Change log for AKEYLESS_VAULT

Date	Changes
2026-04-20	Enhancement: - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped time raw log field to event.idm.read_only_udm.metadata.event_timestamp UDM field. - event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip: Newly mapped remote_addr raw log field to event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip UDM field. - event.idm.read_only_udm.target.resource.name: Newly mapped request_parameters.resolved_item_name raw log fields to event.idm.read_only_udm.target.resource.name UDM field. - event.idm.read_only_udm.security_result.description: Newly mapped status raw log field to event.idm.read_only_udm.security_result.description UDM field. - event.idm.read_only_udm.security_result.action: Newly mapped event.idm.read_only_udm.security_result.action UDM field with action raw log field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped action raw log field to event.idm.read_only_udm.metadata.product_event_type UDM field. - event.idm.read_only_udm.metadata.event_type: Mapped event.idm.read_only_udm.metadata.event_type UDM field with action raw log field.
2026-04-08	Enhancement: - Added a Grok pattern to parse new pattern of SYSLOG logs. - event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip: Removed second element of remote_addr raw log field from the event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip UDM fields as it represents gateway ip more than a client ip. - event.idm.read_only_udm.intermediary.ip: Mapped the second element of remote_addr raw log field with event.idm.read_only_udm.intermediary.ip UDM field. - event.idm.read_only_udm.observer.hostname: Newly mapped syslog_hostname raw log field with event.idm.read_only_udm.observer.hostname UDM field. - event.idm.read_only_udm.observer.application: Newly mapped process_name raw log field with event.idm.read_only_udm.observer.application UDM field. - event.idm.read_only_udm.observer.process.pid: Newly mapped pid raw log field with event.idm.read_only_udm.observer.process.pid UDM field. - event.idm.read_only_udm.security_result.severity: Newly mapped severity raw log field with event.idm.read_only_udm.security_result.severity UDM field. - Added a conditional check before already existing mapping of request_parameters.unique_id to event.idm.read_only_udm.target.resource.attribute.labels. - event.idm.read_only_udm.principal.user.email_addresses: Newly mapped request_parameters.unique_id raw log field with event.idm.read_only_udm.principal.user.email_addresses UDM field. - event.idm.read_only_udm.target.resource.resource_subtype: Newly mapped item_type raw log field with event.idm.read_only_udm.target.resource.resource_subtype UDM field. - event.idm.read_only_udm.network.session_id: Newly mapped request_parameters.session_id raw log field with event.idm.read_only_udm.network.session_id UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped duration_in_ms, request_parameters.source, and request_parameters.item_accessibility raw log fields with event.idm.read_only_udm.target.resource.attribute.labels UDM field.
2023-09-16	Enhancement: - Adjusted the parser to support JSON logs along with KV logs. - Mapped request_parameters.access_type to target.resource.attribute.labels. - Mapped request_parameters.product to target.resource.attribute.labels. - Mapped request_parameters.transaction_type to target.resource.attribute.labels. - Mapped request_parameters.user_agent to target.resource.attribute.labels. - Mapped request_parameters.unique_id to target.resource.attribute.labels. - Mapped request_parameters.comment to target.resource.attribute.labels. - Mapped request_parameters.token_id to target.resource.attribute.labels. - Mapped request_parameters.operation to target.resource.attribute.labels. - Mapped request_parameters.universal_identity_rotate_type to target.resource.attribute.labels. - Mapped remote_addr array to principal.ip.