Change log for ARMIS_ACTIVITIES

Date

Changes

2025-10-23

Enhancement: - Added support for an optional Syslog header before the JSON payload. - `event.idm.read_only_udm.principal.user.user_display_name`: Newly mapped `source_user` raw log field to `event.idm.read_only_udm.principal.user.user_display_name`. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `timestamp` raw log field from syslog header to `event.idm.read_only_udm.metadata.event_timestamp`. - `event.idm.read_only_udm.intermediary.hostname`: Newly mapped `intermediary_hostname` raw log field to `event.idm.read_only_udm.intermediary.hostname`. - `event.idm.read_only_udm.intermediary.asset.hostname`: Newly mapped `intermediary_hostname` raw log field to `event.idm.read_only_udm.intermediary.asset.hostname`. - `event.idm.read_only_udm.security_result.rule_id`: Newly mapped `id` raw log field to `event.idm.read_only_udm.security_result.rule_id`. - `event.idm.read_only_udm.security_result.severity`: Newly mapped `severity` and `policy.actions.actionType` raw log fields to `event.idm.read_only_udm.security_result.severity`. - `event.idm.read_only_udm.security_result.risk_score`: Newly mapped `riskLevel` raw log field to `event.idm.read_only_udm.security_result.risk_score`. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `status` and `activities.decision_data.risk_factor_type` raw log fields to `event.idm.read_only_udm.security_result.detection_fields`. - `event.idm.read_only_udm.security_result.description`: Newly mapped `policy.description` raw log field to `event.idm.read_only_udm.security_result.description`. - `event.idm.read_only_udm.additional.fields`: Newly mapped `classification`,`policy.labels`, `policy.rules.and`, `policy.actions.actionParams.title`, `policy.actions.actionParams.alertDescription`, `policy.actions.actionParams.alertClassificationId`, `policy.actions.actionParams.endpoint`, `policy.actions.actionParams.timeBack`, `policy.actions.actionParams.emailRecipients`, `sources.sensor.name`, `sources.sensor.type`, `sources.boundaries`, `sources.dataSources`, `policy.isActive`, `policy.isBoundary`, `policy.isEditable`, `policy.creationTime`, `policy.modificationTime`, `policy.owner`, `activities.type`, `activities.decision_data.client_offered_suites`, `activities.decision_data.selected_suite`, `activities.decision_data.src_device_id`, `activities.decision_data.risk_factor_id`, `activities.decision_data.risk_factor_category`, `activities.decision_data.risk_factor_description`, `activities.decision_data.risk_factor_score`, `activities.decision_data.connection`, `activities.decision_data.category`, and `activities.decision_data.client_device_id` raw log fields to `event.idm.read_only_udm.additional.fields`. - `event.idm.read_only_udm.security_result.severity_details`: Newly mapped `policy.actions.actionType` raw log field to `event.idm.read_only_udm.security_result.severity_details`. - `event.idm.read_only_udm.security_result.category_details`: Newly mapped `sources.category` raw log field to `event.idm.read_only_udm.security_result.category_details`. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `sources.id` raw log field to `event.idm.read_only_udm.principal.user.userid`. - `event.idm.read_only_udm.principal.ip`: Newly mapped `sources.ip`, `sources.ipv6`, and `activities.decision_data.src_ip` raw log fields to `event.idm.read_only_udm.principal.ip`. - `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `sources.ip`, `sources.ipv6`, and `activities.decision_data.src_ip` raw log fields to `event.idm.read_only_udm.principal.asset.ip`. - `event.idm.read_only_udm.principal.hostname`: Newly mapped `sources.name` raw log field to `event.idm.read_only_udm.principal.hostname`. - `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `sources.name` raw log field to `event.idm.read_only_udm.principal.asset.hostname`. - `event.idm.read_only_udm.principal.location.name`: Newly mapped `sources.site.name` raw log field to `event.idm.read_only_udm.principal.location.name`. - `event.idm.read_only_udm.principal.location.country_or_region`: Newly mapped `sources.site.location` raw log field to `event.idm.read_only_udm.principal.location.country_or_region`. - `event.idm.read_only_udm.principal.user.attribute.labels`: Newly mapped `sources.type` and `sources.model` raw log fields to `event.idm.read_only_udm.principal.user.attribute.labels`. - `event.idm.read_only_udm.principal.mac`: Newly mapped `sources.identifier` raw log field to `event.idm.read_only_udm.principal.mac`. - `event.idm.read_only_udm.principal.asset.mac`: Newly mapped `sources.identifier` raw log field to `event.idm.read_only_udm.principal.asset.mac`. - `event.idm.read_only_udm.principal.asset.product_object_id`: Newly mapped `sources.identifier` raw log field to `event.idm.read_only_udm.principal.asset.product_object_id` when it's not a valid MAC address. - `event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `activities.UUID` raw log field to `event.idm.read_only_udm.metadata.product_log_id`. - `event.idm.read_only_udm.network.tls.version`: Newly mapped `activities.decision_data.version` raw log field to `event.idm.read_only_udm.network.tls.version`. - `event.idm.read_only_udm.target.ip`: Newly mapped `activities.decision_data.host` raw log field to `event.idm.read_only_udm.target.ip`. - `event.idm.read_only_udm.target.asset.ip`: Newly mapped `activities.decision_data.host` raw log field to `event.idm.read_only_udm.target.asset.ip`. - `event.idm.read_only_udm.target.hostname`: Newly mapped `activities.decision_data.host` raw log field to `event.idm.read_only_udm.target.hostname`. - `event.idm.read_only_udm.target.asset.hostname`: Newly mapped `activities.decision_data.host` raw log field to `event.idm.read_only_udm.target.asset.hostname`. - `event.idm.read_only_udm.target.port`: Newly mapped `activities.decision_data.port` raw log field to `event.idm.read_only_udm.target.port`. - `event.idm.read_only_udm.security_result.confidence`: Newly mapped `activities.decision_data.confidence` raw log field to `event.idm.read_only_udm.security_result.confidence`. - `event.idm.read_only_udm.security_result.confidence_details`: Newly mapped `activities.decision_data.confidence` raw log field to `event.idm.read_only_udm.security_result.confidence_details`. - `event.idm.read_only_udm.network.application_protocol`: Newly mapped `activities.decision_data.protocol` raw log field to `event.idm.read_only_udm.network.application_protocol`. - `event.idm.read_only_udm.network.dns.questions.name`: Newly mapped `activities.decision_data.host` and `activities.decision_data.query_type` raw log fields to `event.idm.read_only_udm.network.dns.questions.name` for DNS_QUERY events. - `event.idm.read_only_udm.network.dns.answers.data`: Newly mapped `activities.decision_data.answer_ips` raw log field to `event.idm.read_only_udm.network.dns.answers.data` for DNS_QUERY events. - Modified grok patterns to handle the optional Syslog header and extract the JSON data. - The `metadata.event_type` is now dynamically set to `NETWORK_CONNECTION`, `USER_UNCATEGORIZED`, `STATUS_UPDATE`, or `GENERIC_EVENT` based on the presence of principal, target, and user information, replacing the previous hardcoded value.