We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for MICROSOFT_DEFENDER_MAIL

Date	Changes
2026-07-19	Enhancement: - `event.idm.read_only_udm.security_result.category_details`: Removed mapping of `category` from `event.idm.read_only_udm.security_result.category_details` UDM field as this field describes what product is generated by the event. - `event.idm.read_only_udm.metadata.product_name`: Mapped `category` raw log field with `event.idm.read_only_udm.metadata.product_name` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Removed mapping of `properties.SenderObjectId` from `event.idm.read_only_udm.security_result.detection_fields` UDM field in order to introduce a more accurate mapping. - `event.idm.read_only_udm.principal.user.product_object_id`: Mapped `properties.SenderObjectId` raw log field with `event.idm.read_only_udm.principal.user.product_object_id` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Removed mapping of `properties.RecipientObjectId` from `event.idm.read_only_udm.security_result.detection_fields` UDM field in order to introduce a more accurate mapping. - `event.idm.read_only_udm.target.user.product_object_id`: Mapped `properties.RecipientObjectId` raw log field with `event.idm.read_only_udm.target.user.product_object_id` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Removed mapping of `properties.ReportId` from `event.idm.read_only_udm.security_result.detection_fields` UDM field in order to introduce a more accurate mapping. - `event.idm.read_only_udm.metadata.product_log_id`: Mapped `properties.ReportId` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Removed mapping of `properties.NetworkMessageId` from `event.idm.read_only_udm.security_result.detection_fields` UDM field in order to introduce a more accurate mapping. - `event.idm.read_only_udm.network.session_id`: Mapped `properties.NetworkMessageId` raw log field with `event.idm.read_only_udm.network.session_id` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Removed mapping of `properties.InternetMessageId` from `event.idm.read_only_udm.security_result.detection_fields` UDM field in order to introduce a more accurate mapping. - `event.idm.read_only_udm.network.email.mail_id`: Mapped `properties.InternetMessageId` raw log field with `event.idm.read_only_udm.network.email.mail_id` UDM field. - `event.idm.read_only_udm.additional.fields`: Removed mapping of `properties.SenderMailFromAddress` from `event.idm.read_only_udm.additional.fields` UDM field as it is a duplicate mapping. - `event.idm.read_only_udm.target.resource.id`: Removed mapping of `_raw.tenantId` from `event.idm.read_only_udm.target.resource.id` UDM field as it is a deprecated field. - `event.idm.read_only_udm.target.resource.product_object_id`: Mapped `_raw.tenantId` raw log field with `event.idm.read_only_udm.target.resource.product_object_id` UDM field. - `event.idm.read_only_udm.principal.user.product_object_id`: Removed mapping of `tenantId` from `event.idm.read_only_udm.principal.user.product_object_id` UDM field in order to ensure parser consistency. - `event.idm.read_only_udm.target.resource.product_object_id`: Mapped `tenantId` raw log field with `event.idm.read_only_udm.target.resource.product_object_id` UDM field. - `event.idm.read_only_udm.metadata.product_event_type`: Removed mapping of `operationName` from `event.idm.read_only_udm.metadata.product_event_type` UDM field as it is not a relevant field mapping. - `event.idm.read_only_udm.additional.fields`: Mapped `operationName` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.metadata.product_event_type`: Mapped `category_event` field with `event.idm.read_only_udm.metadata.product_event_type` UDM field. - `event.idm.read_only_udm.target.file.mime_type`: Mapped the values of `_raw.properties.FileType` and `properties.FileType` raw log fields to `event.idm.read_only_udm.target.file.mime_type` UDM field more accurately. - Added support for the new timestamp format for the `properties.Timestamp` raw log field.
2026-07-17	Enhancement: - `event.idm.read_only_udm.additional.fields`: Mapped `properties.EmailDirection` and `_raw.properties.EmailDirection` raw log field to `event.idm.read_only_udm.additional.fields` UDM field with `UNKNOWN_DIRECTION` when `properties.EmailDirection` is neither `INBOUND` nor `OUTBOUND`. - `event.idm.read_only_udm.network.direction`: Newly mapped `_raw.properties.EmailDirection` raw log field to `event.idm.read_only_udm.network.direction` UDM field.
2026-06-30	Enhancement: - event.idm.read_only_udm.network.email.to: Newly mapped `extracted_email` raw log field to `event.idm.read_only_udm.network.email.to` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `display_name` raw log field to `event.idm.read_only_udm.additional.fields` UDM field.
2026-06-29	- Added length validation (1-253 characters) for email addresses mapped from `_raw.properties.RecipientEmailAddress`, `receiptAddre`, and `properties.To`, `properties.AccountUpn` raw log fields. - Added grok pattern to extract email addresses from `properties.To` raw log field. -`event.idm.read_only_udm.metadata.vendor_name`: Updated vendor name from `MICROSOFT_DEFENDER_MAIL` to `MICROSOFT`.
2026-06-17	- `event.idm.read_only_udm.metadata.event_timestamp`: Removed mapping of `time` from `event.idm.read_only_udm.metadata.event_timestamp` UDM field because `time` represents the collection timestamp, not the event occurrence time. - `event.idm.read_only_udm.metadata.collected_timestamp`: Mapped `time` raw log field to `event.idm.read_only_udm.metadata.collected_timestamp` UDM field because `time` represents the time the log was collected. - `event.idm.read_only_udm.additional.fields`: Removed mapping of `properties.Timestamp` from `event.idm.read_only_udm.additional.fields` UDM field because `properties.Timestamp` is the actual event time and should be mapped to `event.idm.read_only_udm.metadata.event_timestamp`. - `event.idm.read_only_udm.metadata.event_timestamp`: Mapped `properties.Timestamp` raw log field to `event.idm.read_only_udm.metadata.event_timestamp` UDM field because `properties.Timestamp` represents the time the event occurred. - `event.idm.read_only_udm.metadata.collected_timestamp`: Removed mapping of `_TimeReceivedBySvc` from `event.idm.read_only_udm.metadata.collected_timestamp` UDM field because `_TimeReceivedBySvc` is more appropriately categorized as a security detection related field. - `event.idm.read_only_udm.security_result.detection_fields`: Mapped `_TimeReceivedBySvc` raw log field to `event.idm.read_only_udm.security_result.detection_fields` UDM field as it is security detection related field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `properties.UrlChainPosition` raw log field to `event.idm.read_only_udm.additional.fields` UDM field.
2026-06-10	- `event.idm.read_only_udm.target.email`: When `properties.AccountUpn` is a valid email, mapped `properties.AccountUpn` raw log field to `event.idm.read_only_udm.target.email`. - `event.idm.read_only_udm.target.user.userid`: Mapped `properties.AccountUpn` raw log field to `event.idm.read_only_udm.target.user.userid` UDM field when `properties.AccountUpn` is not a valid email. - `event.idm.read_only_udm.target.application`: Newly mapped `properties.AppName` raw log field with `event.idm.read_only_udm.target.application` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `properties.AppVersion` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `properties.SourceId` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.metadata.event_type`: when has_target_user is true and has_principal is true, updated `event.idm.read_only_udm.metadata.event_type` to `USER_UNCATEGORIZED` event type.
2026-05-21	- `event.idm.read_only_udm.additional.fields`: Newly mapped `properties.Timestamp` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.target.file.sha256`: Newly mapped `properties.SHA256` raw log field with `event.idm.read_only_udm.target.file.sha256` UDM field. - `event.idm.read_only_udm.metadata.event_type`: Updated `event.idm.read_only_udm.metadata.event_type` to `EMAIL_TRANSACTION` based on the necessary data present in the logs.
2026-05-13	- `event.idm.read_only_udm.additional.fields`: Updated mapping of `properties.SenderFromAddress` from `event.idm.read_only_udm.additional.fields` to `event.idm.read_only_udm.network.email.from` as it corresponds to `network.email` details. - `event.idm.read_only_udm.network.email.from` : Mapped `properties.SenderFromAddress` raw log field to `event.idm.read_only_udm.network.email.from` UDM field if it matches email pattern and `_raw.properties.SenderFromAddress` field is not present. - `event.idm.read_only_udm.additional.fields`: Newly mapped `properties.Connectors` raw log field to `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.additional.fields`: Mapped `properties.To` raw log field to `event.idm.read_only_udm.additional.fields` UDM field if `properties.To` is not a valid email. - `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `_TimeReceivedBySvc` raw log field to `event.idm.read_only_udm.metadata.collected_timestamp` UDM field.
2025-09-19	- `event.idm.read_only_udm.network.email.to`: Newly mapped `properties.To` raw log field to `event.idm.read_only_udm.network.email.to` UDM field. - `event.idm.read_only_udm.network.received_bytes`: Newly mapped `properties.EmailSize` raw log field to `event.idm.read_only_udm.network.received_bytes` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `properties.EmailClusterId`, `properties.BulkComplaintLevel`, `properties.ExchangeTransportRule`, `properties.IsFirstContact` raw log fields to `event.idm.read_only_udm.additional.fields` UDM field. - `Modified handling of` DetectionMethods `raw log field Phish array elements are now mapped to indexed keys within` event.idm.read_only_udm.additional.fields` instead of being aggregated into a list under a single `Phish` key. - `Modified handling of` DetectionMethods `raw log field Spam array elements are now mapped to indexed keys within` event.idm.read_only_udm.additional.fields` instead of being aggregated into a list under a single `Spam` key. - `event.idm.read_only_udm.target.hostname`: Newly mapped `properties.RecipientDomain` raw log field to `event.idm.read_only_udm.target.hostname` UDM field. - Set the `event.idm.read_only_udm.metadata.event_type` to `NETWORK_CONNECTION` if both has_principal and has_target are true.
2025-03-24	- Enhanced email validation for `_raw.properties.SenderMailFromAddress` before assigning to `principal.email`, using both regular expression and length checks. - Corrected merge target for `_raw.properties.EmailClusterId` from `event1.idm.read_only_udm.additional.fields` to `additional.fields` to ensure proper population of the field. - Implemented length check on `_raw.properties.SenderFromAddress` before assigning to `network.email.from` to ensure it's a valid email format.
2025-01-23	- Mapped `properties.Action` to `security_result.action_details` . - Mapped `properties.ActionType` to `security_result.detection_fields`.
2024-10-10	- Added support to parse new format of unparsed JSON logs.
2024-08-06	- Newly created parser.