Change log for AZURE_DEVOPS

Date	Changes
2025-03-10	Enhancement: - Mapped area to target.application. - Mapped categoryDisplayName to security_result.action_details. - Mapped details to metadata.description. - Mapped actionId to metadata.product_event_type. - Mapped timestamp to metadata.event_timestamp. - Mapped actorUserId to principal.user.userid. - Mapped actorDisplayName to principal.user.user_display_name. - Mapped actorCUID to principal.user.product_object_id. - Mapped actorUPN to principal.user.email_addresses. - Mapped scopeId to target.resource_ancestors_scope.product_object_id. - Mapped scopeName to target.resource_ancestors_scope.name. - Mapped userAgent to network.http.user_agent and network.http.parsed_user_agent. - Mapped projectId to target.resource_ancestors_project.product_object_id. - Mapped scopeType to additional.fields. - Mapped projectName to target.resource.attribute.labels. - Mapped activityId to metadata.product_log_id.
2024-01-19	Enhancement: - Changed metadata.event_type value from SERVICE_* to USER_RESOURCE_UPDATE_CONTENT if principal user data and target resource data are present. - Changed mapping for IpAddress from target.ip to principal.ip. - Changed mapping for ActorCUID from principal.user.product_object_id to additional.fields. - Changed mapping for ScopeId from principal.asset_id to resource_ancestors.product_object_id. - Changed mapping for _Internal_WorkspaceResourceId from target.resource.product_object_id to additional.fields. - Changed mapping for ProjectId from target.resource.attribute.labels to target.resource_ancestors.product_object_id. - Changed mapping for AuthenticationMechanism from security_result.summary to extensions.auth.auth_details. - Changed mapping for CorrelationId from network.session_id to additional.fields. - Changed mapping for ScopeDisplayName from additional.fields to target.resource_ancestors.name. - Changed mapping for PipelineId from additional.fields to target.resource.product_object_id. - Changed mapping for PipelineName from additional.fields to target.resource.name. - Changed mapping for PipelineScope from additional.fields to target.resource.attribute.labels. - Changed mapping for PipelineRevision from additional.fields to target.resource.attribute.labels. - Changed mapping for ProjectId from target.resource.resource.attribute.labels to target.resource_ancestors.product_object_id. - Changed mapping for Area from additional.fields to target.application. - Mapped MICROSOFT_AZURE value to target.asset.attribute.cloud.environment. - When AuthenticationMechanism is having ServicePrincipal value, then set SERVICE_ACCOUNT_TYPE to principal.user.account_type, else set CLOUD_ACCOUNT_TYPE to principal.user.account_type. - Mapped Category to security_result.action_details. - Mapped ALLOW or BLOCK to security_result.action based on Details field. - Mapped ActivityId to additional.fields.
2024-01-09	Enhancement: - Added Grok and gsub to parse the unparsed JSON logs. - Mapped rec.correlationId, properties.currentHealthStatus, properties.previousHealthStatus, properties.type, properties.cause, properties.title, properties.details, properties.recommendationType, properties.recommendationCategory, properties.recommendationImpact, properties.recommendationName, properties.recommendationResourceLink, properties.recommendationSchemaVersion, properties.eventCategory, properties.hierarchy, properties.message, properties.entity, identity.claims.xms.tcdt, identity.claims.aio, identity.claims.appid, identity.claims.appidacr, identity.claims.aud, identity.claims.exp, identity.claims.iat, identity.claims.idtyp, identity.claims.iss, identity.claims.uti, identity.claims.rh, identity.claims.ver, identity.claims.nbf, identity.authorization.evidence.roleAssignmentId, identity.authorization.evidence.principalType, identity.authorization.evidence.principalId, identity.authorization.evidence.roleAssignmentScope, identity.authorization.evidence.roleDefinitionId to security_result.detection_fields. - Mapped resultSignature.label, rec.resultType, Visibility, Humidity, Precipitation,MoonPhase, Moonrise, Moonset, Pressure, WindSpeed, UVIndex, DewPoint, WindDirection, Sunrise, Sunset, Temperature, Icon, Conditions to additional.fields". - Mapped level to security_result.severity. - Mapped appname to target.application. - Mapped category.details to security.result.category.details. - Mapped rec.resourceId to target.resource.id. - Mapped res.extensionResourceName to principal.hostname.
2023-11-23	Enhancement: - Added support for a new pattern of JSON logs. - Mapped data.TimeGenerated to metadata.event_timestamp. - When _Internal_WorkspaceResourceId is missing, then mapped topic to target.resource.product_object_id. - Mapped data.Data.ConnectionId to additional.fields. - Mapped data.Data.ownerDetails to additional.fields. - Mapped data.Data.DeploymentResult to additional.fields. - Mapped data.Data.EnvironmentName to additional.fields. - Mapped data.Data.JobName to additional.fields. - Mapped data.Data.StageName to additional.fields. - Mapped data.Data.RunName to additional.fields. - Mapped data.Data.RetentionLeaseId to additional.fields. - Mapped data.Data.CheckSuiteId to additional.fields. - Mapped data.Data.CheckSuiteStatus to additional.fields. - Mapped data.Data.ApprovalRequest to additional.fields. - Mapped data.Data.ApprovalType to additional.fields. - Mapped subject to additional.fields. - Mapped data.ActorUserId to principal.user.userid. - Mapped data.ActorDisplayName to principal.user.user_display_name. - Mapped data.ActorCUID to principal.user.product_object_id. - Mapped data.ActorUPN to principal.user.email_addresses. - Mapped data.ScopeId to principal.asset_id. - Mapped data.CorrelationId to network.session_id. - Mapped data.UserAgent to network.http.user_agent. - Mapped data.ProjectId to target.resource.attribute.labels. - Mapped data.ScopeType to additional.fields. - Mapped data.ProjectName to target.resource.attribute.labels. - Mapped data.Details to metadata.description. - Mapped data.CategoryDisplayName to security_result.rule_name. - Mapped data.Area to additional.fields. - Mapped data.Id to metadata.product_log_id. - Mapped data.ActionId to metadata.product_event_type. - Mapped data.Timestamp to metadata.event_timestamp.
2022-06-28	Newly created parser