We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for KASPERSKY_ENDPOINT

Date Changes

2025-09-18 - Added support to parse the kvdata to appropriate UDM fields which were earlier mapped to metadata.description UDM field.
- event.idm.read_only_udm.metadata.product_event_type: Newly mapped Eventtype raw log field with event.idm.read_only_udm.metadata.product_event_type UDM field.
- event.idm.read_only_udm.principal.ip: Removed mapping of ipAddress from event.idm.read_only_udm.principal.ip in order to map it to the respective UDM fields
- event.idm.read_only_udm.principal.asset.ip: Removed mapping of ipAddress from event.idm.read_only_udm.principal.asset.ip in order to map it to the respective UDM fields
- event.idm.read_only_udm.metadata.product_version: Newly mapped version raw log field with event.idm.read_only_udm.metadata.product_version UDM field.
- event.idm.read_only_udm.principal.process.file.full_path: Removed mapping of objectName from event.idm.read_only_udm.principal.process.file.full_path UDM field and mapped Objectname instead.
- event.idm.read_only_udm.target.file.full_path: Removed mapping of pathToObject from event.idm.read_only_udm.target.file.full_path UDM field and mapped Pathtoobject instead.
- event.idm.read_only_udm.security_result.summary: Removed mapping of resultDescription from event.idm.read_only_udm.security_result.summary UDM field and mapped Resultdescription instead.
- event.idm.read_only_udm.principal.process.pid: Removed mapping of processID from event.idm.read_only_udm.principal.process.pid UDM field and mapped ProcessID instead.
- event.idm.read_only_udm.additional.fields: Removed mapping of FileName from event.idm.read_only_udm.additional.fields UDM field and mapped Name instead.
- event.idm.read_only_udm.additional.fields: Removed mapping of applicationPath from event.idm.read_only_udm.additional.fields UDM field and mapped Applicationpath instead.
- event.idm.read_only_udm.additional.fields: Removed mapping of objectType from event.idm.read_only_udm.additional.fields UDM field and mapped Objecttype instead.
- event.idm.read_only_udm.additional.fields: Removed mapping of resultDescription from event.idm.read_only_udm.additional.fields UDM field and mapped Resultdescription instead.
- event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped ResultOperation raw log field with event.idm.read_only_udm.principal.resource.attribute.labels UDM field.
- event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped Encryptiontype raw log field with event.idm.read_only_udm.principal.resource.attribute.labels UDM field.
- event.idm.read_only_udm.target.resource.resource_subtype: Newly mapped DevicetypeBustype raw log field with event.idm.read_only_udm.target.resource.resource_subtype UDM field.
- event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped Authenticationtype raw log field with event.idm.read_only_udm.principal.resource.attribute.labels UDM field.
- event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped SSID raw log field with event.idm.read_only_udm.principal.resource.attribute.labels UDM field.
- event.idm.read_only_udm.target.resource.type: Newly mapped Devicecategory raw log field with event.idm.read_only_udm.target.resource.type UDM field.
- event.idm.read_only_udm.target.resource.name: Newly mapped DeviceID raw log field with event.idm.read_only_udm.target.resource.name UDM field.
- event.idm.read_only_udm.security_result.action: Newly mapped ResultDecision raw log field with event.idm.read_only_udm.security_result.action UDM field.
- event.idm.read_only_udm.security_result.action_details: Newly mapped ResultDecision raw log field with event.idm.read_only_udm.security_result.action_details UDM field.

2025-02-12 - Newly created parser.

Date	Changes
2025-09-18	- Added support to parse the kvdata to appropriate UDM fields which were earlier mapped to `metadata.description` UDM field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped `Eventtype` raw log field with `event.idm.read_only_udm.metadata.product_event_type` UDM field. - event.idm.read_only_udm.principal.ip: Removed mapping of `ipAddress` from `event.idm.read_only_udm.principal.ip` in order to map it to the respective UDM fields - event.idm.read_only_udm.principal.asset.ip: Removed mapping of `ipAddress` from `event.idm.read_only_udm.principal.asset.ip` in order to map it to the respective UDM fields - event.idm.read_only_udm.metadata.product_version: Newly mapped `version` raw log field with `event.idm.read_only_udm.metadata.product_version` UDM field. - event.idm.read_only_udm.principal.process.file.full_path: Removed mapping of `objectName` from `event.idm.read_only_udm.principal.process.file.full_path` UDM field and mapped `Objectname` instead. - event.idm.read_only_udm.target.file.full_path: Removed mapping of `pathToObject` from `event.idm.read_only_udm.target.file.full_path` UDM field and mapped `Pathtoobject` instead. - event.idm.read_only_udm.security_result.summary: Removed mapping of `resultDescription` from `event.idm.read_only_udm.security_result.summary` UDM field and mapped `Resultdescription` instead. - event.idm.read_only_udm.principal.process.pid: Removed mapping of `processID` from `event.idm.read_only_udm.principal.process.pid` UDM field and mapped `ProcessID` instead. - event.idm.read_only_udm.additional.fields: Removed mapping of `FileName` from `event.idm.read_only_udm.additional.fields` UDM field and mapped `Name` instead. - event.idm.read_only_udm.additional.fields: Removed mapping of `applicationPath` from `event.idm.read_only_udm.additional.fields` UDM field and mapped `Applicationpath` instead. - event.idm.read_only_udm.additional.fields: Removed mapping of `objectType` from `event.idm.read_only_udm.additional.fields` UDM field and mapped `Objecttype` instead. - event.idm.read_only_udm.additional.fields: Removed mapping of `resultDescription` from `event.idm.read_only_udm.additional.fields` UDM field and mapped `Resultdescription` instead. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `ResultOperation` raw log field with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `Encryptiontype` raw log field with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.target.resource.resource_subtype: Newly mapped `DevicetypeBustype` raw log field with `event.idm.read_only_udm.target.resource.resource_subtype` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `Authenticationtype` raw log field with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `SSID` raw log field with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.target.resource.type: Newly mapped `Devicecategory` raw log field with `event.idm.read_only_udm.target.resource.type` UDM field. - event.idm.read_only_udm.target.resource.name: Newly mapped `DeviceID` raw log field with `event.idm.read_only_udm.target.resource.name` UDM field. - event.idm.read_only_udm.security_result.action: Newly mapped `ResultDecision` raw log field with `event.idm.read_only_udm.security_result.action` UDM field. - event.idm.read_only_udm.security_result.action_details: Newly mapped `ResultDecision` raw log field with `event.idm.read_only_udm.security_result.action_details` UDM field.
2025-02-12	- Newly created parser.