resource.labels.region` to `target.location.country_or_region`. - Added null checks for various fields wherever required.
2023-04-10	Enhancement - - Set `target.resource.attribute.cloud.environment` to `GOOGLE_CLOUD_PLATFORM`. - Set `target.resource.name` to the full resource name value.
2022-07-22	Enhancement: - Mapped `resource.labels.location` to `principal.location.name`. - Mapped `resource.labels.subnetwork_id` to `target.user.attribute.labels`. - Mapped `logName` to `security_result.category_details`.