Change log for CYBERARK_PTA

Date	Changes
2026-07-28	Enhancement: - Added grok pattern matching on temp_data to extract timestamp and inter_ip from syslog headers in CEF log entries. - event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped deviceCustomDate1 raw log field with event.idm.read_only_udm.metadata.collected_timestamp UDM field. - event.idm.read_only_udm.intermediary.ip and event.idm.read_only_udm.intermediary.asset.ip: Newly mapped inter_ip raw log field with event.idm.read_only_udm.intermediary.ip and event.idm.read_only_udm.intermediary.asset.ip UDM fields. - event.idm.read_only_udm.metadata.event_type: - Set event.idm.read_only_udm.metadata.event_type to USER_RESOURCE_ACCESS when principal machine data and has target user are present. - Set event.idm.read_only_udm.metadata.event_type to USER_UNCATEGORIZED when principal host is present.
2026-06-22	Enhancement: -event.idm.read_only_udm.security_result.description: Removed mapping of suspiciousSessionActivity from event.idm.read_only_udm.security_result.description UDM field since suspiciousSessionActivity raw log field represents executed command. -event.idm.read_only_udm.target.process.command_line: Mapped suspiciousSessionActivity raw log field with event.idm.read_only_udm.target.process.command_line UDM field.
2026-05-28	Enhancement: - Added grok pattern to support LEEF log format. - event.idm.read_only_udm.metadata.id: Newly mapped leef_eventid raw log field with event.idm.read_only_udm.metadata.id UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped eventID raw log field with event.idm.read_only_udm.metadata.product_log_id UDM field. - event.idm.read_only_udm.metadata.product_version: Newly mapped leef_version raw log fields with event.idm.read_only_udm.metadata.product_version UDM field. - event.idm.read_only_udm.metadata.vendor_name: Newly mapped vendor_data raw log field with event.idm.read_only_udm.metadata.vendor_name UDM field. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped timestamp raw log field with event.idm.read_only_udm.metadata.event_timestamp UDM field. - event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped devTime raw log field with event.idm.read_only_udm.metadata.collected_timestamp UDM field. - event.idm.read_only_udm.principal.user.user_display_name: Newly mapped suser raw log field with event.idm.read_only_udm.principal.user.user_display_name UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped src raw log field with event.idm.read_only_udm.principal.asset.ip UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped src raw log field with event.idm.read_only_udm.principal.ip UDM field. - event.idm.read_only_udm.target.user.userid: Newly mapped usrName raw log field with event.idm.read_only_udm.target.user.userid UDM field. - event.idm.read_only_udm.target.asset.ip: Newly mapped dst raw log field with event.idm.read_only_udm.target.asset.ip UDM field. - event.idm.read_only_udm.target.ip: Newly mapped dst raw log field with event.idm.read_only_udm.target.ip UDM field. - event.idm.read_only_udm.intermediary.asset.ip: Newly mapped inter_ip raw log field with event.idm.read_only_udm.intermediary.asset.ip UDM field. - event.idm.read_only_udm.intermediary.ip: Newly mapped inter_ip raw log field with event.idm.read_only_udm.intermediary.ip UDM field. - event.idm.read_only_udm.about.url: Newly mapped externalLink raw log field with event.idm.read_only_udm.about.url UDM field. - event.idm.read_only_udm.security_result.category_details: Newly mapped Cat raw log field with event.idm.read_only_udm.security_result.category_details UDM field. - event.idm.read_only_udm.security_result.description: Newly mapped suspiciousSessionActivity raw log field with event.idm.read_only_udm.security_result.description UDM field. - event.idm.read_only_udm.security_result.severity: Newly mapped sev raw log field with event.idm.read_only_udm.security_result.severity UDM field. - event.idm.read_only_udm.security_result.severity_details: Newly mapped sev raw log field with event.idm.read_only_udm.security_result.severity_details UDM field. - event.idm.read_only_udm.security_result.url_back_to_product: Newly mapped ptaLink raw log field with event.idm.read_only_udm.security_result.url_back_to_product UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped externalLinkLabel, suspiciousSessionActivityLabel, eventIdLabel, linkLabel, suserLabel, extraDataLabel, extraData,prod_version raw log fields with event.idm.read_only_udm.additional.fields UDM field. - event.idm.read_only_udm.metadata.event_type: Updated the event.idm.read_only_udm.metadata.event_type to NETWORK_CONNECTION and USER_UNCATEGORIZED when necessary raw log fields are present.
2024-08-13	Newly created parser.