We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for CLOUDFLARE_AUDIT

Date	Changes
2026-08-06	Enhancement: - `event.idm.read_only_udm.target.resource.id`: Removed mapping of `ResourceID` from `event.idm.read_only_udm.target.resource.id` UDM field as it is deprecated UDM field. - `event.idm.read_only_udm.security_result.description`: Newly mapped `action.info` raw log field with `event.idm.read_only_udm.security_result.description` UDM field - `event.idm.read_only_udm.metadata.product_event_type`: Newly mapped `action.type` raw log field with `event.idm.read_only_udm.metadata.product_event_type` UDM field - `event.idm.read_only_udm.network.session_id`: Newly mapped `newValueJson.session_id` raw log field with `event.idm.read_only_udm.network.session_id` UDM field - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `newValueJson`, `oldValueJson`, `newValue`, `oldValue` raw log fields with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `actor.ip` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM fields. - `event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `id` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - `event.idm.read_only_udm.target.resource.resource_subtype`: Newly mapped `resource.type` raw log field with `event.idm.read_only_udm.target.resource.resource_subtype` UDM field. - `event.idm.read_only_udm.target.resource.product_object_id`: Newly mapped `resource.id` raw log field with `event.idm.read_only_udm.target.resource.product_object_id` UDM field. - `event.idm.read_only_udm.target.user.product_object_id`: Newly mapped `owner.id` raw log field with `event.idm.read_only_udm.target.user.product_object_id` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `interface` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.principal.user.email_addresses`: Newly mapped `actor.email` raw log field with `event.idm.read_only_udm.principal.user.email_addresses` UDM field. - `event.idm.read_only_udm.principal.user.product_object_id`: Newly mapped `actor.id` raw log field with `event.idm.read_only_udm.principal.user.product_object_id` UDM field.
2026-01-01	Enhancement: - Modified the condition to set the event type as USER_RESOURCE_UPDATE_CONTENT only when principal user id or principal email is present. - Modified the condition to set the event type as USER_RESOURCE_ACCESS only when principal user id and principal machine data is present. - event.idm.read_only_udm.metadata.event_type: Newly mapped to STATUS_UPDATE when principal machine data is present.
2023-11-27	Enhancement: - Added a Grok pattern to match new log format. - Mapped `ResourceID` to `target.resource.product_object_id`. - Mapped `metainfo_zone_name` to `principal.hostname`. - Mapped `metainfo_user_id` to `principal.user.userid`. - Mapped `metainfo_user_email` to `principal.user.email`. - Mapped `metainfo_user_tag` to `principal.user.product_object_id`. - Mapped `metainfo` fields to `security_result.detection_fields`. - Mapped `newvalue_session_id` to `network.session_id`. - Mapped `NewValue` to `security_result.detection_fields`. - Mapped `OldValue` to `security_result.detection_fields`. - If `ActorID` is present, set `metadata.event_type` to `USER_RESOURCE_ACCESS`.
2023-07-09	New parser created.