Change log for AI_HUNTER
| Date | Changes |
|---|---|
| 2026-03-02 | Enhancement:
-`event.idm.read_only_udm.additional.fields`: Newly mapped `api_msg` raw log field to `event.idm.read_only_udm.additional.fields` UDM field. -`event.idm.read_only_udm.target.hostname`: Newly mapped `domain` raw log field to `event.idm.read_only_udm.target.hostname` UDM field. -`event.idm.read_only_udm.principal.resource.attribute.labels`: Newly mapped `source_module` raw log field to `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. -`event.idm.read_only_udm.principal.asset.ip`: Newly mapped `src_ip` raw log field to `event.idm.read_only_udm.principal.asset.ip` UDM field. -`event.idm.read_only_udm.target.asset.hostname`: Newly mapped `domain` raw log field to `event.idm.read_only_udm.target.asset.hostname` UDM field. -`event.idm.read_only_udm.metadata.event_type`: If `src_ip` is not null "has_principal" is "true" and updated the value of `event.idm.read_only_udm.metadata.event_type` to "STATUS_UNCATEGORIZED", else if `src_ip` is null "has_principal" is "false" and updated the value of `event.idm.read_only_udm.metadata.event_type` to "GENERIC_EVENT". - Modified the grok patterns in message and inner_message grok in order to parse the logs and following UDM fields are now being mapped correctly: -`event.idm.read_only_udm.metadata.description` -`event.idm.read_only_udm.metadata.event_timestamp.seconds` -`event.idm.read_only_udm.metadata.log_type` -`event.idm.read_only_udm.metadata.product_name` -`event.idm.read_only_udm.metadata.vendor_name` -`event.idm.read_only_udm.principal.ip` |