Change log for AUTH_ZERO
| Date | Changes |
|---|---|
| 2025-05-12 | Enhancement:
- Added a gsub to replace "}{" with "},{" in message field. - event.idm.read_only_udm.metadata.product_version: Newly mapped "record_version" raw log field with "event.idm.read_only_udm.metadata.product_version" UDM field. - event.idm.read_only_udm.metadata.id: Newly mapped "record_id" raw log field with "event.idm.read_only_udm.metadata.id" UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped "record_detail_type" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.principal.file.full_path: Newly mapped "record_source" raw log field with "event.idm.read_only_udm.principal.file.full_path" UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped "record_account" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped "record_time" raw log field with "event.idm.read_only_udm.metadata.event_timestamp" UDM field. - event.idm.read_only_udm.principal.location.country_or_region: Newly mapped "record_region" raw log field with "event.idm.read_only_udm.principal.location.country_or_region" UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped "record_detail_log_id" raw log field with "event.idm.read_only_udm.metadata.product_log_id" UDM field. - event.idm.read_only_udm.security_result.description: Newly mapped "connection_" raw log field with "event.idm.read_only_udm.security_result.description" UDM field. - Replaced "record.detail.js_data.auth0_client.name" raw log field with "auth0_client_name". - Replaced "record.detail.js_data.auth0_client.version" raw log field with "auth0_client_version". - Replaced "record.detail.js_data.auth0_client.env.python" raw log field with "auth0_client_env_python". - Replaced "record.detail.js_data.audience" raw log field with "js_data_audience". - Replaced "record.detail.js_data.scope" raw log field with "js_data_scope". - Replaced "record.detail.js_data.tenant_name" raw log field with "js_data_tenant_name". - Replaced "record.detail.js_data.date" raw log field with "date". - Replaced "record.detail.js_data.type" raw log field with "type". - Replaced "record.detail.js_data.description" raw log field with "description". - Replaced "record.detail.js_data.connection_id" raw log field with "connection_id". - Replaced "record.detail.js_data.client_id" raw log field with "client_id". - Replaced "record.detail.js_data.client_name" raw log field with "client_name". - Replaced "record.detail.js_data.ip" raw log field with "ip". - Replaced "record.detail.js_data.client_ip" raw log field with "js_data_client_ip". - Replaced "record.detail.js_data.user_agent" raw log field with "user_agent". - Replaced "record.detail.js_data.user_id" raw log field with "user_id". - Replaced "record.detail.js_data.user_name" raw log field with "user_name". - event.idm.read_only_udm.additional.fields: Newly mapped "js_data_audience" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped "js_data_scope" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped "auth0_client_env_python" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped "js_data_tenant_name" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped "auth0_client_name" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped "auth0_client_version" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.principal.ip, event.idm.read_only_udm.principal.asset.ip: Newly mapped "js_data_client_ip" raw log field with "event.idm.read_only_udm.principal.ip" and "event.idm.read_only_udm.principal.asset.ip" UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped "ip" raw log field with "event.idm.read_only_udm.principal.asset.ip" UDM field. - Added "has_principal" flag for "js_data_client_ip", "ip" raw log fields. - event.idm.read_only_udm.additional.fields: Newly mapped "execution" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - event.idm.read_only_udm.principal.platform_version: Newly mapped "record.detail.js_data.$event_schema.version" raw log field with "event.idm.read_only_udm.principal.platform_version" UDM field. - Removed "has_principal" flag where "event.idm.read_only_udm.metadata.event_type" is "USER_UNCATEGORIZED". |
| 2025-04-24 | Enhancement:
- Added support for the new pattern of JSON logs. |
| 2025-04-21 | Enhancement:
- When "event.idm.read_only_udm.metadata.product_event_type = "s" then set the "event.idm.read_only_udm.metadata.event_type" to "USER_LOGIN". - When "event.idm.read_only_udm.metadata.product_event_type = "s" then set the "event.idm.read_only_udm.extensions.auth.type" to "MACHINE". |
| 2025-01-12 | Enhancement:
- Added support for a new log array pattern. |
| 2024-11-21 | Enhancement:
- Added support for a new pattern of JSON logs. |
| 2024-10-10 | Enhancement:
- Added support for a new pattern of JSON logs. |
| 2024-09-12 | Enhancement:
- Added support for a new pattern of JSON logs. |
| 2024-06-25 | Bug-Fix:
- Mapped "data.scope" to "additional.fields". |
| 2024-03-07 | Bug-Fix:
- Mapped "data.user_name" to "target.user.email_addresses". - Mapped "data.details.body.email_verified", "data.details.body.is_signup" to "security_result.detection_fields". - Mapped "data.details.body.transaction.redirect_uri" to "target.url". |
| 2023-06-19 | Newly created parser.
|