We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for MANAGE_ENGINE_AD360

Date Changes

2025-08-05 - Added a new grok pattern for message data field to add support for the dropped logs.
- Newly added JSON filter for message data field to add support for the dropped logs.
- Newly added gsub for the message, kv_data1 data field to parse the following log fields.
- Added a kv filter for message,kv_data1 data field to parse the following log fields.
- event.idm.read_only_udm.principal.application: Newly mapped appname raw log field to event.idm.read_only_udm.principal.application.
- event.idm.read_only_udm.principal.hostname and event.idm.read_only_udm.principal.asset.hostname: Newly mapped hostname raw log field to event.idm.read_only_udm.principal.hostname UDM field and event.idm.read_only_udm.principal.asset.hostname UDM field.
- event.idm.read_only_udm.principal.user.userid: Newly mapped TechnicianName raw log field to event.idm.read_only_udm.principal.user.userid UDM field.
- event.idm.read_only_udm.principal.process.command_line: Newly mapped ModuleName raw log field to event.idm.read_only_udm.principal.process.command_line UDM field.
- event.idm.read_only_udm.target.user.userid: Newly mapped Nombre_de_objeto raw log field to event.idm.read_only_udm.target.user.userid UDM field.
- event.idm.read_only_udm.target.administrative_domain: Newly mapped Nombre_de_dominio raw log field to event.idm.read_only_udm.target.administrative_domain UDM field.
- event.idm.read_only_udm.security_result.summary : Newly mapped Estado raw log field to event.idm.read_only_udm.security_result.summary UDM field.
- event.idm.read_only_udm.target.user.phone_numbers: Newly mapped telephoneNumber raw log field to event.idm.read_only_udm.target.user.phone_numbers UDM field.
- event.idm.read_only_udm.additional.fields: Newly mapped facility, priority, version, Tipo de contraseña (as key password_type), Nombre de la plantilla (as key template_name), mobile raw log fields to event.idm.read_only_udm.additional.fields.
- event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped userAccountControl raw log field to event.idm.read_only_udm.target.resource.attribute.labels UDM field.
- event.idm.read_only_udm.security_result.rule_name : Newly mapped ACTION raw log field to event.idm.read_only_udm.security_result.rule_name UDM field.
- event.idm.read_only_udm.metadata.event_type : Newly mapped event.idm.read_only_udm.metadata.event_type as NETWORK_CONNECTION if has_principal is true and has_target is true,USER_CHANGE_PERMISSIONS if has_principal is true and has_target_user is true, STATUS_UPDATE if has_principal is true and has_target is false, GENERIC_EVENT otherwise.

2022-09-16 Newly created parser.

Date	Changes
2025-08-05	- Added a new grok pattern for `message` data field to add support for the dropped logs. - Newly added JSON filter for `message` data field to add support for the dropped logs. - Newly added gsub for the `message`, `kv_data1` data field to parse the following log fields. - Added a kv filter for `message`,`kv_data1` data field to parse the following log fields. - `event.idm.read_only_udm.principal.application`: Newly mapped `appname` raw log field to event.idm.read_only_udm.principal.application. - `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `hostname` raw log field to `event.idm.read_only_udm.principal.hostname` UDM field and `event.idm.read_only_udm.principal.asset.hostname` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `TechnicianName` raw log field to `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.principal.process.command_line`: Newly mapped `ModuleName` raw log field to `event.idm.read_only_udm.principal.process.command_line` UDM field. - `event.idm.read_only_udm.target.user.userid`: Newly mapped `Nombre_de_objeto` raw log field to `event.idm.read_only_udm.target.user.userid` UDM field. - `event.idm.read_only_udm.target.administrative_domain`: Newly mapped `Nombre_de_dominio` raw log field to `event.idm.read_only_udm.target.administrative_domain` UDM field. - `event.idm.read_only_udm.security_result.summary` : Newly mapped `Estado` raw log field to `event.idm.read_only_udm.security_result.summary` UDM field. - `event.idm.read_only_udm.target.user.phone_numbers`: Newly mapped `telephoneNumber` raw log field to `event.idm.read_only_udm.target.user.phone_numbers` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `facility`, `priority`, `version`, `Tipo de contraseña` (as key password_type), `Nombre de la plantilla` (as key template_name), `mobile` raw log fields to `event.idm.read_only_udm.additional.fields`. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `userAccountControl` raw log field to `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.security_result.rule_name` : Newly mapped `ACTION` raw log field to `event.idm.read_only_udm.security_result.rule_name` UDM field. - `event.idm.read_only_udm.metadata.event_type` : Newly mapped `event.idm.read_only_udm.metadata.event_type` as `NETWORK_CONNECTION` if `has_principal` is `true` and `has_target` is `true`,`USER_CHANGE_PERMISSIONS` if `has_principal` is `true` and `has_target_user` is `true`, `STATUS_UPDATE` if `has_principal` is `true` and has_target is `false`, `GENERIC_EVENT` otherwise.
2022-09-16	Newly created parser.