We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for ILLUMIO_CORE

Date	Changes
2026-07-17	Enhancement: - Added a Grok pattern to parse the raw log fields. - `event.idm.read_only_udm.observer.process.pid`: Newly mapped `obs_pid` raw log field with `event.idm.read_only_udm.observer.process.pid` UDM field. - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `action.src_ip` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM fields. - `event.idm.read_only_udm.network.http.method`: Newly mapped `action.api_method` raw log field with `event.idm.read_only_udm.network.http.method` UDM field. - `event.idm.read_only_udm.network.http.response_code`: Newly mapped `action.http_status_code` raw log field with `event.idm.read_only_udm.network.http.response_code` UDM field. - `event.idm.read_only_udm.principal.user.email_addresses`: Newly mapped `created_by.user.username` raw log field with `event.idm.read_only_udm.principal.user.email_addresses` UDM field. - `event.idm.read_only_udm.target.user.email_addresses`: Newly mapped `resource.resource.user.username` raw log field with `event.idm.read_only_udm.target.user.email_addresses` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `resource.changes.status.before` and `resource.changes.status.after` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.principal.user.attribute.labels`: Newly mapped `created_by.user.href`, `created_by.agent.href`, `created_by.agent.hostname`, `created_by.ven.href`, `created_by.ven.hostname` raw log fields with `event.idm.read_only_udm.principal.user.attribute.labels` UDM field. - `event.idm.read_only_udm.target.user.attribute.labels`: Newly mapped `resource.resource.user.href`, `resource.resource.user.type` raw log fields with `event.idm.read_only_udm.target.user.attribute.labels` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `resource.resource.ven.href`, `resource.resource.agent.href` raw log fields with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `action.api_endpoint`, `action.uuid`, `resource.uuid`, `resource.change_type`, `resource.resource.workload.href`, `resource.resource.workload.name`, `resource.resource.workload.hostname`, `resource.changes.local.before`, `resource.changes.local.after`, `resource.changes.password_changed_at.before`, `resource.changes.last_goodbye_at.before`, `resource.changes.last_goodbye_at.after`, `resource.changes.name.after`, `resource.changes.enforcement_mode.before`, `resource.changes.enforcement_mode.after`, `resource.changes.description.after`, `resource.changes.password_changed_at.after`, `label.key`, `label.value`, `label.href` raw log fields with `event.idm.read_only_udm.security_result.detection_fields` UDM field.
2025-12-29	Enhancement: - Added new grok patterns to parse new format of syslog logs. - event.idm.read_only_udm.security_result.summary: Newly mapped `outcome` raw log field with event.idm.read_only_udm.security_result.summary UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `shost`, `program` raw log fields with event.idm.read_only_udm.security_result.detection_fields UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped `ip` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.security_result.severity: Newly mapped `level` raw log field with `event.idm.read_only_udm.security_result.severity` UDM field.
2025-12-11	Enhancement: - Added a new grok pattern to support new format of logs. - event.idm.read_only_udm.additional.fields: Newly mapped `org_id` raw log field with `org_id` as the key with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `network` raw log field with `network` as the key with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `src.dm` raw log field with `src_dm` as the key with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `src.os` raw log field with `src_os` as the key with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `src.vt_type` raw log field with `src_vt_type` as the key with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Removed explicit mappings for `src_labels.env`, `src_labels.app`, and `src_labels.role` and `src_labels` is handled dynamically using for loop iterating through `src_labels`, mapping each key-value pair (except loc) with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field with the key prefixed by `src_`. - event.idm.read_only_udm.target.resource.attribute.labels: Removed explicit mappings for `dst_labels.env`, `dst_labels.app`, and `dst_labels.role` and `dst_labels` is handled dynamically using for loop iterating through `dst_labels`, mapping each key-value pair (except loc) with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field with the key prefixed by `dst_`.
2024-11-14	Enhancement: - When there is no principal machine data available, then mapped `metadata.event_type` to `GENERIC_EVENT`. - Mapped `uuid`,`change_type`,`href`,`name`,`hostname` labels to `sec_res.detection_fields`
2024-04-18	Enhancement: - Enhanced parser to additionally support SYSLOG+CEF log formats.
2024-02-21	Enhancement: - Enhanced parser to additionally support SYSLOG and SYSLOG+JSON log formats.
2023-03-14	Newly created parser.