Change log for KITEWORKS

Date	Changes
2025-11-14	Enhancement: - Mapped Kiteworks JSON formatted logs to UDM fields. - `event.idm.read_only_udm.additional.fields`: Newly mapped `subscriptionId`, `payload.data.context`, `payload.data.geolocation_source.source`, `payload.data.geolocation_source.source_with_kw`, `payload.appname`, `payload.procid`, `payload.flag`, `payload.tenant_id` raw log field(s) with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.intermediary`: Newly mapped `intermediary_host` raw log field(s) with `event.idm.read_only_udm.intermediary` UDM field. - `event.idm.read_only_udm.metadata.description`: Newly mapped `payload.description` raw log field(s) with `event.idm.read_only_udm.metadata.description` UDM field. - `event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `webhookId` raw log field(s) with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - `event.idm.read_only_udm.network.http.parsed_user_agent`: Newly mapped `payload.user_agent` raw log field(s) with `event.idm.read_only_udm.network.http.parsed_user_agent` UDM field. - `event.idm.read_only_udm.network.http.user_agent`: Newly mapped `payload.user_agent` raw log field(s) with `event.idm.read_only_udm.network.http.user_agent` UDM field. - `event.idm.read_only_udm.network.session_id`: Newly mapped `payload.data.session` raw log field(s) with `event.idm.read_only_udm.network.session_id` UDM field. - `event.idm.read_only_udm.principal.application`: Newly mapped `payload.client_name` raw log field(s) with `event.idm.read_only_udm.principal.application` UDM field. - `event.idm.read_only_udm.principal.asset.product_object_id`: Newly mapped `payload.client_id` raw log field(s) with `event.idm.read_only_udm.principal.asset.product_object_id` UDM field. - `event.idm.read_only_udm.principal.hostname`: Newly mapped `payload.host` raw log field(s) with `event.idm.read_only_udm.principal.hostname` UDM field. - `event.idm.read_only_udm.principal.ip`: Newly mapped `payload.user_ip`, `payload.source_ip` raw log field(s) with `event.idm.read_only_udm.principal.ip` UDM field. - `event.idm.read_only_udm.principal.user.attribute.labels`: Newly mapped `payload.user_type` raw log field(s) with `event.idm.read_only_udm.principal.user.attribute.labels` UDM field. - `event.idm.read_only_udm.principal.user.product_object_id`: Newly mapped `payload.user_id` raw log field(s) with `event.idm.read_only_udm.principal.user.product_object_id` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `payload.user_name` raw log field(s) with `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.security_result.action`: Newly mapped `payload.successful` raw log field(s) with `event.idm.read_only_udm.security_result.action` UDM field. - `event.idm.read_only_udm.security_result.severity`: Newly mapped `payload.severity` raw log field(s) with `event.idm.read_only_udm.security_result.severity` UDM field. - `event.idm.read_only_udm.target.application`: Newly mapped `payload.application` raw log field(s) with `event.idm.read_only_udm.target.application` UDM field. - `event.idm.read_only_udm.target.hostname`: Newly mapped `payload.app_host` raw log field(s) with `event.idm.read_only_udm.target.hostname` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `tenantId` raw log field(s) with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.metadata.event_type`: If `payload.event_field` is `user_logged_out`, updated to `USER_LOGOUT`. - `event.idm.read_only_udm.extensions.auth.type`: If `msg` or `payload.event_field` has a value, updated to `MACHINE`. - Parsing logic updated to prioritize direct JSON parsing of the entire log message. If JSON parsing fails, it falls back to the previous grok-based syslog parsing logic. - Added logic to parse `payload.timestamp` using the `ISO8601` format.
2025-09-26	- Added support for new format of logs. - event.idm.read_only_udm.metadata.description: Newly mapped `log_message`, `description`, `full_log` raw log field with `event.idm.read_only_udm.metadata.description` UDM field. - event.idm.read_only_udm.target.ip: Newly mapped `host_ip`, `data.node_ip` raw log field with `event.idm.read_only_udm.target.ip` UDM field. - event.idm.read_only_udm.target.asset.ip: Newly mapped `host_ip`, `data.node_ip` raw log field with `event.idm.read_only_udm.target.asset.ip` UDM field. - event.idm.read_only_udm.target.hostname: Newly mapped `host`, `app_host` raw log field with `event.idm.read_only_udm.target.hostname` UDM field. - event.idm.read_only_udm.target.asset.hostname: Newly mapped `host` raw log field with `event.idm.read_only_udm.target.asset.hostname` UDM field. - event.idm.read_only_udm.network.http.user_agent: Newly mapped `http_user_agent`, `user_agent` raw log field with `event.idm.read_only_udm.network.http.user_agent` UDM field. - event.idm.read_only_udm.network.http.parsed_user_agent: Newly mapped `http_user_agent`, `user_agent` raw log field with `event.idm.read_only_udm.network.http.parsed_user_agent` UDM field. - event.idm.read_only_udm.principal.process.pid: Newly mapped `pid`, `process_pid` raw log field with `event.idm.read_only_udm.principal.process.pid` UDM field. - event.idm.read_only_udm.principal.application: Newly mapped `application` raw log field with `event.idm.read_only_udm.principal.application` UDM field. - event.idm.read_only_udm.network.session_duration.seconds: Newly mapped `request_time_seconds` raw log field with `event.idm.read_only_udm.network.session_duration.seconds` UDM field. - event.idm.read_only_udm.network.session_duration.nanos: Newly mapped `request_time_nanos` raw log field with `event.idm.read_only_udm.network.session_duration.nanos` UDM field. - event.idm.read_only_udm.network.http.response_code: Newly mapped `status` raw log field with `event.idm.read_only_udm.network.http.response_code` UDM field. - event.idm.read_only_udm.network.http.method: Newly mapped `http_method` raw log field with `event.idm.read_only_udm.network.http.method` UDM field. - event.idm.read_only_udm.target.url: Newly mapped `target_url` raw log field with `event.idm.read_only_udm.target.url` UDM field. - event.idm.read_only_udm.network.email.mail_id: Newly mapped `msgid` raw log field with `event.idm.read_only_udm.network.email.mail_id` UDM field. - event.idm.read_only_udm.network.application_protocol: Newly mapped `app_protocol_output`, `http_version` raw log field with `event.idm.read_only_udm.network.application_protocol` UDM field. - event.idm.read_only_udm.network.application_protocol_version: Newly mapped `method_version` raw log field with `event.idm.read_only_udm.network.application_protocol_version` UDM field. - event.idm.read_only_udm.network.sent_bytes: Newly mapped `bytes_sent` raw log field with `event.idm.read_only_udm.network.sent_bytes` UDM field. - event.idm.read_only_udm.network.received_bytes: Newly mapped `request_length` raw log field with `event.idm.read_only_udm.network.received_bytes` UDM field. - event.idm.read_only_udm.network.http.referral_url: Newly mapped `http_referer_filtered` raw log field with `event.idm.read_only_udm.network.http.referral_url` UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped `remote_addr`, `user_ip` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped `remote_addr`, `user_ip` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `context`, `data.reference_id`, `id` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - event.idm.read_only_udm.principal.user.userid: Newly mapped `remote_user`, `from`, `user_id` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - event.idm.read_only_udm.target.user.userid: Newly mapped `to` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field. - event.idm.read_only_udm.target.file.full_path: Newly mapped `data_file_path`, `data_file` raw log field with `event.idm.read_only_udm.target.file.full_path` UDM field. - event.idm.read_only_udm.target.file.size: Newly mapped `data_file_size` raw log field with `event.idm.read_only_udm.target.file.size` UDM field. - event.idm.read_only_udm.target.file.mime_type: Newly mapped `data_file_mime` raw log field with `event.idm.read_only_udm.target.file.mime_type` UDM field. - event.idm.read_only_udm.target.file.md5: Newly mapped `data_file_hash` raw log field with `event.idm.read_only_udm.target.file.md5` UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `hash_label` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.hostname: Newly mapped `url_host` raw log field with `event.idm.read_only_udm.principal.hostname` UDM field. - event.idm.read_only_udm.network.session_id: Newly mapped `session`, `data.session` raw log field with `event.idm.read_only_udm.network.session_id` UDM field. - event.idm.read_only_udm.target.resource.product_object_id: Newly mapped `data_file_id` raw log field with `event.idm.read_only_udm.target.resource.product_object_id` UDM field. - event.idm.read_only_udm.target.file.names: Newly mapped `data_file_name` raw log field with `event.idm.read_only_udm.target.file.names` UDM field. - event.idm.read_only_udm.network.tls.cipher: Newly mapped `cipher` raw log field with `event.idm.read_only_udm.network.tls.cipher` UDM field. - event.idm.read_only_udm.security_result.category_details: Newly mapped `event_data` field with `event.idm.read_only_udm.security_result.category_details` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped agent.id`,`agent.name`,`decoder.name`,`rule.main`,`request_filtered_label`, `groups_label`, `http_x_forwarded_for`, `msec`, `body_bytes_sent`, `queue_id`, `size`, `class`, `nrcpts`, `dsn`, `ctladdr`, `xdelay`, `mailer`, `pri`, `delay`, `data.file.file_id`, `tenant_id`, `user_type`, `client_device`, `flag`, `data.file.file_uploader.profile.id`, `data.file.file_uploader.profile.name`, `data.is_folder_upload`, `data.context`, `data.geolocation_source.source`, `data.geolocation_source.source_with_kw`, `data.file.file_uploader.guid`, `daemon`, `verify`, `bits`, `STARTTLS`, `ec_object_id`, `rule.firedtimes`, `location`, `data.file.version`, `data.file.ec_object_id`, `data.parent_folder.path`, and `data.parent_folder.ec_source` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.network.tls.version: Newly mapped `version` raw log field with `event.idm.read_only_udm.network.tls.version` UDM field. - event.idm.read_only_udm.intermediary: Newly mapped `intermediary1`, `intermediary` raw log field with `event.idm.read_only_udm.intermediary` UDM field. - event.idm.read_only_udm.about: Newly mapped `about` raw log field with `event.idm.read_only_udm.about` UDM field. - event.idm.read_only_udm.principal.user.user_display_name: Newly mapped `user_name` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field. - event.idm.read_only_udm.principal.hostname: Newly mapped `manager.name` raw log field with `event.idm.read_only_udm.principal.hostname` UDM field. - event.idm.read_only_udm.metadata.event_type: If has_principal is "true" and has_target is "true" and has_target_file is "true", updated to FILE_CREATION. - event.idm.read_only_udm.metadata.event_type: If has_principal is "true" and has_target is "true" and app_protocol_output matches "HTTP", updated to NETWORK_HTTP. - event.idm.read_only_udm.metadata.event_type: If has_principal is "true" and has_target is "true", updated to NETWORK_CONNECTION. - event.idm.read_only_udm.metadata.event_type: If has_principal_user is "true", updated to USER_UNCATEGORIZED.
2023-11-10	- Newly created parser.