Change log for KNOWBE4_PHISHER

Date	Changes
2025-12-12	Enhancement: - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped receivedAt raw log field with event.idm.read_only_udm.metadata.event_timestamp UDM field. - event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped reportedAt raw log field with event.idm.read_only_udm.metadata.collected_timestamp UDM field. - event.idm.read_only_udm.intermediary.hostname: Newly mapped syslog_hostname raw log field with event.idm.read_only_udm.intermediary.hostname UDM field. - event.idm.read_only_udm.intermediary.asset.hostname: Newly mapped syslog_hostname raw log field with event.idm.read_only_udm.intermediary.asset.hostname UDM field. - event.idm.read_only_udm.principal.user.email_addresses: Newly mapped sender raw log field with event.idm.read_only_udm.principal.user.email_addresses UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped sender raw log field with event.idm.read_only_udm.principal.resource.attribute.labels UDM field. - event.idm.read_only_udm.target.user.email_addresses: Newly mapped reporter raw log field with event.idm.read_only_udm.target.user.email_addresses UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped reporter raw log field with event.idm.read_only_udm.target.resource.attribute.labels UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped action raw log field with event.idm.read_only_udm.security_result.detection_fields UDM field. - event.idm.read_only_udm.security_result.priority_details: Newly mapped priority raw log field with event.idm.read_only_udm.security_result.priority_details UDM field. - event.idm.read_only_udm.security_result.action_details: Newly mapped status raw log field with event.idm.read_only_udm.security_result.action_details UDM field. - event.idm.read_only_udm.network.email.subject: Newly mapped subject raw log field with event.idm.read_only_udm.network.email.subject UDM field. - event.idm.read_only_udm.security_result.category_details: Newly mapped category raw log field with event.idm.read_only_udm.security_result.category_details UDM field. - event.idm.read_only_udm.target.url: Newly mapped permalink raw log field with event.idm.read_only_udm.target.url UDM field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped syslog_program raw log field with event.idm.read_only_udm.metadata.product_event_type UDM field. - event.idm.read_only_udm.metadata.event_type: If has_principal_user_email is true, updated to USER_UNCATEGORIZED. - The parser now supports syslog-formatted logs, extracting a JSON payload from the message field. - The log drop condition has been updated to trigger only if both syslog grok parsing and the subsequent JSON parsing fail.
2025-06-05	Enhancement: - Added gsub to replace Message-ID with Message-Id and In-Reply-To with Reply-To for new logs. - Changed the field name from indexraw to indexhtml. - Changed the field name from indexraw to indextext. - Modified condition to check if indexhtml,indexraw and indextext is equal to the string 0 OR the integer 0. - event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip: Newly Mapped Received raw log field to extract the ip address and mapped with event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip UDM fields. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped Date raw log field to event.idm.read_only_udm.metadata.event_timestamp UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly Mapped Received-SPF, Authentication-Results, X-SES-RECEIPT, X-SES-DKIM-SIGNATURE, ARC-Seal, ARC-Message-Signature, ARC-Authentication-Results, X-Google-DKIM-Signature, X-Forwarded-Encrypted, X-Gm-Message-State, X-Received, X-Forwarded-To, X-Forwarded-For, DKIM-Signature, X-Gm-Gg, X-Google-Smtp-Source, and X-Gm-Features raw log fields with event.idm.read_only_udm.security_result.detection_fields UDM field.
2024-10-16	- Newly created parser.