We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for NUTANIX_PRISM

Date	Changes
2025-12-30	Enhancement: - Added a grok patterns to parse the new log formats. - `event.idm.read_only_udm.intermediary.hostname`: Newly mapped `header_host` raw log field with `event.idm.read_only_udm.intermediary.hostname` UDM field. - `event.idm.read_only_udm.principal.application`: Newly mapped `application` raw log field with `event.idm.read_only_udm.principal.application` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `thread_name`, `line_number`, `vdisk_id`, `pam_module`, `pam_submodule` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.target.resource.attribute.labels`: Newly mapped `snapshot_chain_id`, `partition_id`, `block_number`, `transaction_id` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `replica_ip` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field. - `event.idm.read_only_udm.metadata.description`: Newly mapped `description` raw log field with `event.idm.read_only_udm.metadata.description` UDM field. - `event.idm.read_only_udm.metadata.product_event_type`: Newly mapped `operation` raw log field with `event.idm.read_only_udm.metadata.product_event_type UDM field. - `event.idm.read_only_udm.target.user.userid`: Newly mapped `pam_target_user` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `pam_principal_uid` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.metadata.product_event_type`: Newly mapped `pam_message` raw log field with `event.idm.read_only_udm.metadata.product_event_type` UDM field.
2025-12-10	Enhancement: - event.idm.read_only_udm.principal.process.pid: Newly mapped `princ_pid` raw log field with `event.idm.read_only_udm.principal.process.pid` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `vblocks`, `nutanix_scan_keys`, `curr_range_idx`, `creation_time_usecs`, `total_rpcs_done`, `total_rpc_time_usecs`, `last_rpc_time_usecs`, `total_rows_read`, `total_data_read_bytes`, `num_rpcs_before_stateful_scans_got_enabled`, `total_deserialization_time_usecs`, `prefetch_hits`, `total_scan_time`, `unprocessed_data_size`, `processed_data_size`, `prefetch_in_progress`, `deserialization_in_progress`, `prefetch_stopped`, `prefetch_error`, `done_callback_set`, `is_arena_enabled`, `use_chakrdb_backend`, `source_file` raw log field with event.idm.read_only_udm.additional.fields UDM field. - Added conditional check for `agent.type`. - Added conditional check for `agent.version`. - Added new timestamp formats yyyy-MM-ddTHH:mm:ss.SSSSSSZ and RFC 3339.
2024-02-21	Enhancement: - When `inner_message` is not empty and `not_json` is `true`, then set `audit_log` to `true` to support dropped JSON logs. - Aligned `principal.ip` and `principal.asset.ip` mappings. - Aligned `target.ip` and `target.asset.ip` mappings. - Aligned `principal.hostname` and `principal.asset.hostname` mappings. - When `network_set` is `false`, `has_principal` is `true`, `has_target` is `false` and `audit_log` is `false`, then set `metadata.event_type` to `STATUS_UPDATE`. - When `network_set` is `true`, `has_principal` is `true`, `has_target` is `false` and `audit_log` is `false`, then set `metadata.event_type` to `GENERIC_EVENT`.
2024-01-12	Enhancement: - Added support for new format of syslog logs. - Added a null conditional check before mapping `logstash.ingest.host` to `intermediary.hostname`. - Added a null conditional check before mapping `logstash.process.host` to `intermediary.hostname`. - Added a null conditional check before mapping `logstash.collect.host` to `observer.ip`.
2023-12-23	Enhancement: - Added support for new type of AUDIT logs. - Added new Grok patterns to parse SYSLOG+JSON logs. - Mapped `affectedEntityList` and `alertUid` to `security_result.detection_fields`. - Mapped `clientIp` and `params.requested_ip_address` to `principal.ip`. - Mapped `defaultMsg` to `metadata.description`. - Mapped `operationType` to `metadata.product_event_type`. - Mapped `originatingClusterUuid` and `sessionId` to `additional.fields`. - Mapped `params.mac_address` to `principal.mac`. - Mapped `uuid` to `metadata.product_log_id`. - Mapped `userName` to `principal.user.user_display_name`. - Mapped `params.vm_name` to `target.resource.name`.
2023-01-23	Enhancement: - Mapped `logstash.ingest.host` to `intermediary[0].hostname` instead of `observer.hostname`. - Mapped `logstash.collect.host` to `observer.ip`. - Added null check for `logstash.ingest.host`.