Change log for AUTOMATION_ANYWHERE

Date	Changes
2026-01-09	Enhancement: - event.idm.read_only_udm.principal.user.userid: mentioned `has_user` to `true` when the user details are available to event.idm.read_only_udm.principal.user.userid UDM field. - Mapped the `USER_LOGIN` and `USER_LOGOUT` event_types when the `event_description` contains "User log in successfully" and "User log out successfully" respectively.
2025-12-19	Enhancement: - event.idm.read_only_udm.target.asset.hostname: Newly mapped "host" raw log field with "event.idm.read_only_udm.target.asset.hostname". - event.idm.read_only_udm.target.asset.ip: Newly mapped "resource_name" raw log field with "event.idm.read_only_udm.target.asset.ip". - event.idm.read_only_udm.principal.hostname: Newly mapped "audit.hostName" raw log field with "event.idm.read_only_udm.principal.hostname". - event.idm.read_only_udm.principal.asset.hostname: Newly mapped "audit.hostName" raw log field with "event.idm.read_only_udm.principal.asset.hostname". - event.idm.read_only_udm.principal.user.userid: Newly mapped "audit.userName" raw log field with "event.idm.read_only_udm.principal.user.userid". - event.idm.read_only_udm.metadata.product_log_id: Newly mapped "audit.requestId" raw log field with "event.idm.read_only_udm.metadata.product_log_id". - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped "audit.createdOn" raw log field with "event.idm.read_only_udm.metadata.event_timestamp". - event.idm.read_only_udm.security_result.detection_fields: Newly mapped "auditdetail.newValue", "auditdetail.oldValue" raw log fields with "event.idm.read_only_udm.security_result.detection_fields". - event.idm.read_only_udm.additional.fields: Newly mapped the following raw log fields "audit.source", "audit.auditType", "audit.createdBy", "audit.externalSessionId", "audit.externalReference.id", "audit.externalReference.displayName", "audit.externalReference.type", "audit.id", "audit.eventDescription", "audit.environmentName", "audit.modelInfo.modelName", "audit.modelInfo.version", "audit.modelInfo.revision", "audit.modelInfo.provider", "audit.modelInfo.deploymentId", "audit.modelInfo.region", "audit.modelInfo.displayName", "audit.modelInfo.isCustom", "audit.modelInfo.modelType", "audit.modelInfo.modelConnectionType", "audit.modelInfo.customModelName", "audit.modelInfo.groundedSourceId", "audit.modelInfo.modelConnectionName", "audit.encryptedPayload.type", "audit.encryptedPayload.attributes.promptTokens", "audit.encryptedPayload.attributes.totalTokens", "audit.encryptedPayload.attributes.completionTokens", "audit.executionContext.executionId", "audit.executionContext.automationName", "audit.executionContext.deviceId", "audit.executionContext.botId", "audit.executionContext.workspaceType", "audit.executionContext.automationType", "audit.executionContext.folderPath", "audit.executionContext.deviceName", "audit.executionContext.activityId", "audit.executionContext.plannerId", "audit.executionContext.agentRequestId", "audit.aiGuardrail.id_", "audit.aiGuardrail.name_", "audit.aiGuardrail.toxicityScore_", "audit.aiGuardrail.toxicityLevel_", "audit.aiGuardrail.action_", "audit.aiEvaluation.id_", "audit.aiEvaluation.name_", "audit.aiEvaluation.method_", "audit.aiEvaluation.status_", "audit.aiEvaluation.type_", "audit.aiEvaluation.sourceName_", "audit.aiEvaluation.routeUrl_", "audit.encryptedPayload.payload", "audit.encryptedPayload.iv", "audit.executionContext.toolInfo" with "event.idm.read_only_udm.additional.fields".

Date

Changes

2026-01-09

Enhancement:
- event.idm.read_only_udm.principal.user.userid: mentioned `has_user` to `true` when the user details are available to event.idm.read_only_udm.principal.user.userid UDM field.
- Mapped the `USER_LOGIN` and `USER_LOGOUT` event_types when the `event_description` contains "User log in successfully" and "User log out successfully" respectively.

2025-12-19

Enhancement:
- event.idm.read_only_udm.target.asset.hostname: Newly mapped "host" raw log field with "event.idm.read_only_udm.target.asset.hostname".
- event.idm.read_only_udm.target.asset.ip: Newly mapped "resource_name" raw log field with "event.idm.read_only_udm.target.asset.ip".
- event.idm.read_only_udm.principal.hostname: Newly mapped "audit.hostName" raw log field with "event.idm.read_only_udm.principal.hostname".
- event.idm.read_only_udm.principal.asset.hostname: Newly mapped "audit.hostName" raw log field with "event.idm.read_only_udm.principal.asset.hostname".
- event.idm.read_only_udm.principal.user.userid: Newly mapped "audit.userName" raw log field with "event.idm.read_only_udm.principal.user.userid".
- event.idm.read_only_udm.metadata.product_log_id: Newly mapped "audit.requestId" raw log field with "event.idm.read_only_udm.metadata.product_log_id".
- event.idm.read_only_udm.metadata.event_timestamp: Newly mapped "audit.createdOn" raw log field with "event.idm.read_only_udm.metadata.event_timestamp".
- event.idm.read_only_udm.security_result.detection_fields: Newly mapped "auditdetail.newValue", "auditdetail.oldValue" raw log fields with "event.idm.read_only_udm.security_result.detection_fields".
- event.idm.read_only_udm.additional.fields: Newly mapped the following raw log fields "audit.source", "audit.auditType", "audit.createdBy", "audit.externalSessionId", "audit.externalReference.id", "audit.externalReference.displayName", "audit.externalReference.type", "audit.id", "audit.eventDescription", "audit.environmentName", "audit.modelInfo.modelName", "audit.modelInfo.version", "audit.modelInfo.revision", "audit.modelInfo.provider", "audit.modelInfo.deploymentId", "audit.modelInfo.region", "audit.modelInfo.displayName", "audit.modelInfo.isCustom", "audit.modelInfo.modelType", "audit.modelInfo.modelConnectionType", "audit.modelInfo.customModelName", "audit.modelInfo.groundedSourceId", "audit.modelInfo.modelConnectionName", "audit.encryptedPayload.type", "audit.encryptedPayload.attributes.promptTokens", "audit.encryptedPayload.attributes.totalTokens", "audit.encryptedPayload.attributes.completionTokens", "audit.executionContext.executionId", "audit.executionContext.automationName", "audit.executionContext.deviceId", "audit.executionContext.botId", "audit.executionContext.workspaceType", "audit.executionContext.automationType", "audit.executionContext.folderPath", "audit.executionContext.deviceName", "audit.executionContext.activityId", "audit.executionContext.plannerId", "audit.executionContext.agentRequestId", "audit.aiGuardrail.id_", "audit.aiGuardrail.name_", "audit.aiGuardrail.toxicityScore_", "audit.aiGuardrail.toxicityLevel_", "audit.aiGuardrail.action_", "audit.aiEvaluation.id_", "audit.aiEvaluation.name_", "audit.aiEvaluation.method_", "audit.aiEvaluation.status_", "audit.aiEvaluation.type_", "audit.aiEvaluation.sourceName_", "audit.aiEvaluation.routeUrl_", "audit.encryptedPayload.payload", "audit.encryptedPayload.iv", "audit.executionContext.toolInfo" with "event.idm.read_only_udm.additional.fields".