Change log for MICROSOFT_NPS

Date	Changes
2025-12-31	Enhancement: - Added support for JSON+CSV format logs. - "event.idm.read_only_udm.principal.hostname": Newly mapped "column1" raw log field with "event.idm.read_only_udm.principal.hostname" UDM field. - "event.idm.read_only_udm.metadata.product_name": Newly mapped "column2" raw log field with "event.idm.read_only_udm.metadata.product_name" UDM field. - "event.idm.read_only_udm.metadata.event_timestamp": Newly mapped "column3", "column4" raw log fields with "event.idm.read_only_udm.metadata.event_timestamp" UDM field. - "event.idm.read_only_udm.principal.labels.packet_type": Newly mapped "column5" raw log field with "event.idm.read_only_udm.principal.labels.packet_type" UDM field. - "event.idm.read_only_udm.principal.user.userid": Newly mapped "column6" raw log field with "event.idm.read_only_udm.principal.user.userid" UDM field. - "event.idm.read_only_udm.principal.labels.client_vendor": Newly mapped "column15" raw log field with "event.idm.read_only_udm.principal.labels.client_vendor" UDM field. - "event.idm.read_only_udm.principal.ip": Newly mapped "column16" raw log field with "event.idm.read_only_udm.principal.ip" UDM field. - "event.idm.read_only_udm.principal.asset.ip": Newly mapped "column16" raw log field with "event.idm.read_only_udm.principal.asset.ip" UDM field. - "event.idm.read_only_udm.intermediary.hostname": Newly mapped "column17" raw log field with "event.idm.read_only_udm.intermediary.hostname" UDM field. - "event.idm.read_only_udm.principal.labels.nas_port_type": Newly mapped "column20" raw log field with "event.idm.read_only_udm.principal.labels.nas_port_type" UDM field. - "event.idm.read_only_udm.principal.labels.reason_code": Newly mapped "column26" raw log field with "event.idm.read_only_udm.principal.labels.reason_code" UDM field. - "event.idm.read_only_udm.principal.labels.acct_status_type": Newly mapped "column32" raw log field with "event.idm.read_only_udm.principal.labels.acct_status_type" UDM field. - "event.idm.read_only_udm.network.session_id": Newly mapped "column36" raw log field with "event.idm.read_only_udm.network.session_id" UDM field. - "event.idm.read_only_udm.principal.labels.acct_authentic": Newly mapped "column37" raw log field with "event.idm.read_only_udm.principal.labels.acct_authentic" UDM field. - "event.idm.read_only_udm.security_result.summary": Newly mapped "column61" raw log field with "event.idm.read_only_udm.security_result.summary" UDM field. - "event.idm.read_only_udm.target.hostname": Newly mapped "column63" raw log field with "event.idm.read_only_udm.target.hostname" UDM field. - "event.idm.read_only_udm.target.asset.hostname": Newly mapped "column63" raw log field with "event.idm.read_only_udm.target.asset.hostname" UDM field. - "event.idm.read_only_udm.target.ip": Newly mapped "column64" raw log field with "event.idm.read_only_udm.target.ip" UDM field. - "event.idm.read_only_udm.target.asset.ip": Newly mapped "column64" raw log field with "event.idm.read_only_udm.target.asset.ip" UDM field. - "event.idm.read_only_udm.intermediary": Merged "intermediary" internal field to "event.idm.read_only_udm.intermediary" UDM field. - "TimeCreated": Combined "column3" and "column4" into "TimeCreated". - "TimeCreated": Converted type to "date" with error handling for "date_match_failed". - Initialized new internal fields: "is_csv", "csv_parse_failure", "intermediary", "RecordDate", "RecordTime", and "column1" through "column66". - Added "csv" filter to parse "_raw" field using comma as a separator. - Expanded "date" filter for "TimeCreated" to include "MM/dd/yyyy HH:mm:ss" format. - Updated XML parsing conditional logic to check for "Event" in "_raw" instead of "_raw" being non-empty.
2025-12-01	Enhancement: - Added support for JSON+XML format logs. - 'event.idm.read_only_udm.principal.hostname': Newly mapped 'Computer' raw log field with 'event.idm.read_only_udm.principal.hostname' UDM field. - 'event.idm.read_only_udm.principal.asset.hostname': Newly mapped 'Computer' raw log field with 'event.idm.read_only_udm.principal.asset.hostname' UDM field. - 'event.idm.read_only_udm.metadata.product_name': Newly mapped 'ProviderName' raw log field with 'event.idm.read_only_udm.metadata.product_name' UDM field. - 'event.idm.read_only_udm.principal.user.windows_sid': Newly mapped 'UserName' raw log field with 'event.idm.read_only_udm.principal.user.windows_sid' UDM field. - 'event.idm.read_only_udm.principal.user.userid': Newly mapped 'UserName' raw log field with 'event.idm.read_only_udm.principal.user.userid' UDM field. - 'event.idm.read_only_udm.principal.port': Newly mapped 'NAS_Port' raw log field with 'event.idm.read_only_udm.principal.port' UDM field. - 'event.idm.read_only_udm.network.session_id': Newly mapped 'Acct_Session_Id' raw log field with 'event.idm.read_only_udm.network.session_id' UDM field. - 'event.idm.read_only_udm.principal.ip': Newly mapped 'NAS_IP_Address' raw log field with 'event.idm.read_only_udm.principal.ip' UDM field. - 'event.idm.read_only_udm.principal.asset.ip': Newly mapped 'NAS_IP_Address' raw log field with 'event.idm.read_only_udm.principal.asset.ip' UDM field. - 'event.idm.read_only_udm.target.ip': Newly mapped 'Client_IP_Address' raw log field with 'event.idm.read_only_udm.target.ip' UDM field. - 'event.idm.read_only_udm.target.asset.ip': Newly mapped 'Client_IP_Address' raw log field with 'event.idm.read_only_udm.target.asset.ip' UDM field. - 'event.idm.read_only_udm.target.hostname': Newly mapped 'Client_Friendly_Name' raw log field with 'event.idm.read_only_udm.target.hostname' UDM field. - 'event.idm.read_only_udm.target.asset.hostname': Newly mapped 'Client_Friendly_Name' raw log field with 'event.idm.read_only_udm.target.asset.hostname' UDM field. - 'event.idm.read_only_udm.security_result.summary': Newly mapped 'Proxy_Policy_Name' raw log field with 'event.idm.read_only_udm.security_result.summary' UDM field. - 'event.idm.read_only_udm.principal.labels': Newly mapped 'NAS-Port-Type', 'Acct-Status-Type', 'Acct-Authentic', 'Client-Vendor', 'Packet-Type', 'Reason-Code' raw log fields with 'event.idm.read_only_udm.principal.labels' UDM field. - 'event.idm.read_only_udm.additional.fields': Newly mapped 'source', 'cribl_pipe' raw log fields with 'event.idm.read_only_udm.additional.fields' UDM field.
2024-07-24	Resolved flaky behavior.
2024-03-12	Newly created parser.