Change log for RUCKUS_WIRELESS

Date Changes
2025-10-31 - Added new Grok patterns to parse the unparsed logs.
- event.idm.read_only_udm.metadata.product_log_id: Newly mapped sequenceId raw log field with event.idm.read_only_udm.metadata.product_log_id UDM field.
- event.idm.read_only_udm.metadata.product_event_type: Newly mapped type raw log field with event.idm.read_only_udm.metadata.product_event_type UDM field.
- event.idm.read_only_udm.principal.user.userid: Newly mapped uid, p_user, prin_user, user raw log fields with event.idm.read_only_udm.principal.user.userid UDM field.
- event.idm.read_only_udm.principal.user.attribute.labels: Newly mapped auid, subj, p_uid raw log fields with event.idm.read_only_udm.principal.user.attribute.labels UDM field.
- event.idm.read_only_udm.principal.process.file.full_path: Newly mapped cwd raw log field with event.idm.read_only_udm.principal.process.file.full_path UDM field.
- event.idm.read_only_udm.target.user.userid: Newly mapped acct, t_user, user raw log fields with event.idm.read_only_udm.target.user.userid UDM field.
- event.idm.read_only_udm.target.user.attribute.labels: Newly mapped t_uid raw log field with event.idm.read_only_udm.target.user.attribute.labels UDM field.
- event.idm.read_only_udm.target.process.command_line: Newly mapped cmd, cmd_line raw log fields with event.idm.read_only_udm.target.process.command_line UDM field.
- event.idm.read_only_udm.target.process.file.full_path: Newly mapped exe raw log field with event.idm.read_only_udm.target.process.file.full_path UDM field.
- event.idm.read_only_udm.network.session_id: Newly mapped session_id raw log field with event.idm.read_only_udm.network.session_id UDM field.
- event.idm.read_only_udm.extensions.auth.auth_details: Newly mapped grantors, auth_method raw log fields with event.idm.read_only_udm.extensions.auth.auth_details UDM field.
- event.idm.read_only_udm.security_result.action: Statically mapped to ALLOW or BLOCK based on the value of the res field.
- event.idm.read_only_udm.extensions.auth.type: Statically mapped to AUTHTYPE_UNSPECIFIED for certain event types and messages.
- event.idm.read_only_udm.security_result.description: Mapped from pam_msg or audit_msg based on parsing success and description field.
- event.idm.read_only_udm.security_result.action_details: Mapped from the op field.
2024-07-02 - Added new Grok patterns to parse the unparsed logs.
- Mapped summary to security_result.description.
2023-01-06 Added new grok patterns to parse the unparsed logs.
2022-09-12 Newly created parser.