Stay organized with collections
Save and categorize content based on your preferences.
Change log for MICROSOFT_CASB
Date
Changes
2025-03-26
Enhancement:
- Modified and added Grok pattern to parse different time formats.
- Added a conditional check when mapping "suser" to "principal.user.userid".
- Mapped "uniqueServiceAppIds" to "target.resource.id".
- Added a conditional check before setting "metadata.event_type" to "USER_LOGIN" and renaming "event.idm.read_only_udm.principal.user" to "event.idm.read_only_udm.target.user".
- Added a conditional check before setting "metadata.event_type" to "USER_RESOURCE_CREATION" , "USER_RESOURCE_UPDATE_CONTENT" and "RESOURCE_READ".
- Added a "user_display_name" null check before mapping "user_display_name" to "principal.user.userid".
- Added on error when mapping "suser" to "principal.user.userid" and "principal.user.user_display_name".
2023-11-27
Enhancement:
- Handled unparsed JSON logs.
2023-06-28
Enhancement:
- Enhanced parser to set the "metadata.event_type" to a more specific value and reduce the number of logs with "GENERIC_EVENT" for "metadata.event_type".
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-06-02 UTC."],[[["The change log for MICROSOFT_CASB includes updates as recent as November 27, 2023."],["An enhancement was implemented on November 27, 2023 to handle unparsed JSON logs."],["On June 28, 2023, the parser was improved to provide more specific values for \"metadata.event_type,\" reducing generic event logs."]]],[]]
