Change log for MANAGE_ENGINE_AD360

Date	Changes
2025-08-05	- Added a new grok pattern for `message` data field to add support for the dropped logs. - Newly added JSON filter for `message` data field to add support for the dropped logs. - Newly added gsub for the `message`, `kv_data1` data field to parse the following log fields. - Added a kv filter for `message`,`kv_data1` data field to parse the following log fields. - `event.idm.read_only_udm.principal.application`: Newly mapped `appname` raw log field to event.idm.read_only_udm.principal.application. - `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `hostname` raw log field to `event.idm.read_only_udm.principal.hostname` UDM field and `event.idm.read_only_udm.principal.asset.hostname` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `TechnicianName` raw log field to `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.principal.process.command_line`: Newly mapped `ModuleName` raw log field to `event.idm.read_only_udm.principal.process.command_line` UDM field. - `event.idm.read_only_udm.target.user.userid`: Newly mapped `Nombre_de_objeto` raw log field to `event.idm.read_only_udm.target.user.userid` UDM field. - `event.idm.read_only_udm.target.administrative_domain`: Newly mapped `Nombre_de_dominio` raw log field to `event.idm.read_only_udm.target.administrative_domain` UDM field. - `event.idm.read_only_udm.security_result.summary` : Newly mapped `Estado` raw log field to `event.idm.read_only_udm.security_result.summary` UDM field. - `event.idm.read_only_udm.target.user.phone_numbers`: Newly mapped `telephoneNumber` raw log field to `event.idm.read_only_udm.target.user.phone_numbers` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `facility`, `priority`, `version`, `Tipo de contraseña` (as key password_type), `Nombre de la plantilla` (as key template_name), `mobile` raw log fields to `event.idm.read_only_udm.additional.fields`. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `userAccountControl` raw log field to `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.security_result.rule_name` : Newly mapped `ACTION` raw log field to `event.idm.read_only_udm.security_result.rule_name` UDM field. - `event.idm.read_only_udm.metadata.event_type` : Newly mapped `event.idm.read_only_udm.metadata.event_type` as `NETWORK_CONNECTION` if `has_principal` is "true" and `has_target` is "true",`USER_CHANGE_PERMISSIONS` if `has_principal` is "true" and `has_target_user` is "true", `STATUS_UPDATE` if `has_principal` is "true" and has_target is "false", `GENERIC_EVENT` otherwise.
2022-09-16	Newly created parser.

Date

Changes

2025-08-05

- Added a new grok pattern for `message` data field to add support for the dropped logs.
- Newly added JSON filter for `message` data field to add support for the dropped logs.
- Newly added gsub for the `message`, `kv_data1` data field to parse the following log fields.
- Added a kv filter for `message`,`kv_data1` data field to parse the following log fields.
- `event.idm.read_only_udm.principal.application`: Newly mapped `appname` raw log field to event.idm.read_only_udm.principal.application.
- `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `hostname` raw log field to `event.idm.read_only_udm.principal.hostname` UDM field and `event.idm.read_only_udm.principal.asset.hostname` UDM field.
- `event.idm.read_only_udm.principal.user.userid`: Newly mapped `TechnicianName` raw log field to `event.idm.read_only_udm.principal.user.userid` UDM field.
- `event.idm.read_only_udm.principal.process.command_line`: Newly mapped `ModuleName` raw log field to `event.idm.read_only_udm.principal.process.command_line` UDM field.
- `event.idm.read_only_udm.target.user.userid`: Newly mapped `Nombre_de_objeto` raw log field to `event.idm.read_only_udm.target.user.userid` UDM field.
- `event.idm.read_only_udm.target.administrative_domain`: Newly mapped `Nombre_de_dominio` raw log field to `event.idm.read_only_udm.target.administrative_domain` UDM field.
- `event.idm.read_only_udm.security_result.summary` : Newly mapped `Estado` raw log field to `event.idm.read_only_udm.security_result.summary` UDM field.
- `event.idm.read_only_udm.target.user.phone_numbers`: Newly mapped `telephoneNumber` raw log field to `event.idm.read_only_udm.target.user.phone_numbers` UDM field.
- `event.idm.read_only_udm.additional.fields`: Newly mapped `facility`, `priority`, `version`, `Tipo de contraseña` (as key password_type), `Nombre de la plantilla` (as key template_name), `mobile` raw log fields to `event.idm.read_only_udm.additional.fields`.
- `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `userAccountControl` raw log field to `event.idm.read_only_udm.target.resource.attribute.labels` UDM field.
- `event.idm.read_only_udm.security_result.rule_name` : Newly mapped `ACTION` raw log field to `event.idm.read_only_udm.security_result.rule_name` UDM field.
- `event.idm.read_only_udm.metadata.event_type` : Newly mapped `event.idm.read_only_udm.metadata.event_type` as `NETWORK_CONNECTION` if `has_principal` is "true" and `has_target` is "true",`USER_CHANGE_PERMISSIONS` if `has_principal` is "true" and `has_target_user` is "true", `STATUS_UPDATE` if `has_principal` is "true" and has_target is "false", `GENERIC_EVENT` otherwise.

2022-09-16

Newly created parser.