We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for AWS_SECURITY_HUB

Date	Changes
2026-06-18	Enhancement: - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `Time_dt` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `Time` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `Finding_info.Title`, `Metadata.Profiles.Array`, `Type_name`, `observable.Name`, `observable.Type` raw log fields with event.idm.read_only_udm.additional.fields UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `Compliance.Status_detail`, `Compliance.Status_code`, `Unmapped.ProductFields.ControlId`, `Unmapped.ProductFields.PreviousComplianceStatus`, `Unmapped.RecordState`, `Unmapped.WorkflowState`, `Type_uid` raw log fields with event.idm.read_only_udm.security_result.detection_fields UDM field. - `event.idm.read_only_udm.principal.resource.attribute.labels`: Newly mapped `Resource.Cloud_partition` and `Cloud.Provider` raw log fields with event.idm.read_only_udm.principal.resource.attribute.labels UDM field.
2026-04-27	Enhancement: - `event.idm.read_only_udm.additional.fields`: Newly mapped `m.ProductFields.provider/security-service/service/additionalInfo/type`, `m.ProductFields.provider/security-service/service/count`, `m.ProductFields.provider/security-service/service/resourceRole`, `m.ProductFields.provider/security-service/service/featureName`, `m.ProductFields.provider/security-service/service/additionalInfo/value`, `m.ProductFields.provider/security-service/service/archived`, `m.ProductFields.provider/security-service/service/additionalInfo/threatListName`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/organization/asnOrg`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/ipAddressV4`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/geoLocation/lon`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/organization/isp`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/organization/asn`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/localPortDetails/port`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/geoLocation/lat`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/localPortDetails/portName`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/blocked`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/city/cityName`, `m.ProductFields.aws/guardduty/service/action/actionType`, `m.ProductFields.aws/guardduty/service/evidence/threatIntelligenceDetails.0_/threatListName`, `m.ProductFields.aws/guardduty/service/eventLastSeen`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/organization/org`, `m.ProductFields.aws/guardduty/service/eventFirstSeen`, `m.ProductFields.aws/guardduty/service/detectorId`, `m.ProductFields.aws/guardduty/service/serviceName`, `m.ProductFields.aws/guardduty/service/action/portProbeAction/portProbeDetails.0_/remoteIpDetails/country/countryName`, `m.ProductFields.aws/guardduty/service/additionalInfo/threatListName`, `PortProbeDetail.RemoteIpDetails.Country.CountryCode`, `PortProbeDetail.RemoteIpDetails.Organization.Asn`, `PortProbeDetail.RemoteIpDetails.Organization.AsnOrg`, `PortProbeDetail.RemoteIpDetails.Organization.Isp`, `PortProbeDetail.RemoteIpDetails.Organization.Org`, `PortProbeDetail.LocalPortDetails.PortName`, `PortProbeDetail.LocalPortDetails.Port`, `type`, `resource.Region`, `resource.Details.AwsEc2Instance.ImageId` raw log field with event.idm.read_only_udm.additional.fields UDM field. - `event.idm.read_only_udm.principal.location.region_coordinates.latitude`: Newly mapped `PortProbeDetail.RemoteIpDetails.GeoLocation.Lat` raw log field with event.idm.read_only_udm.principal.location.region_coordinates.latitude UDM field. - `event.idm.read_only_udm.principal.location.region_coordinates.longitude`: Newly mapped `PortProbeDetail.RemoteIpDetails.GeoLocation.Lon` raw log field with event.idm.read_only_udm.principal.location.region_coordinates.longitude UDM field. - `event.idm.read_only_udm.principal.location.city`: Newly mapped `PortProbeDetail.RemoteIpDetails.City.CityName` raw log field with event.idm.read_only_udm.principal.location.city UDM field. - `event.idm.read_only_udm.principal.location.country_or_region`: Newly mapped `PortProbeDetail.RemoteIpDetails.Country.CountryName` raw log field with event.idm.read_only_udm.principal.location.country_or_region UDM field. - `event.idm.read_only_udm.principal.ip`, `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `PortProbeDetail.RemoteIpDetails.IpAddressV4` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM fields. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `PatchSummary`,`m.ProductFields.ProwlerResourceName`, `m.ProductFields.ProviderVersion`, `m.ProductFields.ProviderName`, `m.ProductFields.HealthEventStartTime`, `m.Severity.Original`, `m.ProductFields.PreviousComplianceStatus`, `m.ProductFields.Resources:0/Id`, `m.ProductFields.StandardsControlArn`, `m.ProductFields.RelatedAWSResources:0/type`, `m.ProductFields.RelatedAWSResources:0/name`, `m.ProductFields.RecommendationUrl`, `m.ProductFields.ControlId`, `m.FindingProviderFields.Severity.Original`, `RelatedRequirement`, `AssociatedStandard.StandardsId`, `m.ProductFields.PatchManagerHash`, `m.ProductFields.aws/route53resolver/dnsfirewall/firewallDomainListId`, `m.ProductFields.aws/inspector/resources/1/resourceDetails/awsEc2InstanceDetails/platform`, `m.ProductFields.aws/inspector/instanceId`, `m.ProductFields.aws/inspector/inspectorScore`, `m.ProductFields.aws/inspector/ProductVersion`, `m.ProductFields.aws/inspector/FindingStatus`, `ReferenceUrl`, `VulnerablePackagesValue.Name`, `VulnerablePackagesValue.Release`, `VulnerablePackagesValue.FixedInVersion`, `VulnerablePackagesValue.Epoch`, `VulnerablePackagesValue.Version`, `VulnerablePackagesValue.PackageManager`, `VulnerablePackagesValue.Architecture`, `RelatedVulnerabilitiesValue`, `vulnerability.Id`, `vulnerability.EpssScore`, `vulnerability.ExploitAvailable`, `vulnerability.FixAvailable`, `CvssValue.Source`, `CvssValue.BaseVector`, `CvssValue.BaseScore`, `CvssValue.Version`, `m.Confidence`, `m.Severity.Normalized`, `m.Severity.Label`, `m.Severity.Product`, `m.ProductFields.aws/config/ConfigComplianceType`, `m.ProductFields.aws/config/ConfigRuleName`, `m.ProductFields.aws/config/ConfigRuleArn`, `m.ProductFields.aws/securityhub/ProductName`, `m.ProductFields.aws/securityhub/CompanyName` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.security_result.action`: Newly mapped `sec_action_details` raw log field with `event.idm.read_only_udm.security_result.action` UDM field. - `event.idm.read_only_udm.network.ip_protocol`: Newly mapped `m.ProductFields.aws/route53resolver/dnsfirewall/transport` raw log field with `event.idm.read_only_udm.network.ip_protocol` UDM field. - `event.idm.read_only_udm.security_result.rule_id`: Newly mapped `m.ProductFields.aws/route53resolver/dnsfirewall/firewallRuleGroupId` raw log field with `event.idm.read_only_udm.security_result.rule_id` UDM field. - `event.idm.read_only_udm.network.dns.questions.name`: Newly mapped `m.ProductFields.aws/route53resolver/dnsfirewall/queryName` raw log field with `event.idm.read_only_udm.network.dns.questions.name` UDM field. - `event.idm.read_only_udm.security_result.confidence`: Newly mapped `m.FindingProviderFields.Confidence` raw log field with `event.idm.read_only_udm.security_result.confidence` UDM field. - `event.idm.read_only_udm.security_result.confidence_details`: Newly mapped `m.FindingProviderFields.Confidence` raw log field with `event.idm.read_only_udm.security_result.confidence_details` UDM field. - `event.idm.read_only_udm.principal.group.group_display_name`: Newly mapped `m.AwsAccountName` raw log field with `event.idm.read_only_udm.principal.group.group_display_name` UDM field. - `event.idm.read_only_udm.principal.group.product_object_id`: Newly mapped `m.AwsAccountId` raw log field with `event.idm.read_only_udm.principal.group.product_object_id` UDM field. - `event.idm.read_only_udm.target.ip`, `event.idm.read_only_udm.target.asset.ip`: Newly mapped `resource.Details.ComputeInstance.IpV4Addresses` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM fields. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `resource.Details.AwsEc2Instance.Type`, `resource.Details.AwsEc2Instance.IpV4Addresses`, `resource.Details.AwsEc2Instance.VpcId`, `resource.Details.AwsEc2Instance.KeyName`, `resource.Tags`, `resource.Partition` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.principal.resource.attribute.labels`: Newly mapped `resource.Details.Other.fmsDesiredWebAcl`, `resource.Details.Other.associatedWebAcl`, `resource.Details.Other.fmsPolicyArn`, `resource.Details.Other.fmsPolicyAutoRemediationEnabled`, `resource.Details.Other.fmsPolicyName`, `resource.Details.Other.fmsViolationConfigRuleName` raw log field with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `resource.Details.Other.fmsAdminAccountId` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.network.dns.questions.class`: Newly mapped `m.ProductFields.aws/route53resolver/dnsfirewall/queryClass` raw log field with `event.idm.read_only_udm.network.dns.questions.class` UDM field. - `event.idm.read_only_udm.network.dns.questions.type`: Newly mapped `m.ProductFields.aws/route53resolver/dnsfirewall/queryType` raw log field with `event.idm.read_only_udm.network.dns.questions.type` UDM field.
2026-04-07	Enhancement: - Added support to parse the new format of JSON logs. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `finding.Compliance.Status`, `finding.Remediation.Recommendation.Text`, `finding.Remediation.Recommendation.Url` raw log field(s) with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.security_result.confidence_score`: Newly mapped `finding.FindingProviderFields.Confidence` raw log field with `event.idm.read_only_udm.security_result.confidence_score` UDM field. - `event.idm.read_only_udm.target.resource.resource_type`: If `finding.Resource.Type` is `AwsEc2Vpc`, then mapped `event.idm.read_only_udm.target.resource.resource_type` as `VPC_NETWORK`. - `event.idm.read_only_udm.metadata.event_type`: If `finding.Resource.Type` is `AwsEc2Vpc`, then mapped `event.idm.read_only_udm.metadata.event_type` as `USER_RESOURCE_ACCESS`. - `event.idm.read_only_udm.target.resource.resource_subtype`: If `finding.Resource.Type` is `AwsEc2Vpc`, then mapped `finding.Resource.Type` raw log field with `event.idm.read_only_udm.target.resource.resource_subtype UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `detail.findings.0.Resources.0.Details.Other.fmsAdminAccountId` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.target.resource.name`: Newly mapped `detail.findings.0.Resources.0.Details.Other.fmsPolicyArn` raw log field with `event.idm.read_only_udm.target.resource.name` UDM field. - `event.idm.read_only_udm.principal.user.group_identifiers`: Newly mapped `detail.findings.0.Resources.0.Details.Other.fmsDesiredDnsRuleGroups` raw log field with `event.idm.read_only_udm.principal.user.group_identifiers` UDM field.
2026-02-05	Enhancement: - `event.idm.read_only_udm.metadata.product_version`: Newly mapped `finding.SchemaVersion` raw log field with `event.idm.read_only_udm.metadata.product_version` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `m.resources`,`m.account`, `m.source`, `m.detailType`, `m.region`, `m.time`, `m.version`, `finding.Id`, `finding.Action.AwsApiCallAction.CallerType`, `finding.Action.AwsApiCallAction.Api`, `finding.Action.AwsApiCallAction.RemoteIpDetails.Country.CountryCode`, `finding.Action.AwsApiCallAction.RemoteIpDetails.Country.CountryName`, `finding.Action.AwsApiCallAction.RemoteIpDetails.Organization.AsnOrg`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asnOrg`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/org`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName`, `finding.ProductFields.aws/guardduty/service/additionalInfo/unusualBehavior/unusualUserAgentsUserIdentityProfiling`, `finding.ProductFields.aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledUserNamesAccountProfiling`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon`, `finding.ProductFields.aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledASNsAccountProfiling`, `finding.ProductFields.aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledUserAgentsAccountProfiling`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asn`, `finding.ProductFields.aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledAPIsAccountProfiling`, `finding.ProductFields.aws/guardduty/service/additionalInfo/userAgent/fullUserAgent`, `finding.ProductFields.aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledUserTypesAccountProfiling`, `finding.ProductFields.aws/guardduty/service/additionalInfo/unusualBehavior/unusualAPIsUserIdentityProfiling`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4`, `finding.ProductFields.aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledASNsAccountProfiling`, `finding.ProductFields.aws/guardduty/service/additionalInfo/unusualBehavior/unusualASNsUserIdentityProfiling`, `finding.ProductFields.aws/guardduty/service/additionalInfo/unusualBehavior/isUnusualUserIdentity`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/serviceName`, `finding.ProductFields.aws/guardduty/service/additionalInfo/anomalies/anomalousAPIs`, `finding.ProductFields.aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledASNsAccountProfiling`, `finding.ProductFields.aws/guardduty/service/additionalInfo/unusualBehavior/unusualUserNamesAccountProfiling`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/callerType`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName`, `finding.ProductFields.aws/guardduty/service/action/awsApiCallAction/api`, `finding.ProductFields.aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledUserNamesAccountProfiling`, `finding.ProductFields.aws/guardduty/service/additionalInfo/userAgent/userAgentCategory`, `finding.Sample`, `finding.ProductFields.aws/securityhub/ProductName`, `finding.ProductFields.aws/securityhub/CompanyName`, and `m.resources` raw log field(s) with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.principal.user.company_name`: Newly mapped `finding.CompanyName` raw log field with `event.idm.read_only_udm.principal.user.company_name` UDM field. - `event.idm.read_only_udm.principal.group.group_display_name`: Newly mapped `finding.AwsAccountName` raw log field with `event.idm.read_only_udm.principal.group.group_display_name` UDM field. - `event.idm.read_only_udm.principal.asset.first_seen_time`: Newly mapped `finding.FirstObservedAt` raw log field with `event.idm.read_only_udm.principal.asset.first_seen_time` UDM field. - `event.idm.read_only_udm.principal.location.name`: Newly mapped `finding.Region` raw log field with `event.idm.read_only_udm.principal.location.name` UDM field. - `event.idm.read_only_udm.principal.location.region_coordinates.longitude`: Newly mapped `finding.Action.AwsApiCallAction.RemoteIpDetails.GeoLocation.Lon` raw log field with `event.idm.read_only_udm.principal.location.region_coordinates.longitude` UDM field. - `event.idm.read_only_udm.principal.location.region_coordinates.latitude`: Newly mapped `finding.Action.AwsApiCallAction.RemoteIpDetails.GeoLocation.Lat` raw log field with `event.idm.read_only_udm.principal.location.region_coordinates.latitude` UDM field. - `event.idm.read_only_udm.target.ip`: Newly mapped `PortProbeDetail.RemoteIpDetails.IpAddressV4`, `Resource.Details.AwsEc2Instance.IpV4Addresses` raw log field(s) with `event.idm.read_only_udm.target.ip` UDM field. - `event.idm.read_only_udm.target.asset.ip`: Newly mapped `PortProbeDetail.RemoteIpDetails.IpAddressV4`, `Resource.Details.AwsEc2Instance.IpV4Addresses` raw log field(s) with `event.idm.read_only_udm.target.asset.ip` UDM field. - `event.idm.read_only_udm.target.asset.attribute.cloud.vpc.id`: Newly mapped `Resource.Details.AwsEc2Instance.VpcId` raw log field with `event.idm.read_only_udm.target.asset.attribute.cloud.vpc.id` UDM field. - `event.idm.read_only_udm.target.asset.attribute.creation_time`: Newly mapped `Resource.Details.AwsEc2Instance.LaunchedAt` raw log field with `event.idm.read_only_udm.target.asset.attribute.creation_time` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `PortProbeDetail.RemoteIpDetails.GeoLocation.Lon`, `Resource.Details.AwsEc2Instance.IamInstanceProfileArn`, `Resource.Details.AwsEc2Instance.SubnetId`, `Resource.Details.AwsEc2Instance.ImageId`, `Resource.Details.AwsEc2Instance.Type`, `Resource.Partition`, `PortProbeDetail.RemoteIpDetails.GeoLocation.Lat`, `Resource.Tags.*`, `PortProbeDetail.RemoteIpDetails.City.CityName`, `PortProbeDetail.RemoteIpDetails.Country.CountryCode`, `PortProbeDetail.RemoteIpDetails.Country.CountryName`, `PortProbeDetail.RemoteIpDetails.Organization.Asn`, `PortProbeDetail.RemoteIpDetails.Organization.AsnOrg`, `PortProbeDetail.RemoteIpDetails.Organization.Isp`, `PortProbeDetail.RemoteIpDetails.Organization.Org`, `PortProbeDetail.LocalPortDetails.PortName`, `PortProbeDetail.LocalPortDetails.Port`, and `IpV4Address` (if grok fails) raw log field(s) with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.security_result.category_details`: Newly mapped `finding.Types` (at index 0) raw log field with `event.idm.read_only_udm.security_result.category_details` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `finding.Action.PortProbeAction.Blocked`,`finding.Severity.Product`, `finding.Severity.Normalized`, `finding.ProcessedAt`, `finding.WorkflowState`, `finding.Workflow.Status`, `finding.RecordState`, `finding.GeneratorId`, `finding.LastObservedAt`, and `finding.ProductArn` raw log field(s) with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.security_result.url_back_to_product`: Newly mapped `finding.SourceUrl` raw log field with `event.idm.read_only_udm.security_result.url_back_to_product` UDM field. - `event.idm.read_only_udm.security_result.last_updated_time`: Newly mapped `finding.UpdatedAt` raw log field with `event.idm.read_only_udm.security_result.last_updated_time` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `finding.CreatedAt` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field.
2026-01-15	Enhancement: - `event.idm.read_only_udm.additional.fields`: Newly mapped `resource.Details.AwsEc2Instance.MetadataOptions.HttpPutResponseHopLimit`, `resource.Details.AwsEc2Instance.MetadataOptions.HttpProtocolIpv6`, `resource.Details.AwsEc2Instance.MetadataOptions.HttpTokens`, `resource.Details.AwsEc2Instance.MetadataOptions.InstanceMetadataTags`, `resource.Details.AwsEc2Instance.MetadataOptions.HttpEndpoint`, `resource.Details.AwsEc2Instance.VirtualizationType`, `resource.Details.AwsEc2Instance.NetworkInterfaces.NetworkInterfaceId`, `resource.Details.AwsEc2Instance.ImageId`, `resource.Details.AwsEc2Instance.SubnetId`, `resource.Details.AwsEc2Instance.IamInstanceProfileArn` raw log field(s) with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `resource.Tags.aws:autoscaling:groupName`, `resource.Tags.aws:ec2:fleet-id`, `resource.Tags.Attributes`, `resource.Tags.Environment`, `resource.Tags.Stage`, `resource.Tags.aws:ec2launchtemplate:version`, `resource.Tags.AmazonECSManaged`, `resource.Tags.Namespace`, `resource.Tags.aws:ec2launchtemplate:id`, `resource.Tags.Name` raw log field(s) with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.target.asset.attribute.creation_time`: Newly mapped `resource.Details.AwsEc2Instance.LaunchedAt` raw log field(s) with `event.idm.read_only_udm.target.asset.attribute.creation_time` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `m.Workflow.Status` raw log field(s) with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.network.http.referral_url`: Newly mapped `m.Remediation.Recommendation.Url` raw log field(s) with `event.idm.read_only_udm.network.http.referral_url` UDM field.
2025-11-26	Enhancement: - Enhanced parsing for the `Resources` array to extract detailed attributes from `Details` and `Tags` into UDM fields, primarily within `target.resource.attribute.labels`. - `event.idm.read_only_udm.target.resource.name`: Newly mapped `resource.Details.AwsEksCluster.Name` raw log field to `event.idm.read_only_udm.target.resource.name`. - `event.idm.read_only_udm.principal.ip`: Newly mapped `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/sourceIPs.0_` raw log field to `event.idm.read_only_udm.principal.ip`. - `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/sourceIPs.0_` raw log field to `event.idm.read_only_udm.principal.asset.ip`. - `event.idm.read_only_udm.principal.location.country_or_region`: Newly mapped `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/remoteIpDetails/country/countryName` raw log field to `event.idm.read_only_udm.principal.location.country_or_region`. - `event.idm.read_only_udm.principal.location.region_longitude`: Newly mapped `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/remoteIpDetails/geoLocation/lon` raw log field to `event.idm.read_only_udm.principal.location.region_longitude`. - `event.idm.read_only_udm.principal.location.city`: Newly mapped `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/remoteIpDetails/city/cityName` raw log field to `event.idm.read_only_udm.principal.location.city`. - `event.idm.read_only_udm.network.http.response_code`: Newly mapped `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/statusCode` raw log field to `event.idm.read_only_udm.network.http.response_code`. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `resource.Id`, `resource.Details.Other.kubernetesDetails/kubernetesUserDetails/username`, `resource.Details.AwsEksCluster.ClusterStatus`, `resource.Details.AwsEksCluster.Arn`, `resource.Details.Other.kubernetesDetails/kubernetesUserDetails/groups.0_`, `resource.Details.Other.kubernetesDetails/kubernetesUserDetails/sessionName.0_`, `resource.Details.Other.kubernetesDetails/kubernetesUserDetails/uid`, `resource.Tags.pulumi_Stack`, `resource.Tags.wiz_outpost_id`, `resource.Tags.wiz`, `resource.Tags.Owner` raw log fields to `event.idm.read_only_udm.target.resource.attribute.labels`. - `event.idm.read_only_udm.additional.fields`: Newly mapped `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/remoteIpDetails/organization/isp`, `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/remoteIpDetails/organization/asn`, `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/remoteIpDetails/geoLocation/lat`, `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/resourceName`, `m.ProductFields.aws/guardduty/service/action/kubernetesRoleBindingDetails/roleRefKind`, `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/resource`, `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/userAgent`, `m.ProductFields.aws/guardduty/service/action/kubernetesRoleBindingDetails/roleRefName`, `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/verb`, `m.ProductFields.aws/guardduty/service/action/kubernetesApiCallAction/requestUri`, `m.ProductFields.aws/guardduty/service/action/kubernetesRoleBindingDetails/uid` raw log fields to `event.idm.read_only_udm.additional.fields`.
2025-09-30	Enhancement: - event.idm.read_only_udm.additional.fields: Newly mapped `Sample` (key `Sample`) and `ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp` (key `ISP`) raw log fields to event.idm.read_only_udm.additional.fields. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `CreatedAt` raw log field to event.idm.read_only_udm.metadata.event_timestamp. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped `ProductName` raw log field to event.idm.read_only_udm.metadata.product_event_type. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `ProductFields.ResourceOwnerAccount` (key `ResourceOwnerAccount`) and `ProductFields.aws/guardduty/service/resourceRole` (key `GuardDutyResourceRole`) raw log fields to event.idm.read_only_udm.target.resource.attribute.labels. - event.idm.read_only_udm.metadata.product_version: Newly mapped `SchemaVersion` raw log field to event.idm.read_only_udm.metadata.product_version. - event.idm.read_only_udm.target.resource.resource_subtype: Newly mapped `resource.Type` raw log field to event.idm.read_only_udm.target.resource.resource_subtype. - event.idm.read_only_udm.src.group.product_object_id: Newly mapped `resource.Details.Other.External Principal` raw log field to event.idm.read_only_udm.src.group.product_object_id. - event.idm.read_only_udm.src.user.company_name: Newly mapped `resource.Details.Other.External Principal Type` raw log field to event.idm.read_only_udm.src.user.company_name. - event.idm.read_only_udm.target.application: Newly mapped `Action.AwsApiCallAction.ServiceName` raw log field to event.idm.read_only_udm.target.application. - event.idm.read_only_udm.principal.ip: Newly mapped `Action.AwsApiCallAction.RemoteIpDetails.IpAddressV4` raw log field to event.idm.read_only_udm.principal.ip. - event.idm.read_only_udm.principal.asset.ip: Newly mapped `Action.AwsApiCallAction.RemoteIpDetails.IpAddressV4` raw log field to event.idm.read_only_udm.principal.asset.ip. - event.idm.read_only_udm.principal.group.group_display_name: Newly mapped `Action.AwsApiCallAction.RemoteIpDetails.Organization.Org` raw log field to event.idm.read_only_udm.principal.group.group_display_name. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `Action.AwsApiCallAction.RemoteIpDetails.Organization.AsnOrg` (key `AsnOrg`), `Action.AwsApiCallAction.RemoteIpDetails.Organization.Asn` (key `Organization_Asn`), `Action.AwsApiCallAction.RemoteIpDetails.Country.CountryCode` (key `CountryCode`), `Action.AwsApiCallAction.RemoteIpDetails.GeoLocation.Lat` (key `GeoLocationLatitude`), `Action.AwsApiCallAction.RemoteIpDetails.GeoLocation.Lon` (key `GeoLocationLongitude`), and `Resources.0.Details.AwsIamAccessKey.PrincipalType` (key `PrincipalType`) raw log fields to event.idm.read_only_udm.principal.resource.attribute.labels. - event.idm.read_only_udm.principal.location.country_or_region: Newly mapped `Action.AwsApiCallAction.RemoteIpDetails.Country.CountryName` raw log field to event.idm.read_only_udm.principal.location.country_or_region. - event.idm.read_only_udm.principal.location.city: Newly mapped `Action.AwsApiCallAction.RemoteIpDetails.City.CityName` raw log field to event.idm.read_only_udm.principal.location.city. - event.idm.read_only_udm.principal.user.userid: Newly mapped `Resources.0.Details.AwsIamAccessKey.PrincipalId` raw log field to event.idm.read_only_udm.principal.user.userid. - event.idm.read_only_udm.principal.user.user_display_name: Newly mapped `Resources.0.Details.AwsIamAccessKey.PrincipalName` raw log field to event.idm.read_only_udm.principal.user.user_display_name. - event.idm.read_only_udm.principal.asset.first_seen_time: Newly mapped `FirstObservedAt` raw log field to event.idm.read_only_udm.principal.asset.first_seen_time. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `WorkflowState` (key `Workflow_State`), `ProcessedAt` (key `ProcessedAt`), `GeneratorId` (key `GeneratorId`), `resource.Details.Other.Condition` (key `Condition`), `resource.Details.Other.Resource Control Policy Restriction Type` (key `Resource Control Policy Restriction Type`), `Action.AwsApiCallAction.Api` (key `ActionApi`), `Action.AwsApiCallAction.CallerType` (key `CallerType`), `Resources.0.Type` (key `ResourceType`), `FindingProviderFields.Severity.Product` (key `ProductSeverity`), `ProductFields.aws/securityhub/FindingId` (key `SecurityHubFindingId`), `LastObservedAt` (key `LastObservedAt`), `ProductFields.aws/guardduty/service/archived` (key `GuardDutyArchived`), `ProductFields.aws/guardduty/service/additionalInfo/value` (key `GuardDutyAdditionalInfo`), `ProductFields.aws/guardduty/service/featureName` (key `GuardDutyFeatureName`), `ProductFields.aws/guardduty/service/count` (key `GuardDutyEventCount`), `ProductFields.aws/guardduty/service/action/awsApiCallAction/affectedResources` (key `AffectedResources`), `ProductFields.aws/guardduty/service/additionalInfo/type` (key `GuardDutyAdditionalInfoType`), `ProductFields.aws/guardduty/service/eventFirstSeen` (key `ProductEventFirstSeen`), and `ProductFields.aws/guardduty/service/eventLastSeen` (key `ProductEventLastSeen`) raw log fields to event.idm.read_only_udm.security_result.detection_fields. - event.idm.read_only_udm.security_result.category_details: Newly mapped `Types` raw log field to event.idm.read_only_udm.security_result.category_details. - event.idm.read_only_udm.security_result.last_updated_time: Newly mapped `UpdatedAt` raw log field to event.idm.read_only_udm.security_result.last_updated_time. - event.idm.read_only_udm.security_result.url_back_to_product: Newly mapped `SourceUrl` raw log field to event.idm.read_only_udm.security_result.url_back_to_product. - event.idm.read_only_udm.security_result.action_details: Newly mapped `resource.Details.Other.Action Granted` and `Action.ActionType` raw log fields to event.idm.read_only_udm.security_result.action_details. - event.idm.read_only_udm.security_result.severity: Newly mapped `FindingProviderFields.Severity.Label` raw log field to event.idm.read_only_udm.security_result.severity. - event.idm.read_only_udm.security_result.severity_details: Newly mapped `FindingProviderFields.Severity.Normalized` raw log field to event.idm.read_only_udm.security_result.severity_details.
2025-02-18	Enhancement: - Added support for a new array of JSON log format.
2025-01-20	Enhancement - Added support for new log format.
2025-01-16	Enhancement - Added support for a new JSON log format.
2023-06-20	Enhancement - Modified `metadata.event_type` from `GENERIC_EVENT` to `USER_RESOURCE_ACCESS`.
2023-03-24	Enhancement - when `detail.findings.0.Resources.0.Type` == `AwsEcsTaskDefinition` - - Mapped `target.resource.resource_type` to `TASK`. - Mapped `event_type` to `USER_RESOURCE_ACCESS`. - Mapped `detail.findings.0.ProductFields.Resources:0/Id` to `principal.asset_id`. - Parsed all other failing logs as GENERIC_EVENT as STATUS_UPDATE was not a good parsing option for them.
2022-08-22	Enhancement - - Updated vendor_name from `AWS SECURITY HUB` to `AMAZON`. - Updated product_name from `AWS SECURITY HUB` to `AWS Security Hub`. - Parsed The new JSON format logs containing `configurationItem` or `configurationItems`. - Handled the logs which were ingested as an import file by separating them out using for loop and parse each as individual events.
2022-07-01	Newly Created Parser.