We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for MICROSTRATEGY

Date Changes

2025-03-21 Newly created parser.
Mapped the following fields:
- Mapped Event_start to metadata.event_timestamp.
- Mapped Hostname to principal.hostname, principal.asset.hostname
- Mapped Source_host to src.hostname, src.asset.hostname
- Mapped Source_server to principal.application
- Mapped PID to target.process.pid
- Mapped Thread_ID to target.resource.attribute.labels
- Mapped level to principal.platform_patch_level
- Mapped Log_level to security_result.detection_fields
- Mapped UID to target.user.userid
- Mapped SID to target.resource.attribute.labels
- Mapped OID to target.resource.id
- Mapped module to target.application
- Mapped method to target.resource.attribute.labels
- Mapped Authentication_message to metadata.description
- Mapped id to principal.user.userid
- Mapped server_ip to principal.ip, principal.asset.ip
- Mapped client_ip to target.ip, target.asset.ip
- Mapped Account_Name to principal.user.user_display_name
- Mapped Account_Login to principal.user.userid
- Mapped Account_Creation_Timestamp to event.idm.read_only_udm.additional.fields
- Mapped Account_Modification_Timestamp to event.idm.read_only_udm.additional.fields
- Mapped Account_Status_DESC to target.resource.attribute.labels
- Mapped Object_Owner_Name to target.resource.name
- Mapped User_Group_Name to principal.user.group_identifiers
- Mapped User to principal.user.user_display_name
- Mapped user to target.user.user_display_name
- Mapped Account to principal.user.userid
- Mapped Session to network.session_id
- Mapped Timestamp to event.idm.read_only_udm.additional.fields
- Mapped MICROSTRATEGY to metadata.vendor_name and metadata.product_name

Date	Changes
2025-03-21	Newly created parser. Mapped the following fields: - Mapped `Event_start` to `metadata.event_timestamp`. - Mapped `Hostname` to `principal.hostname, principal.asset.hostname` - Mapped `Source_host` to `src.hostname, src.asset.hostname` - Mapped `Source_server` to `principal.application` - Mapped `PID` to `target.process.pid` - Mapped `Thread_ID` to `target.resource.attribute.labels` - Mapped `level` to `principal.platform_patch_level` - Mapped `Log_level` to `security_result.detection_fields` - Mapped `UID` to `target.user.userid` - Mapped `SID` to `target.resource.attribute.labels` - Mapped `OID` to `target.resource.id` - Mapped `module` to `target.application` - Mapped `method` to `target.resource.attribute.labels` - Mapped `Authentication_message` to `metadata.description` - Mapped `id` to `principal.user.userid` - Mapped `server_ip` to `principal.ip, principal.asset.ip` - Mapped `client_ip` to `target.ip, target.asset.ip` - Mapped `Account_Name` to `principal.user.user_display_name` - Mapped `Account_Login` to `principal.user.userid` - Mapped `Account_Creation_Timestamp` to `event.idm.read_only_udm.additional.fields` - Mapped `Account_Modification_Timestamp` to `event.idm.read_only_udm.additional.fields` - Mapped `Account_Status_DESC` to `target.resource.attribute.labels` - Mapped `Object_Owner_Name` to `target.resource.name` - Mapped `User_Group_Name` to `principal.user.group_identifiers` - Mapped `User` to `principal.user.user_display_name` - Mapped `user` to `target.user.user_display_name` - Mapped `Account` to `principal.user.userid` - Mapped `Session` to `network.session_id` - Mapped `Timestamp` to `event.idm.read_only_udm.additional.fields` - Mapped `MICROSTRATEGY` to `metadata.vendor_name` and `metadata.product_name`