We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for FORTINET_SWITCH

Date Changes

2026-07-13 Enhancement:
- Added support for timezone in the timestamp
- event.idm.read_only_udm.additional.fields: Newly mapped cpu, memory, sn, concurrent_session, profile, total_session, ui and average raw log fields with event.idm.read_only_udm.additional.fields UDM field.
- event.idm.read_only_udm.network.application_protocol: Newly mapped method raw log field with event.idm.read_only_udm.network.application_protocol UDM field.
- event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip: Newly mapped srcip raw log field with event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip UDM fields.
- event.idm.read_only_udm.target.ip and event.idm.read_only_udm.target.asset.ip: Newly mapped dstip raw log field with event.idm.read_only_udm.target.ip and event.idm.read_only_udm.target.asset.ip UDM fields.
- event.idm.read_only_udm.network.session_duration.seconds: Newly mapped duration raw log field with event.idm.read_only_udm.network.session_duration.seconds UDM field.
- event.idm.read_only_udm.security_result.detection_fields: Newly mapped reason raw log field with event.idm.read_only_udm.security_result.detection_fields UDM field.
- event.idm.read_only_udm.metadata.event_type : Updated event.idm.read_only_udm.metadata.event_type to USER_LOGIN when principal machine data and target machine data is present and action is login.
- event.idm.read_only_udm.metadata.event_type : Updated event.idm.read_only_udm.metadata.event_type to USER_LOGOUT when principal machine data and target machine data is present and action is logout.

2024-11-11 Newly created parser.

Date	Changes
2026-07-13	Enhancement: - Added support for timezone in the `timestamp` - `event.idm.read_only_udm.additional.fields`: Newly mapped `cpu`, `memory`, `sn`, `concurrent_session`, `profile`, `total_session`, `ui` and `average` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.network.application_protocol`: Newly mapped `method` raw log field with `event.idm.read_only_udm.network.application_protocol` UDM field. - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `srcip` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM fields. - `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`: Newly mapped `dstip` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM fields. - `event.idm.read_only_udm.network.session_duration.seconds`: Newly mapped `duration` raw log field with `event.idm.read_only_udm.network.session_duration.seconds` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `reason` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.metadata.event_type` : Updated `event.idm.read_only_udm.metadata.event_type` to `USER_LOGIN` when principal machine data and target machine data is present and `action` is `login`. - `event.idm.read_only_udm.metadata.event_type` : Updated `event.idm.read_only_udm.metadata.event_type` to `USER_LOGOUT` when principal machine data and target machine data is present and `action` is `logout`.
2024-11-11	Newly created parser.