We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for MIMECAST_URL_LOGS

Date	Changes
2026-07-13	Enhancement: - Added support to parse multi event logs. - `event.idm.read_only_udm.additional.fields`: Newly mapped `record.mimecastEventType`, `record.emailPartsDescription`, `userAwarenessAction`, `actions`, `emailPartsDescription`, `mimecastEventType` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.network.email.to`: Added a gsub for existing mapping of `userEmailAddress` to parse `event.idm.read_only_udm.network.email.to` UDM field correctly. - `event.idm.read_only_udm.network.email.from`: Added a gsub for existing mapping of `fromUserEmailAddress` to parse `event.idm.read_only_udm.network.email.from` UDM field correctly. - `event.idm.read_only_udm.network.direction`: Newly mapped `route` and `record.route` raw log fields with `event.idm.read_only_udm.network.direction` UDM field. - `event.idm.read_only_udm.metadata.event_type`: If `record.userEmailAddress` and `record.fromUserEmailAddress` are present, updated the value of `event.idm.read_only_udm.metadata.event_type` to `EMAIL_TRANSACTION` else updated the value of `event.idm.read_only_udm.metadata.event_type` to `GENERIC_EVENT`.
2025-01-16	Enhancement: - Added support for unparsed logs.
2024-09-23	Enhancement: - When `action` is block then mapped `security_result.action` to `BLOCK`. - When `action` is warn then mapped action to `security_result.action_details`.
2024-06-12	- Newly created parser.