Change log for DATABRICKS

Date	Changes
2026-03-17	Newly created parser: - `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `receiveTimestamp` raw log field(s) with `event.idm.read_only_udm.metadata.collected_timestamp` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `event_time`,`time`,`timestamp` raw log field(s) with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.target.resource.product_object_id`: Newly mapped `resourceId` raw log field(s) with `event.idm.read_only_udm.target.resource.product_object_id` UDM field. - `event.idm.read_only_udm.metadata.product_version`: Newly mapped `operationVersion`, `version`, `jsonPayload.version` raw log field(s) with `event.idm.read_only_udm.metadata.product_version` UDM field. - `event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `event_id`, `properties.logId`, `insertId` raw log field(s) with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - `event.idm.read_only_udm.principal.ip`: Newly mapped `properties.sourceIPAddress`, `sourceIPAddress`, `jsonPayload.sourceIPAddress`,`source_ip_address` raw log field(s) with `event.idm.read_only_udm.principal.ip` UDM field. - `event.idm.read_only_udm.principal.user.email_addresses`: Newly mapped `user_identity.email`, `identity.email`, `userIdentity.email`, `jsonPayload.userIdentity.email` raw log field(s) with `event.idm.read_only_udm.principal.user.email_addresses` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `user_identity.email`, `identity.email`, `userIdentity.email`, `jsonPayload.userIdentity.email`, `grantor` raw log field(s) with `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.metadata.product_event_type`: Newly mapped `action_name`,`properties.actionName`, `actionName`, `jsonPayload.actionName` raw log field(s) with `event.idm.read_only_udm.metadata.product_event_type` UDM field. - `event.idm.read_only_udm.target.application`: Newly mapped `service_name`, `properties.serviceName`, `serviceName`, `jsonPayload.serviceName` raw log field(s) with `event.idm.read_only_udm.target.application` UDM field. - `event.idm.read_only_udm.network.http.response_code`: Newly mapped `response_code`, `response.status_code`, `p_response.statusCode`, `response.statusCode`, `jsonPayload.response.statusCode` raw log field(s) with `event.idm.read_only_udm.network.http.response_code` UDM field. - `event.idm.read_only_udm.network.http.user_agent`: Newly mapped `properties.userAgent`, `userAgent`, `jsonPayload.userAgent` raw log field(s) with `event.idm.read_only_udm.network.http.user_agent` UDM field. - `event.idm.read_only_udm.network.session_id`: Newly mapped `properties.sessionId`, `sessionId` raw log field(s) with `event.idm.read_only_udm.network.session_id` UDM field. - `event.idm.read_only_udm.principal.hostname`: Newly mapped `Host` raw log field(s) with `event.idm.read_only_udm.principal.hostname` UDM field. - `event.idm.read_only_udm.target.resource.name`: Newly mapped `resource.labels.function_name`, `object_name` raw log field(s) with `event.idm.read_only_udm.target.resource.name` UDM field. - `event.idm.read_only_udm.target.location.country_or_region`: Newly mapped `resource.labels.region` raw log field(s) with `event.idm.read_only_udm.target.location.country_or_region` UDM field. - `event.idm.read_only_udm.target.resource.resource_subtype`: Newly mapped `resource.type`, `object_type` raw log field(s) with `event.idm.read_only_udm.target.resource.resource_subtype` UDM field. - `event.idm.read_only_udm.security_result.rule_name`: Newly mapped `privilege_type` raw log field(s) with `event.idm.read_only_udm.security_result.rule_name` UDM field. - `event.idm.read_only_udm.security_result.description`: Newly mapped `p_response.errorMessage` raw log field(s) with `event.idm.read_only_udm.security_result.description` UDM field. - `event.idm.read_only_udm.target.user.userid`: Newly mapped `grantee` raw log field(s) with `event.idm.read_only_udm.target.user.userid` UDM field. - `event.idm.read_only_udm.target.file.full_path`: Newly mapped `request_params.path` raw log field(s) with `event.idm.read_only_udm.target.file.full_path` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped key-value pairs from `request_params`, `jsonPayload.request_params`, `identity_metadata` raw log field(s) with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped key-value pairs from `resource.labels` raw log field(s) with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `account_id`, `workspace_id`, `category`, `workspaceId`, `accountId`, `jsonPayload_accountId`, `jsonPayload_workspaceId`, `catalog_name`, `schema_name` raw log field(s) with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `response.result`, `audit_level`, `auditLevel`, `request_params.authenticationMethod`, `jsonPayload.auditLevel`, `jsonPayload.request_params.authenticationMethod` raw log field(s) with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.principal.user.attribute.labels`: Newly mapped `user_identity.subject_name`, `identity.subjectName` raw log field(s) with `event.idm.read_only_udm.principal.user.attribute.labels` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `event_date`, `request_id`, `operationName`, `properties.requestId`, `requestId`, `jsonPayload.logName`, `jsonPayload.requestId`, `jsonPayload.timestamp`, `logName` raw log field(s) with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.metadata.vendor_name`: Newly mapped `DATABRICKS` raw log field(s) with `event.idm.read_only_udm.metadata.vendor_name` UDM field. - `event.idm.read_only_udm.metadata.product_name`: Newly mapped `DATABRICKS` raw log field(s) with `event.idm.read_only_udm.metadata.product_name` UDM field. - `event.idm.read_only_udm.metadata.event_type`: The event_type is updated to `USER_RESOURCE_ACCESS`, `FILE_READ`, `FILE_MODIFICATION`, `USER_RESOURCE_CREATION`, `USER_RESOURCE_UPDATE_PERMISSIONS`, `USER_UNCATEGORIZED`, or `STATUS_UPDATE` based on the presence of necessary principal and target data, defaulting to GENERIC_EVENT if those details are missing.

Date

Changes

2026-03-17

Newly created parser:
- `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `receiveTimestamp` raw log field(s) with `event.idm.read_only_udm.metadata.collected_timestamp` UDM field.
- `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `event_time`,`time`,`timestamp` raw log field(s) with `event.idm.read_only_udm.metadata.event_timestamp` UDM field.
- `event.idm.read_only_udm.target.resource.product_object_id`: Newly mapped `resourceId` raw log field(s) with `event.idm.read_only_udm.target.resource.product_object_id` UDM field.
- `event.idm.read_only_udm.metadata.product_version`: Newly mapped `operationVersion`, `version`, `jsonPayload.version` raw log field(s) with `event.idm.read_only_udm.metadata.product_version` UDM field.
- `event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `event_id`, `properties.logId`, `insertId` raw log field(s) with `event.idm.read_only_udm.metadata.product_log_id` UDM field.
- `event.idm.read_only_udm.principal.ip`: Newly mapped `properties.sourceIPAddress`, `sourceIPAddress`, `jsonPayload.sourceIPAddress`,`source_ip_address` raw log field(s) with `event.idm.read_only_udm.principal.ip` UDM field.
- `event.idm.read_only_udm.principal.user.email_addresses`: Newly mapped `user_identity.email`, `identity.email`, `userIdentity.email`, `jsonPayload.userIdentity.email` raw log field(s) with `event.idm.read_only_udm.principal.user.email_addresses` UDM field.
- `event.idm.read_only_udm.principal.user.userid`: Newly mapped `user_identity.email`, `identity.email`, `userIdentity.email`, `jsonPayload.userIdentity.email`, `grantor` raw log field(s) with `event.idm.read_only_udm.principal.user.userid` UDM field.
- `event.idm.read_only_udm.metadata.product_event_type`: Newly mapped `action_name`,`properties.actionName`, `actionName`, `jsonPayload.actionName` raw log field(s) with `event.idm.read_only_udm.metadata.product_event_type` UDM field.
- `event.idm.read_only_udm.target.application`: Newly mapped `service_name`, `properties.serviceName`, `serviceName`, `jsonPayload.serviceName` raw log field(s) with `event.idm.read_only_udm.target.application` UDM field.
- `event.idm.read_only_udm.network.http.response_code`: Newly mapped `response_code`, `response.status_code`, `p_response.statusCode`, `response.statusCode`, `jsonPayload.response.statusCode` raw log field(s) with `event.idm.read_only_udm.network.http.response_code` UDM field.
- `event.idm.read_only_udm.network.http.user_agent`: Newly mapped `properties.userAgent`, `userAgent`, `jsonPayload.userAgent` raw log field(s) with `event.idm.read_only_udm.network.http.user_agent` UDM field.
- `event.idm.read_only_udm.network.session_id`: Newly mapped `properties.sessionId`, `sessionId` raw log field(s) with `event.idm.read_only_udm.network.session_id` UDM field.
- `event.idm.read_only_udm.principal.hostname`: Newly mapped `Host` raw log field(s) with `event.idm.read_only_udm.principal.hostname` UDM field.
- `event.idm.read_only_udm.target.resource.name`: Newly mapped `resource.labels.function_name`, `object_name` raw log field(s) with `event.idm.read_only_udm.target.resource.name` UDM field.
- `event.idm.read_only_udm.target.location.country_or_region`: Newly mapped `resource.labels.region` raw log field(s) with `event.idm.read_only_udm.target.location.country_or_region` UDM field.
- `event.idm.read_only_udm.target.resource.resource_subtype`: Newly mapped `resource.type`, `object_type` raw log field(s) with `event.idm.read_only_udm.target.resource.resource_subtype` UDM field.
- `event.idm.read_only_udm.security_result.rule_name`: Newly mapped `privilege_type` raw log field(s) with `event.idm.read_only_udm.security_result.rule_name` UDM field.
- `event.idm.read_only_udm.security_result.description`: Newly mapped `p_response.errorMessage` raw log field(s) with `event.idm.read_only_udm.security_result.description` UDM field.
- `event.idm.read_only_udm.target.user.userid`: Newly mapped `grantee` raw log field(s) with `event.idm.read_only_udm.target.user.userid` UDM field.
- `event.idm.read_only_udm.target.file.full_path`: Newly mapped `request_params.path` raw log field(s) with `event.idm.read_only_udm.target.file.full_path` UDM field.
- `event.idm.read_only_udm.additional.fields`: Newly mapped key-value pairs from `request_params`, `jsonPayload.request_params`, `identity_metadata` raw log field(s) with `event.idm.read_only_udm.additional.fields` UDM field.
- `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped key-value pairs from `resource.labels` raw log field(s) with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field.
- `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `account_id`, `workspace_id`, `category`, `workspaceId`, `accountId`, `jsonPayload_accountId`, `jsonPayload_workspaceId`, `catalog_name`, `schema_name` raw log field(s) with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field.
- `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `response.result`, `audit_level`, `auditLevel`, `request_params.authenticationMethod`, `jsonPayload.auditLevel`, `jsonPayload.request_params.authenticationMethod` raw log field(s) with `event.idm.read_only_udm.security_result.detection_fields` UDM field.
- `event.idm.read_only_udm.principal.user.attribute.labels`: Newly mapped `user_identity.subject_name`, `identity.subjectName` raw log field(s) with `event.idm.read_only_udm.principal.user.attribute.labels` UDM field.
- `event.idm.read_only_udm.additional.fields`: Newly mapped `event_date`, `request_id`, `operationName`, `properties.requestId`, `requestId`, `jsonPayload.logName`, `jsonPayload.requestId`, `jsonPayload.timestamp`, `logName` raw log field(s) with `event.idm.read_only_udm.additional.fields` UDM field.
- `event.idm.read_only_udm.metadata.vendor_name`: Newly mapped `DATABRICKS` raw log field(s) with `event.idm.read_only_udm.metadata.vendor_name` UDM field.
- `event.idm.read_only_udm.metadata.product_name`: Newly mapped `DATABRICKS` raw log field(s) with `event.idm.read_only_udm.metadata.product_name` UDM field.
- `event.idm.read_only_udm.metadata.event_type`: The event_type is updated to `USER_RESOURCE_ACCESS`, `FILE_READ`, `FILE_MODIFICATION`, `USER_RESOURCE_CREATION`, `USER_RESOURCE_UPDATE_PERMISSIONS`, `USER_UNCATEGORIZED`, or `STATUS_UPDATE` based on the presence of necessary principal and target data, defaulting to GENERIC_EVENT if those details are missing.