Change log for MARIA_DB
| Date | Changes |
|---|---|
| 2026-03-13 |
Enhancement: - event.idm.read_only_udm.principal.hostname: Removed mapping of column2 from event.idm.read_only_udm.principal.hostname and event.idm.read_only_udm.principal.asset.hostname UDM fields, mapped to more appropriate field.- event.idm.read_only_udm.intermediary.hostname: Mapped column2 raw log field with event.idm.read_only_udm.intermediary.hostname UDM field.- event.idm.read_only_udm.principal.hostname: Newly mapped column4 raw log field with event.idm.read_only_udm.principal.hostname and event.idm.read_only_udm.principal.asset.hostname UDM fields. Added a conditional check to map column4 to event.idm.read_only_udm.principal.hostname if it is not an IP address.
|
| 2026-02-18 |
Enhancement: - event.idm.read_only_udm.additional.fields: Newly mapped type_val, name_val, command_val, database, connection_id raw log fields with event.idm.read_only_udm.additional.fields UDM field.- event.idm.read_only_udm.metadata.description: Newly mapped status_message raw log fields with event.idm.read_only_udm.metadata.description UDM field.- event.idm.read_only_udm.metadata.event_timestamp: Newly mapped time_year, time_val raw log field with event.idm.read_only_udm.metadata.event_timestamp UDM field.- event.idm.read_only_udm.principal.process.file.full_path: Newly mapped program raw log field with event.idm.read_only_udm.principal.process.file.full_path UDM field.- event.idm.read_only_udm.principal.process.pid: Newly mapped process_id raw log field with event.idm.read_only_udm.principal.process.pid UDM field.- event.idm.read_only_udm.target.resource.product_object_id: Newly mapped server_uid raw log field with event.idm.read_only_udm.target.resource.product_object_id UDM field.- event.idm.read_only_udm.security_result.detection_fields: Newly mapped user_auth_status raw log field with event.idm.read_only_udm.security_result.detection_fields UDM field.- event.idm.read_only_udm.security_result.rule_id: Newly mapped rule_id raw log field with event.idm.read_only_udm.security_result.rule_id UDM field.- event.idm.read_only_udm.security_result.action_details: Newly mapped action raw log field with event.idm.read_only_udm.security_result.action_details UDM field.- event.idm.read_only_udm.target.file.full_path: Newly mapped file_path raw log field with event.idm.read_only_udm.target.file.full_path UDM field.- event.idm.read_only_udm.target.port: Newly mapped db_port raw log field with event.idm.read_only_udm.target.port UDM field.- event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped db_version raw log field with event.idm.read_only_udm.target.resource.attribute.labels UDM field.- event.idm.read_only_udm.target.resource.name: Newly mapped resource_name raw log field with event.idm.read_only_udm.target.resource.name UDM field.- event.idm.read_only_udm.target.url: Newly mapped managed_by raw log field with event.idm.read_only_udm.target.url UDM field.- event.idm.read_only_udm.security_result.severity: Set the value of event.idm.read_only_udm.security_result.severity UDM field to MEDIUM when log_level is warning and to INFORMATIONAL when log_level is note.- event.idm.read_only_udm.security_result.severity_details: Newly mapped log_level raw log field with event.idm.read_only_udm.security_result.severity_details UDM field.- Added new date formats to support for the event.idm.read_only_udm.metadata.event_timestamp.- Added the grok patterns to ensure inappropriate values are no longer being mapped to event.idm.read_only_udm.metadata.product_event_type, event.idm.read_only_udm.principal.hostname, event.idm.read_only_udm.principal.asset.hostname, event.idm.read_only_udm.principal.user.userid and event.idm.read_only_udm.metadata.event_timestamp.nanos UDM fields. Additionally, this is allowing the event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip UDM fields to be mapped correctly.
|
| 2024-12-03 |
- Added gsub to remove special characters from the CSV format logs.
|
| 2024-11-08 | - Added support for the CSV format logs. |
| 2024-07-07 | - Newly created parser. |