Change log for MICROSOFT_GRAPH_ALERT

Date	Changes
2026-07-10	- principal.ip: Corrected mapping for the raw log field evidence.senderIP. Resolved variable conflicts ensuring accurate mapping of evidence.senderIP to principal.ip UDM field when [e-mail] matches .*teamsMessageEvidence. - additional.fields: Appended loop index %_{index} to the additional.fields key names evidence_channelId_%{index} (teamsMessageEvidence) and start_utc_date_time_%{index} (cloudLogonSessionEvidence) for raw log fields evidence.channelId and evidence.startUtcDateTime for preventing protobuf unmarshaling errors when multiple evidence items contain these fields.
2026-06-01	- metadata.event_type : Added support for the new title, Purview IRM (45608f68) PROD-Europe Zone Policy to USER_RESOURCE_ACCESS - additional.fields[Intent]: Removed mapping of additionalData.Intent from additional.fields[Intent] UDM field - security_result.detection_fields[Intent]: Mapped additionalData.Intent raw log field with security_result.detection_fields[Intent] UDM field - additional.fields[AlertPolicyTitle]: Removed mapping of additionalData.AlertPolicyTitle from additional.fields[AlertPolicyTitle] UDM field - security_result.rule_labels[AlertPolicyTitle]: Mapped additionalData.AlertPolicyTitle raw log field with security_result.rule_labels[AlertPolicyTitle] UDM field - additional.fields[RiskScore]: Removed mapping of additionalData.RiskScore from additional.fields[RiskScore] UDM field - security_result.risk_score: Mapped additionalData.RiskScore raw log field with security_result.risk_score UDM field - additional.fields[AggregatedDataLeakTriggerEventInsightType]: Removed mapping of additionalData.AggregatedDataLeakTriggerEventInsightType from additional.fields[AggregatedDataLeakTriggerEventInsightType] UDM field - security_result.detection_fields[AggregatedDataLeakTriggerEventInsightType]: Mapped additionalData.AggregatedDataLeakTriggerEventInsightType raw log field with security_result.detection_fields[AggregatedDataLeakTriggerEventInsightType] UDM field - additional.fields[HighestScoredUserInsightStartTime]: Removed mapping of additionalData.HighestScoredUserInsightStartTime from additional.fields[HighestScoredUserInsightStartTime] UDM field - security_result.detection_fields[HighestScoredUserInsightStartTime]: Mapped additionalData.HighestScoredUserInsightStartTime raw log field with security_result.detection_fields[HighestScoredUserInsightStartTime] UDM field - additional.fields[LastTriggeringEvent]: Removed mapping of additionalData.LastTriggeringEvent from additional.fields[LastTriggeringEvent] UDM field - security_result.detection_fields[LastTriggeringEvent]: Mapped additionalData.LastTriggeringEvent raw log field with security_result.detection_fields[LastTriggeringEvent] UDM field - additional.fields[TriggeringSignalDateTimeUtc]: Removed mapping of additionalData.TriggeringSignalDateTimeUtc from additional.fields[TriggeringSignalDateTimeUtc] UDM field - security_result.detection_fields[TriggeringSignalDateTimeUtc]: Mapped additionalData.TriggeringSignalDateTimeUtc raw log field with security_result.detection_fields[TriggeringSignalDateTimeUtc] UDM field
2026-04-22	- Microsoft Teams chat initiated by a suspicious external user : Added support for the new title, Microsoft Teams chat initiated by a suspicious external user generated by the service source microsoft365Defender and its relevant fields.
2026-03-10	- DLP policy (DLP Policy_Global_Email_Drawing_Files) matched for email with subject: Added support for alerts generated when a DLP policy is matched for email with subject and mapped relevant corresponding raw log fields. - principal.network.email.to: Removed mapping of evidence.recipientEmailAddress from principal.network.email.to UDM field if the raw log field evidence.odata.type matches the regex .*analyzedMessageEvidence to introduce more accurate mapping. - about.network.email.to: Removed mapping of evidence.recipientEmailAddress from about.network.email.to UDM field if the raw log field evidence.odata.type matches the regex .*analyzedMessageEvidence to introduce more accurate mapping. - network.email.to: Mapped evidence.recipientEmailAddress raw log field with network.email.to UDM field if the raw log field evidence.odata.type matches the regex .*analyzedMessageEvidence. - principal.user.attribute.labels[user_account_user_principal_name]: Corrected mapping for the raw log field evidence.userAccount.userPrincipalName. Removed the erroneous mapping of evidence.userAccount.userPrincipalName to principal.user.attribute.labels[user_account_user_principal_name] which occurred when it was a valid email address and if the raw log field evidence.odata.type matches the regex (.*)(userEvidence|mailboxEvidence) to introduce more accurate mapping. This was caused by a variable name conflict in GROK filters. - principal.user.email_addresses: Mapped evidence.userAccount.userPrincipalName raw log field with principal.user.email_addresses UDM field when it contains a valid email address and if the raw log field evidence.odata.type matches the regex (.*)(userEvidence|mailboxEvidence), by resolving a variable name conflict with the evidence.recipientEmailAddress field processing.
2026-02-02	Modified the conditional value mapping for the security_result.action UDM field to introduce more accurate mappings. - security_result.action: Removed mapping of the value ALLOW from security_result.action UDM field and mapped the value BLOCK instead when all of the following conditions are met: - The raw log field serviceSource is equal to microsoftDefenderForEndpoint. - The raw log field [e-mail] matches the regex (.*)(fileEvidence|processEvidence). - The raw log field evidence.detectionStatus is equal to detected. - The raw log field title matches the regex (.*)(block|prevented|denied|declined). - security_result.action: Newly mapped value BLOCK with security_result.action UDM field when the raw log field title matches the regex (.*)(fileEvidence|processEvidence).
2026-01-07	- Handled the edge case for setting metadata.event_type to SCAN_HOST when title is Suspicious kernel module detected [seen multiple times].
2025-12-18	- network.http.user_agent: Newly mapped evidence.userAgent raw log field with network.http.user_agent UDM field if the raw log field [e-mail] conains the value cloudLogonSessionEvidence.
2025-12-16	- Added mapping for security_result.action based on evidence.detectionStatus when serviceSource is microsoftDefenderForEndpoint and [e-mail] having value as fileEvidence or processEvidence. - Mapped security_result.action to BLOCK when evidence.detectionStatus is prevented or blocked. - Mapped security_result.action to ALLOW when evidence.detectionStatus is detected.
2025-10-14	- security_result.detection_fields[determination]: Newly mapped determination raw log field with security_result.detection_fields[determination] UDM field.
2025-09-17	Improved error handling to cover various edge cases across multiple scenarios.
2025-08-12	- Suspicious Microsoft Defender Antivirus exclusion : Added support for the new event, Suspicious Microsoft Defender Antivirus exclusion in the detection source microsoftDefenderForEndpoint. - Mapped the evidence.hostName to the principal.hostname if evidence.deviceDnsName is empty in the deviceEvidence event.
2025-06-10	- target.file.names: Newly mapped file_name raw log field with target.file.names UDM field - Removed unexpected characters from the raw log field fileState.path to resolve parsing issues.
2025-01-06	Corrected typo: changed evi.p1Sender.emailAddress to evi.p2Sender.emailAddress.
2024-12-23	- Extracted and mapped the IP address, API endpoint, method, and status code from the customProperties log field.
2024-11-25	Newly created parser.