Change log for WINDOWS_DEFENDER_AV

Date	Changes
2026-04-06	Enhancement - - event.idm.read_only_udm.security_result.summary: Removed mapping of Threat Name from event.idm.read_only_udm.security_result.summary UDM field when EventID is 1116 or 1117 in order to introduce a more event specific mapping. - event.idm.read_only_udm.security_result.summary: Mapped the EventID raw log field to the event.idm.read_only_udm.security_result.summary UDM field when EventID is 1116 or 1117, since EventID more accurately represents the event summary. - event.idm.read_only_udm.security_result.description: Removed mapping of EventID from event.idm.read_only_udm.security_result.description UDM field when EventID is 1116 or 1117 in order to introduce a more event specific mapping. - event.idm.read_only_udm.security_result.description: Updated the value based on EventID: - If EventID is 1116: Microsoft Defender Antivirus detected malware or other potentially unwanted software. - If EventID is 1117: Microsoft Defender Antivirus performed an action to protect your system from malware or other potentially unwanted software. - If EventID is 1118: Microsoft Defender Antivirus attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed. - If EventID is 1119: Microsoft Defender Antivirus encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message. - If EventID is 1120: Microsoft Defender Antivirus deduced the hashes for a threat resource. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped EventRecordID raw log field with event.idm.read_only_udm.metadata.product_log_id UDM field. - event.idm.read_only_udm.metadata.product_version: Newly mapped Product Version raw log field with event.idm.read_only_udm.metadata.product_version UDM field. - event.idm.read_only_udm.metadata.product_deployment_id: Newly mapped ProviderGuid raw log field with event.idm.read_only_udm.metadata.product_deployment_id UDM field. - event.idm.read_only_udm.principal.asset.hostname: Newly mapped Hostname raw log field with event.idm.read_only_udm.principal.asset.hostname UDM field. - event.idm.read_only_udm.principal.url: Newly mapped xmlns raw log field with event.idm.read_only_udm.principal.url UDM field. - event.idm.read_only_udm.target.file.full_path: Newly mapped Threat Resource Path raw log field with event.idm.read_only_udm.target.file.full_path UDM field. - event.idm.read_only_udm.target.file.sha1: Newly mapped Hashes raw log field with event.idm.read_only_udm.target.file.sha1 UDM field. - event.idm.read_only_udm.security_result.severity_details: Newly mapped RenderingInfoLevel raw log field with event.idm.read_only_udm.security_result.severity_details UDM field. - event.idm.read_only_udm.security_result.action_details: Newly mapped Action Name raw log field with event.idm.read_only_udm.security_result.action_details UDM field. - event.idm.read_only_udm.security_result.first_discovered_time: Newly mapped Detection Time raw log field with event.idm.read_only_udm.security_result.first_discovered_time UDM field. - event.idm.read_only_udm.security_result.threat_id: Newly mapped Threat ID raw log field with event.idm.read_only_udm.security_result.threat_id UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped Remediation User, Status Description, Action ID, Additional Actions ID, Additional Actions String, Category ID, Detection ID, Engine Version, Error Code, Error Description, Execution ID, Execution Name, Origin ID, Origin Name, Post Clean Status, Pre Execution Status, Security Intelligence Version, Severity ID, Source ID, State, Status Code, Type ID, Type Name raw log fields with event.idm.read_only_udm.security_result.detection_fields UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped Level, Culture, Keywords, Opcode, Product Name, Provider Name, RenderingInfoMessage, Service, Task, Version and Security UserID raw log fields with event.idm.read_only_udm.additional.fields UDM field. - event.idm.read_only_udm.security_result.summary: Newly mapped EventID raw log field with event.idm.read_only_udm.security_result.summary UDM field when EventID is 1118, 1119 or 1120. - Added on_error handling to the type conversion of the ProcessID raw log field, which is mapped to the event.idm.read_only_udm.principal.process.pid UDM field.
2025-02-27	Enhancement - - Added gsub to parse unparsed logs. - Changed mapping of Path from target.process.file.full_path to target.registry.registry_key. - Added a conditional check when mapping event_type to SCAN_HOST, SCAN_FILE, and GENERIC_EVENT.
2025-02-14	Enhancement - - Added support for new JSON log format.
2024-01-30	Bug-Fix - - Added on_error check for date filter to parse UNIX and UNIX_MS format.
2023-09-04	Bug-Fix - - Parsed date by adding rebase as true. - Additionally mapped the following fields: - UserID is mapped to principal.user.userid. - Category Name mapped to security_result.category_details. - ProviderGuid mapped to metadata.product_deployment_id. - RecordNumber mapped to metadata.product_log_id. - ActivityID mapped to security_result.detection_fields. - ProcessID mapped to principal.process.pid. - Domain mapped to principal.administrative_domain. - FWLink mapped to metadata.url_back_to_product. - Path mapped to target.process.file.full_path.