Change log for AZURE_STORAGE_AUDIT
| Date | Changes |
|---|---|
| 2025-05-16 | - Added "parse_app_protocol.include" file to add support for "event.idm.read_only_udm.network.application_protocol" UDM field-
- `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.operationCount" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.requestHeaderSize" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.responseHeaderSize" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.requestBodySize" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.responseBodySize" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.network.session_id`: Newly mapped "properties.smbSessionId" raw log field with "event.idm.read_only_udm.network.session_id" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.smbTreeConnectID" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.smbPersistentHandleID" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.smbVolatileHandleID" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.smbCreditsConsumed" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.smbMessageID" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.smbCommandMajor" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped "properties.smbCommandDetail" raw log field with "event.idm.read_only_udm.target.resource.attribute.labels" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "properties.smbFileId" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped "loggingSourceName" raw log field with "event.idm.read_only_udm.additional.fields" UDM field. - `event.idm.read_only_udm.security_result.summary`: Newly mapped "loggingSourceName" raw log field with "event.idm.read_only_udm.security_result.summary" UDM field. - `event.idm.read_only_udm.security_result.action`: Newly mapped "loggingSourceName" raw log field with "event.idm.read_only_udm.security_result.action" UDM field. |
| 2024-12-12 | - Mapped "identity.tokenHash", "identity.type", "identity.requester.appId", "identity.requester.tenantId", "identity.requester.tokenIssuer", "properties.sourceAccessTier", "principal.type", "auth.action", "auth.roleAssignmentId", and "auth.roleDefinitionId" to "additional.fields".
- Mapped "identity.requester.upn" to "src.user.userid". - Mapped "identity.requester.objectId" to "src.user.product_object_id". |
| 2024-12-06 | - Mapped "smbCommandMinor" to "security_result.action_details".
|
| 2024-07-31 | - Initialized "statusText" and "correlationId" to null.
|
| 2024-04-08 | - Created new parser.
|