We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for HADOOP

Date	Changes
2026-02-23	Enhancement - `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `collection_time_details` raw log field to `event.idm.read_only_udm.metadata.collected_timestamp` UDM field. - `event.idm.read_only_udm.principal.asset.network_domain`: Newly mapped `principal_network_domain` raw log field to `event.idm.read_only_udm.principal.asset.network_domain` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `timestamp_details` raw log field to `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.target.hostname`,`event.idm.read_only_udm.target.asset.hostname`: Added null and empty conditional check before mapping `event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname` as null is not a valid hostname. - `event.idm.read_only_udm.metadata.new_event`: Updated the `event.idm.read_only_udm.metadata.new_event` from `NETWORK_CONNECTION` to `STATUS_UPDATE` when no target device details are found. - `event.idm.read_only_udm.metadata.description`: Added a grok pattern to correctly extract raw log fields and map them to the appropriate UDM fields; previously, these were being incorrectly parsed into the `event.idm.read_only_udm.metadata.description` UDM field. - `event.idm.read_only_udm.metadata.product_name`: Added a grok pattern to correctly extract raw log fields and map them to the appropriate UDM field; previously, these were being incorrectly parsed into the `event.idm.read_only_udm.metadata.product_name` UDM field. - Added a new grok pattern for the raw log field `ugi` to extract principal_network_domain. - Added a new grok pattern to handle the new format of syslog+kv logs, this is allowing the following UDM fields to be mapped correctly: - `event.idm.read_only_udm.principal.ip` - `event.idm.read_only_udm.principal.asset.ip` - `event.idm.read_only_udm.principal.process.command_line` - `event.idm.read_only_udm.security_result.action` - `event.idm.read_only_udm.security_result.severity` - `event.idm.read_only_udm.src.file.full_path - `event.idm.read_only_udm.metadata.product_event_type` - `event.idm.read_only_udm.observer.ip` - `event.idm.read_only_udm.additional.fields` - `event.idm.read_only_udm.principal.user.userid`
2023-06-05	Enhancement - Added new Grok pattern to parse new syslog format logs. - Changed `event_type` from `GENERIC_EVENT` to `NETWORK_CONNECTION` when both `principal` and `target` fields are present, otherwise set it to `STATUS_UPDATE`. - Mapped `ugi` to `target.ip`. - Mapped `tip` to `target.hostname`. - Mapped `cmd` to `principal.process.command_line`. - Mapped the `hostname` and IP address already mapped to `observer.hostname and observer.ip` to `principal.hostname` and `principal.ip` as well to meet validation requirements.
2022-05-25	Mapped IP to observer.ip.