Change log for BARRACUDA_CLOUDGEN_FIREWALL

Date	Changes
2026-04-16	- `event.idm.read_only_udm.additional.fields`: Newly mapped `server`, `service`, `box`, `startport`, `endport`, `request_type`, `request_key`, `syslogpriority` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `peer` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field. - `event.idm.read_only_udm.principal.application`: Newly mapped `origin` raw log field with `event.idm.read_only_udm.principal.application` UDM field. - `event.idm.read_only_udm.metadata.description`: Newly mapped `desc` raw log field with `event.idm.read_only_udm.metadata.description` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `principal_user_id` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.principal.user.group_identifiers`: Newly mapped `cn_data` raw log field with `event.idm.read_only_udm.principal.user.group_identifiers` UDM field. - `event.idm.read_only_udm.principal.port`: Newly mapped `src_port` raw log field with `event.idm.read_only_udm.principal.port` UDM field. - Added a Grok pattern on the `message` field to correctly parse the raw log fields.
2026-04-02	- `event.idm.read_only_udm.target.application`: Removed mapping of `action` from `event.idm.read_only_udm.target.application` UDM field, as it contains the `security action` details rather than `application` data. - `event.idm.read_only_udm.security_result.action`: Mapped the `action` raw log field to `event.idm.read_only_udm.security_result.action` UDM field, mapped to `ALLOW` when `action` is `Allow` and to `BLOCK` when `action` is `Block`. - `event.idm.read_only_udm.security_result.action_details`: Mapped the `action` raw log field to `event.idm.read_only_udm.security_result.action_details` UDM field. - `event.idm.read_only_udm.target.user.userid`: Removed mapping of `column1` from `event.idm.read_only_udm.target.user.userid` UDM field, as it contains the `direction` data rather than `user id`. - `event.idm.read_only_udm.additional.fields`: Newly mapped `column1` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.target.mac` and `event.idm.read_only_udm.target.asset.mac`: Removed mapping of the `column6` raw log field from `event.idm.read_only_udm.target.mac` and `event.idm.read_only_udm.target.asset.mac` UDM field, when it contains the `principal MAC` address rather than the `target MAC` address. - `event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac`: Mapped `column6` raw log field to `event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `column3`, `column9` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.security_result.rule_id`: Newly mapped `column12` raw log field with `event.idm.read_only_udm.security_result.rule_id` UDM field. - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `column4` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field. - `event.idm.read_only_udm.network.ip_protocol`: Newly mapped `column2` raw log field with `event.idm.read_only_udm.network.ip_protocol` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `ts_timestamp` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - Added a Grok pattern on the `message` field to correctly parse the raw log fields.
2025-02-10	Newly created parser.