Change log for PROOFPOINT_CASB

Date	Changes
2026-01-16	Enhancement: - event.idm.read_only_udm.intermediary.process.pid: Newly mapped `event1.agent.pid` raw log field with `event.idm.read_only_udm.intermediary.process.pid` UDM field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped `event1.activity.primaryCategory` raw log field with `event.idm.read_only_udm.metadata.product_event_type` UDM field. - event.idm.read_only_udm.metadata.vendor_name: Newly mapped `event1.feed.vendor` raw log field with `event.idm.read_only_udm.metadata.vendor_name` UDM field. - event.idm.read_only_udm.metadata.product_name: Newly mapped `event1.feed.product` raw log field with `event.idm.read_only_udm.metadata.product_name` UDM field. - event.idm.read_only_udm.principal.user.email_addresses: Newly mapped `event1.user.email`, `event1.user.directory.manager.email` raw log fields with `event.idm.read_only_udm.principal.user.email_addresses` UDM field. - event.idm.read_only_udm.principal.user.user_display_name: Newly mapped `event1.user.displayName` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field. - event.idm.read_only_udm.metadata.description: Newly mapped `event1.user.directory.title` raw log field with `event.idm.read_only_udm.metadata.description` UDM field. - event.idm.read_only_udm.principal.user.group_identifiers: Newly mapped `event1.user.groups.name` raw log field with `event.idm.read_only_udm.principal.user.group_identifiers` UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped `event1.endpoint.net.interfaces.ip` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.application: Newly mapped `event1.process.application.name` raw log field with `event.idm.read_only_udm.principal.application` UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `resource.hashes.value` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - event.idm.read_only_udm.target.file.mime_type: Newly mapped `resource.contentType` raw log field with `event.idm.read_only_udm.target.file.mime_type` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `resource.hashes.value` raw log field with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.file.mime_type: Newly mapped `resource.contentType` raw log field with `event.idm.read_only_udm.principal.file.mime_type` UDM field. - event.idm.read_only_udm.principal.user.department: Newly mapped `event1.user.directory.department.name` raw log field with `event.idm.read_only_udm.principal.user.department` UDM field. - event.idm.read_only_udm.principal.user.company_name: Newly mapped `event1.user.directory.company.name` raw log field with `event.idm.read_only_udm.principal.user.company_name` UDM field. - event.idm.read_only_udm.target.url: Newly mapped `event1.site.url` raw log field with `event.idm.read_only_udm.target.url` UDM field. - event.idm.read_only_udm.security_result.category_details: Newly mapped `event1.site.categorization.details.categories.name` raw log field with `event.idm.read_only_udm.security_result.category_details` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `event1.components.policies.id`, `event1.activity.policies.id`, `event1.activity.signals.name`, `event1.intelligence.findings.kind`, `indicator.kind`, `indicator.id`, `indicator.name`, `indicator._collations.key_value`, `match.op`, `match.result.value`, `param.value`, `event1.annotations.workflow.state.disposition.status.id`, `event1.annotations.workflow.state.status`, `event1.incident.status`, `event1.site.categorization.details.status`, `event1.site.reputation.details.status`, `event1.incident.severity` raw log fields with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `device.attributes.key`, `device.attributes.value`, `device.attributes._collations.key_value`, `event1.site.reputation.level`, `event1.agent.kind`, `event1.activity.trigger`, `event1.endpoint.fqdn`, `event1.endpoint.os.name`, `event1.endpoint.alias`, `event1.user.directory.ou` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field.
2025-03-20	Enhancement: - Mapped "id" , "tenant_id" and "type" fields to "additional.fields". - Mapped "sub_type" to "target.resource.resource_subtype". - Mapped "severity" to "security_result.severity". - Mapped "description" to "security_result.description". - Mapped "title" to "metadata.description". - Mapped "threat" to "security_result.threat_name". - Mapped "sub_category" to "security_result.summary". - Mapped "category" to "security_result.category_details". - Mapped "classification id to "security_result.rule_id". - Mapped "ip_address" to "principal.ip". - Mapped "geo_location_latitude" to "principal.location.region_latitude". - Mapped "geo_location_longitude" to "principal.location.region_longitude". - Mapped "location" to "principal.location.name". - Mapped "user_agent" to "network.http.user_agent". - Mapped "full_name" to "principal.user.user_display_name". - Mapped "user_email" to "principal.user.email_addresses". - Mapped "user_id" to "principal.user.userid". - Mapped "event_id" to "metadata.product_log_id". - Mapped "cloud_services" to "target.application".
2025-03-14	Enhancement: - Added support for new format of JSON logs.
2024-09-07	- Newly created parser.