We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for MICROSOFT_SENTINEL

Date	Changes
2026-07-09	Enhancement: - `event.idm.read_only_udm.principal.labels`: Removed mapping of `AlertLink` from `event.idm.read_only_udm.principal.labels` UDM field since `AlertLink` is directly related to the security alert being reported. - `event.idm.read_only_udm.security_result.url_back_to_product`: Mapped `AlertLink` raw log field to `event.idm.read_only_udm.security_result.url_back_to_product` UDM field. - `event.idm.read_only_udm.security_result.rule_name`: Removed mapping of `AlertName` from `event.idm.read_only_udm.security_result.rule_name` UDM field as `AlertName` represents threat name. - `event.idm.read_only_udm.security_result.threat_name`: Mapped `AlertName` raw log field to `event.idm.read_only_udm.security_result.threat_name` UDM field. - `event.idm.read_only_udm.security_result.threat_name`: Removed mapping of `AlertType` from `event.idm.read_only_udm.security_result.threat_name` UDM field as `AlertType` represents rule name. - `event.idm.read_only_udm.security_result.rule_name`: Mapped `AlertType` raw log field to `event.idm.read_only_udm.security_result.rule_name` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Removed mapping of `DestinationDevice` from `event.idm.read_only_udm.security_result.detection_fields` UDM field as it represents destination device name. - `event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname`: Mapped `DestinationDevice` raw log field to `event.idm.read_only_udm.target.hostname` and `event.idm.read_only_udm.target.asset.hostname` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Removed mapping of `SensorId` from `event.idm.read_only_udm.security_result.detection_fields` UDM field as it represents observer device name. - `event.idm.read_only_udm.observer.hostname` and `event.idm.read_only_udm.observer.asset.hostname`: Mapped `SensorId` raw log field to `event.idm.read_only_udm.observer.hostname` and `event.idm.read_only_udm.observer.asset.hostname` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Removed mapping of `SourceDevice` from `event.idm.read_only_udm.security_result.detection_fields` UDM field as it represents source device name. - `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname`: Mapped `SourceDevice` raw log field to `event.idm.read_only_udm.principal.hostname` and `event.idm.read_only_udm.principal.asset.hostname` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `_TimeReceived`, `_IsBillable`, `_BilledSize`, `entity.id`, `Nic.IpAddress.id`, `Nic.id`, `entity.Protocols`, `entity.Owners`, `entity.IoTHub.id`, `SystemAlertId`, `TenantId`, `VendorOriginalId`, `_Internal_WorkspaceResourceId`, `_ItemId` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac`: Newly mapped `Nic.MacAddress` raw log field with `event.idm.read_only_udm.principal.mac` and `event.idm.read_only_udm.principal.asset.mac` UDM field. - `event.idm.read_only_udm.principal.resource.attribute.labels`: Newly mapped `entity.Manufacturer`,`entity.FirmwareVersion`, `entity.Model`, `entity.DeviceName`, `Nic.Type`, `Nic.IpAddress.Type`, `Nic.IpAddress.Address`, `entity.Vendor`, `entity.Type`, `entity.DeviceSubType`, `entity.DevicePageLink`, `entity.IsScanner`, `entity.IsAuthorized`, `entity.IsProgramming`, `entity.PurdueLayer`, `entity.Importance`, `entity.Sensor`, `entity.Zone`, `entity.Site`, `entity.DeviceTypeId`, `entity.DeviceType`, `entity.IoTSecurityAgentId`, `entity.Source`, `entity.DeviceId`, `entity.IoTHub.Type`, `entity.IoTHub.ResourceId` raw log fields with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.security_result.detection_fields`: Newly mapped `RemediationSteps`, `isNew`, `AlertManagementUri`, `S7Comm_Control_Function`, `ViolationCount`, `isLearnable` raw log fields with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - `event.idm.read_only_udm.metadata.event_type`: - Set `event.idm.read_only_udm.metadata.event_type` to `NETWORK_CONNECTION` when both principal machine and target machine data are present. - Set `event.idm.read_only_udm.metadata.event_type` to `USER_RESOURCE_ACCESS` when user and resource data are present.
2025-10-16	Enhancement: - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `eventUniqueId` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - event.idm.read_only_udm.security_result.summary: Newly mapped `object.properties.title` raw log field with `event.idm.read_only_udm.security_result.summary` UDM field. - event.idm.read_only_udm.security_result.category_details: Newly mapped `object.properties.labels.labelName` raw log field with `event.idm.read_only_udm.security_result.category_details` UDM field. - event.idm.read_only_udm.security_result.attack_details.techniques: Newly mapped `object.properties.additionalData.techniques` raw log field with `event.idm.read_only_udm.security_result.attack_details.techniques` UDM field. - event.idm.read_only_udm.security_result.attack_details.tactics: Newly mapped `object.properties.additionalData.tactics` raw log field with `event.idm.read_only_udm.security_result.attack_details.tactics` UDM field. - event.idm.read_only_udm.target.user.email_addresses: Newly mapped `object.properties.relatedEntities.properties.mailboxPrimaryAddress` raw log field with `event.idm.read_only_udm.target.user.email_addresses` UDM field. - event.idm.read_only_udm.network.email.to: Newly mapped `object.properties.relatedEntities.properties.recipient` raw log field with `event.idm.read_only_udm.network.email.to` UDM field. - event.idm.read_only_udm.network.email.from: Newly mapped `object.properties.relatedEntities.properties.p1Sender` raw log field with `event.idm.read_only_udm.network.email.from` UDM field. - event.idm.read_only_udm.target.user.userid: Newly mapped `object.properties.relatedEntities.properties.additionalData.UserPrincipalName` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped `object.properties.relatedEntities.properties.senderIP` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped `object.properties.relatedEntities.properties.senderIP` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - event.idm.read_only_udm.network.email.subject: Newly mapped `object.properties.relatedEntities.properties.subject` raw log field with `event.idm.read_only_udm.network.email.subject` UDM field. - event.idm.read_only_udm.target.administrative_domain: Newly mapped `object.properties.relatedEntities.properties.additionalData.DomainName` raw log field with `event.idm.read_only_udm.target.administrative_domain` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `object.properties.labels.labelType,` object.properties.additionalData.alertsCount, `object.properties.alerts.properties.systemAlertId,` object.properties.alerts.properties.alertDisplayName, `object.properties.alerts.properties.description,` object.properties.alerts.properties.severity, `object.properties.alerts.properties.alertType,` object.properties.alerts.properties.providerAlertId, `object.properties.alerts.properties.confidenceLevel,` object.properties.alerts.properties.endTimeUtc, `object.properties.alerts.properties.processingEndTime,` object.properties.alerts.properties.startTimeUtc, `object.properties.alerts.properties.timeGenerated,` object.properties.alerts.properties.friendlyName `raw log field with` event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `object.properties.additionalData.tactics,` object.properties.additionalData.alertProductNames, `object.properties.additionalData.bookmarksCount,` object.properties.additionalData.commentsCount, `object.properties.relatedEntities.properties.recipient,` object.properties.relatedEntities.properties.p1Sender, `object.properties.relatedEntities.properties.networkMessageId,` object.properties.relatedEntities.properties.internetMessageId, `object.properties.alerts.properties.alertLink,` object.properties.alerts.properties.vendorName, `object.properties.alerts.properties.productName` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.target.user.attribute.labels: Newly mapped `object.properties.relatedEntities.properties.additionalData.UserPrincipalName,` object.properties.relatedEntities.properties.upnSuffix, `object.properties.relatedEntities.properties.isDomainJoined,` object.properties.relatedEntities.properties.additionalData.AccountName, `object.properties.relatedEntities.properties.displayName,` object.properties.relatedEntities.properties.upn `raw log field with` event.idm.read_only_udm.target.user.attribute.labels` UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `object.properties.relatedEntities.properties.accountName,` object.properties.relatedEntities.properties.sid, `object.properties.relatedEntities.properties.aadUserId,` object.properties.relatedEntities.properties.additionalData.DomainName `raw log field with` event.idm.read_only_udm.target.resource.attribute.labels` UDM field.
2025-08-13	Enhancement: - Added support for parsing errors. - event.idm.read_only_udm.principal.hostname: Newly Mapped `entity_Hostname` raw log field with `event.idm.read_only_udm.principal.hostname` UDM field. - event.idm.read_only_udm.principal.asset.hostname: Newly Mapped `entity_Hostname` raw log field with `event.idm.read_only_udm.principal.asset.hostname` UDM field. - event.idm.read_only_udm.principal.ip: Newly Mapped `entity_SenderIP` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.ip: Newly Mapped `Client_IP_Address` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly Mapped `Client_IP_Address` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly Mapped `entity_SenderIP` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - event.idm.read_only_udm.principal.user.userid: Newly Mapped `entity_Name` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - event.idm.read_only_udm.principal.user.email_addresses: Newly Mapped `entity_DisplayName` raw log field with `event.idm.read_only_udm.principal.user.email_addresses` UDM field. - event.idm.read_only_udm.principal.user.product_object_id: Newly Mapped `entity_AadUserId` raw log field with `event.idm.read_only_udm.principal.user.product_object_id` UDM field. - event.idm.read_only_udm.principal.user.user_display_name: Newly Mapped `entity_UPNSuffix` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `Alert_generation_status` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `OriginalQuery` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `Query` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `SystemAlertId` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `Data_Sources` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `Correlation_Id` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `_Internal_WorkspaceResourceId` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `_ItemId` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly Mapped `Event_Grouping` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly Mapped `Query_End_Time_UTC` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly Mapped `Query_Start_Time_UTC` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly Mapped `Trigger_Threshold` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly Mapped `Trigger_Operator` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly Mapped `Search_Query_Results_Overall_Count` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly Mapped `Query_Period` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.security_result.rule_id: Newly Mapped `Analytic_Rule_Ids` raw log field with `event.idm.read_only_udm.security_result.rule_id` UDM field. - event.idm.read_only_udm.security_result.threat_name: Newly Mapped `AlertType` raw log field with `event.idm.read_only_udm.security_result.threat_name` UDM field. - event.idm.read_only_udm.principal.ip: Newly Mapped `Previous_IP_Address` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly Mapped `Previous_IP_Address` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - event.idm.read_only_udm.target.user.userid: Newly Mapped `Custom_Details` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field.
2025-02-03	Enhancement: - Added support for JSON logs.
2023-11-03	Enhancement: - Mapped `ResourceId` to `target.resource.name`. - When `ResourceId` is `not null` and event has one of `principal` or `target` as `not null`, then map `metadata.event_type` to `USER_RESOURCE_ACCESS`.
2023-08-31	- Newly created parser.