Change log for ONEIDENTITY_TPAM
| Date | Changes |
|---|---|
| 2025-12-23 |
Enhancement: - Added a new grok pattern to parse new format of logs. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped timestamp raw log field with event.idm.read_only_udm.metadata.event_timestamp UDM field.- event.idm.read_only_udm.additional.fields: Newly mapped cn2, cn3 raw log fields with event.idm.read_only_udm.additional.fields UDM field.- event.idm.read_only_udm.intermediary.ip and event.idm.read_only_udm.intermediary.hostname: Setting event.idm.read_only_udm.intermediary.ip UDM field if intermediary_data raw log field is IP else setting intermediary_data raw log field to event.idm.read_only_udm.intermediary.hostname UDM field.
|
| 2025-04-10 |
- event.idm.read_only_udm.metadata.product_event_type: Mapped eventid along with logmsg raw log fields with event.idm.read_only_udm.metadata.product_event_type UDM field.- Added gsubs in order to handle event.idm.read_only_udm.additional.fields for new format of kv logs.
|
| 2025-03-11 |
- Mapped logtype to metadata.vendor_name- Mapped logmessage to metadata.product_name- Mapped version to metadata.product_version- Mapped logmsg to metadata.product_event_type- Mapped hostname to principal.hostname and principal.asset.hostname- Mapped groupName to principal.group.group_display_name- Mapped duid to target.user.userid- Mapped duser to target.user.user_display_name- Mapped msg to metadata.description- Mapped destinationDnsDomain to target.domain.name- Mapped requestUrl to target.url- Mapped reason to security_result.summary- Mapped cn1 to target.resource.product_object_id- Mapped cs1 to principal.user.attribute.roles- Mapped cs2, cs3, cs4, cs5, cs6 to additional.fields- Mapped deviceCustomDate1 to security_result.detection_fields
|