Change log for ELASTIC_DEFEND

Date	Changes
2025-05-15	- `event.idm.read_only_udm.principal.user.group_identifiers`: Newly mapped `_source.group.name` raw log field to `event.idm.read_only_udm.principal.user.group_identifiers` UDM field. - `event.idm.read_only_udm.target.process.command_line`: Removed mapping of `_source.process.name` raw log field from `event.idm.read_only_udm.target.process.command_line` UDM field. - `event.idm.read_only_udm.principal.process.command_line`: Mapped `_source.process.name` raw log field to `event.idm.read_only_udm.principal.process.command_line` UDM field. - `event.idm.read_only_udm.target.process.file.full_path`: Removed mapping of `_source.process.executable` raw log field from `event.idm.read_only_udm.target.process.file.full_path` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `_source.user.name` raw log field to `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.principal.process.file.full_path`: Removed mapping of `source.process.parent.executable` raw log field from `event.idm.read_only_udm.principal.process.file.full_path` UDM field. - `event.idm.read_only_udm.principal.process.parent_process.file.full_path`: Mapped `source.process.parent.executable` raw log field to `event.idm.read_only_udm.principal.process.parent_process.file.full_path` UDM field. - `event.idm.read_only_udm.security_result.ruleset`: Newly mapped `_source.rule.rule_set` raw log field to `event.idm.read_only_udm.security_result.rule_set` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `_source.group.id` raw log field to `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.security_result.rule_name': Newly mapped `_source.rule.name` raw log field to `event.idm.read_only_udm.security_result.rule_name` UDM field. - `event.idm.read_only_udm.security_result.rule_set': Newly mapped `_source.rule.ruleset` raw log field to `event.idm.read_only_udm.security_result.rule_set` UDM field. - `event.idm.read_only_udm.security_result.rule_id': Newly mapped `_source.rule.id` raw log field to `event.idm.read_only_udm.security_result.rule_id` UDM field. - `event.idm.read_only_udm.security_result.threat_name': Newly mapped `_source.file.Ext.malware_signature.primary.signature.name` raw log field to `event.idm.read_only_udm.security_result.threat_name` UDM field. - `event.idm.read_only_udm.security_result.threat_id': Newly mapped `_source.file.Ext.malware_signature.primary.signature.id` raw log field to `event.idm.read_only_udm.security_result.threat_id` UDM field. - `event.idm.read_only_udm.target.file.sha256': Newly mapped `_source.file.Ext.malware_signature.primary.signature.hash.sha256` raw log field to `event.idm.read_only_udm.target.file.sha256` UDM field. - `event.idm.read_only_udm.security_result.detection_fields': Newly mapped `_source.file.Ext.malware_signature.all_names` raw log field to `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.security_result.detection_fields': Newly mapped `_source.file.Ext.malware_signature.identifier` raw log field to `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.additional.fields': Newly mapped `_source.user.id` raw log field to `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.target.user.userid': Newly mapped `_source.process.entity_id` raw log field to `event.idm.read_only_udm.target.user.userid` UDM field. - `event.idm.read_only_udm.principal.process.pid': Newly mapped `_source.process.pid` raw log field to `event.idm.read_only_udm.principal.process.pid` UDM field.
2025-03-04	- Newly Parser Created.

Date

Changes

2025-05-15

- `event.idm.read_only_udm.principal.user.group_identifiers`: Newly mapped `_source.group.name` raw log field to `event.idm.read_only_udm.principal.user.group_identifiers` UDM field.
- `event.idm.read_only_udm.target.process.command_line`: Removed mapping of `_source.process.name` raw log field from `event.idm.read_only_udm.target.process.command_line` UDM field.
- `event.idm.read_only_udm.principal.process.command_line`: Mapped `_source.process.name` raw log field to `event.idm.read_only_udm.principal.process.command_line` UDM field.
- `event.idm.read_only_udm.target.process.file.full_path`: Removed mapping of `_source.process.executable` raw log field from `event.idm.read_only_udm.target.process.file.full_path` UDM field.
- `event.idm.read_only_udm.principal.user.userid`: Newly mapped `_source.user.name` raw log field to `event.idm.read_only_udm.principal.user.userid` UDM field.
- `event.idm.read_only_udm.principal.process.file.full_path`: Removed mapping of `source.process.parent.executable` raw log field from `event.idm.read_only_udm.principal.process.file.full_path` UDM field.
- `event.idm.read_only_udm.principal.process.parent_process.file.full_path`: Mapped `source.process.parent.executable` raw log field to `event.idm.read_only_udm.principal.process.parent_process.file.full_path` UDM field.
- `event.idm.read_only_udm.security_result.ruleset`: Newly mapped `_source.rule.rule_set` raw log field to `event.idm.read_only_udm.security_result.rule_set` UDM field.
- `event.idm.read_only_udm.additional.fields`: Newly mapped `_source.group.id` raw log field to `event.idm.read_only_udm.additional.fields` UDM field.
- `event.idm.read_only_udm.security_result.rule_name': Newly mapped `_source.rule.name` raw log field to `event.idm.read_only_udm.security_result.rule_name` UDM field.
- `event.idm.read_only_udm.security_result.rule_set': Newly mapped `_source.rule.ruleset` raw log field to `event.idm.read_only_udm.security_result.rule_set` UDM field.
- `event.idm.read_only_udm.security_result.rule_id': Newly mapped `_source.rule.id` raw log field to `event.idm.read_only_udm.security_result.rule_id` UDM field.
- `event.idm.read_only_udm.security_result.threat_name': Newly mapped `_source.file.Ext.malware_signature.primary.signature.name` raw log field to `event.idm.read_only_udm.security_result.threat_name` UDM field.
- `event.idm.read_only_udm.security_result.threat_id': Newly mapped `_source.file.Ext.malware_signature.primary.signature.id` raw log field to `event.idm.read_only_udm.security_result.threat_id` UDM field.
- `event.idm.read_only_udm.target.file.sha256': Newly mapped `_source.file.Ext.malware_signature.primary.signature.hash.sha256` raw log field to `event.idm.read_only_udm.target.file.sha256` UDM field.
- `event.idm.read_only_udm.security_result.detection_fields': Newly mapped `_source.file.Ext.malware_signature.all_names` raw log field to `event.idm.read_only_udm.security_result.detection_fields` UDM field.
- `event.idm.read_only_udm.security_result.detection_fields': Newly mapped `_source.file.Ext.malware_signature.identifier` raw log field to `event.idm.read_only_udm.security_result.detection_fields` UDM field.
- `event.idm.read_only_udm.additional.fields': Newly mapped `_source.user.id` raw log field to `event.idm.read_only_udm.additional.fields` UDM field.
- `event.idm.read_only_udm.target.user.userid': Newly mapped `_source.process.entity_id` raw log field to `event.idm.read_only_udm.target.user.userid` UDM field.
- `event.idm.read_only_udm.principal.process.pid': Newly mapped `_source.process.pid` raw log field to `event.idm.read_only_udm.principal.process.pid` UDM field.

2025-03-04

- Newly Parser Created.