We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for INFORMIX

Date Changes

2026-07-28 Enhancement:
- Added support for SYSLOG + CSV format.
- event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped syslog_timestamp raw log field to event.idm.read_only_udm.metadata.collected_timestamp UDM field.
- event.idm.read_only_udm.metadata.event_timestamp: Newly mapped event_timestamp raw log field to event.idm.read_only_udm.metadata.event_timestamp UDM field.
- event.idm.read_only_udm.target.hostname, event.idm.read_only_udm.target.asset.hostname: Newly mapped syslog_hostname raw log field to event.idm.read_only_udm.target.hostname and event.idm.read_only_udm.target.asset.hostname UDM fields.
- event.idm.read_only_udm.target.application: Newly mapped syslog_process raw log field to event.idm.read_only_udm.target.application UDM field.
- event.idm.read_only_udm.security_result.summary: Newly mapped status_flag raw log field to event.idm.read_only_udm.security_result.summary UDM field.
- event.idm.read_only_udm.principal.hostname, event.idm.read_only_udm.principal.asset.hostname: Newly mapped remote_hostname raw log field to event.idm.read_only_udm.principal.hostname and event.idm.read_only_udm.principal.asset.hostname UDM fields.
- event.idm.read_only_udm.principal.port: Newly mapped remote_port raw log field to event.idm.read_only_udm.principal.port UDM field.
- event.idm.read_only_udm.principal.resource.name: Newly mapped service_name raw log field to event.idm.read_only_udm.principal.resource.name UDM field.
- event.idm.read_only_udm.target.resource.name: Newly mapped database_name raw log field to event.idm.read_only_udm.target.resource.name UDM field.
- event.idm.read_only_udm.target.resource.resource_type: Added conditional logic to set event.idm.read_only_udm.target.resource.resource_type to DATABASE when database_name raw log field is present.
- event.idm.read_only_udm.security_result.description: Newly mapped session_status raw log field to event.idm.read_only_udm.security_result.description UDM field.
- event.idm.read_only_udm.metadata.event_type: Added conditional logic to set event.idm.read_only_udm.metadata.event_type to SYSTEM_AUDIT_LOG_UNCATEGORIZED when has_principal_user is true, NETWORK_CONNECTION when both has_target and has_principal are true, STATUS_UPDATE when has_principal is true, or GENERIC_EVENT as fallback.

Date	Changes
2026-07-28	Enhancement: - Added support for `SYSLOG + CSV` format. - `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `syslog_timestamp` raw log field to `event.idm.read_only_udm.metadata.collected_timestamp` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `event_timestamp` raw log field to `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.target.hostname`, `event.idm.read_only_udm.target.asset.hostname`: Newly mapped `syslog_hostname` raw log field to `event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname` UDM fields. - `event.idm.read_only_udm.target.application`: Newly mapped `syslog_process` raw log field to `event.idm.read_only_udm.target.application` UDM field. - `event.idm.read_only_udm.security_result.summary`: Newly mapped `status_flag` raw log field to `event.idm.read_only_udm.security_result.summary` UDM field. - `event.idm.read_only_udm.principal.hostname`, `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `remote_hostname` raw log field to `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname` UDM fields. - `event.idm.read_only_udm.principal.port`: Newly mapped `remote_port` raw log field to `event.idm.read_only_udm.principal.port` UDM field. - `event.idm.read_only_udm.principal.resource.name`: Newly mapped `service_name` raw log field to `event.idm.read_only_udm.principal.resource.name` UDM field. - `event.idm.read_only_udm.target.resource.name`: Newly mapped `database_name` raw log field to `event.idm.read_only_udm.target.resource.name` UDM field. - `event.idm.read_only_udm.target.resource.resource_type`: Added conditional logic to set `event.idm.read_only_udm.target.resource.resource_type` to `DATABASE` when `database_name` raw log field is present. - `event.idm.read_only_udm.security_result.description`: Newly mapped `session_status` raw log field to `event.idm.read_only_udm.security_result.description` UDM field. - `event.idm.read_only_udm.metadata.event_type`: Added conditional logic to set `event.idm.read_only_udm.metadata.event_type` to `SYSTEM_AUDIT_LOG_UNCATEGORIZED` when `has_principal_user` is true, `NETWORK_CONNECTION` when both `has_target` and `has_principal` are true, `STATUS_UPDATE` when `has_principal` is true, or `GENERIC_EVENT` as fallback.