Change log for SERVICENOW_SECURITY

Date	Changes
2026-04-30	Enhancement: - `event1.idm.read_only_udm.metadata.event_timestamp`: Mapped `timestamp` raw log field with `event1.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event1.idm.read_only_udm.metadata.product_log_id`: Mapped `data.sys_id` raw log field with `event1.idm.read_only_udm.metadata.product_log_id` UDM field. - `event1.idm.read_only_udm.metadata.description`: Mapped `data.message_data` raw log field with `event1.idm.read_only_udm.metadata.description` UDM field. - `event1.idm.read_only_udm.principal.resource.name`: Mapped `data.source` raw log field with `event1.idm.read_only_udm.principal.resource.name` UDM field. - `event1.idm.read_only_udm.additional.fields`: Mapped `source` raw log field with `event1.idm.read_only_udm.additional.fields` UDM field. - `event1.idm.read_only_udm.metadata.collected_timestamp`: Mapped `data.sys_created_on` raw log field with `event1.idm.read_only_udm.metadata.collected_timestamp` UDM field. - `event1.idm.read_only_udm.principal.user.userid`: Mapped `data.sys_created_by`, `data.user` raw log field with `event1.idm.read_only_udm.principal.user.userid` UDM field. - `event1.idm.read_only_udm.principal.namespace`: Mapped `source_instance` raw log field with `event1.idm.read_only_udm.principal.namespace` UDM field. - `event1.idm.read_only_udm.target.resource.attribute.roles`: Mapped `data.role` raw log field with `event1.idm.read_only_udm.target.resource.attribute.roles` UDM field. - `event1.idm.read_only_udm.target.user.userid`: Mapped `data.granted_by` raw log field with `event1.idm.read_only_udm.target.user.userid` UDM field. - `event1.idm.read_only_udm.security_result.severity`: Mapped `data.level` raw log field with `event1.idm.read_only_udm.security_result.severity` UDM field. - `event1.idm.read_only_udm.security_result.action_details`: Mapped `data.state` raw log field with `event1.idm.read_only_udm.security_result.action_details` UDM field. - `event1.idm.read_only_udm.metadata.event_type`: Updated the condition to set `event1.idm.read_only_udm.metadata.event_type` to `USER_UNCATEGORIZED` when `principal user` data is present else mapped to `GENERIC_EVENT`.

Date

Changes

2026-04-30

Enhancement:
- `event1.idm.read_only_udm.metadata.event_timestamp`: Mapped `timestamp` raw log field with `event1.idm.read_only_udm.metadata.event_timestamp` UDM field.
- `event1.idm.read_only_udm.metadata.product_log_id`: Mapped `data.sys_id` raw log field with `event1.idm.read_only_udm.metadata.product_log_id` UDM field.
- `event1.idm.read_only_udm.metadata.description`: Mapped `data.message_data` raw log field with `event1.idm.read_only_udm.metadata.description` UDM field.
- `event1.idm.read_only_udm.principal.resource.name`: Mapped `data.source` raw log field with `event1.idm.read_only_udm.principal.resource.name` UDM field.
- `event1.idm.read_only_udm.additional.fields`: Mapped `source` raw log field with `event1.idm.read_only_udm.additional.fields` UDM field.
- `event1.idm.read_only_udm.metadata.collected_timestamp`: Mapped `data.sys_created_on` raw log field with `event1.idm.read_only_udm.metadata.collected_timestamp` UDM field.
- `event1.idm.read_only_udm.principal.user.userid`: Mapped `data.sys_created_by`, `data.user` raw log field with `event1.idm.read_only_udm.principal.user.userid` UDM field.
- `event1.idm.read_only_udm.principal.namespace`: Mapped `source_instance` raw log field with `event1.idm.read_only_udm.principal.namespace` UDM field.
- `event1.idm.read_only_udm.target.resource.attribute.roles`: Mapped `data.role` raw log field with `event1.idm.read_only_udm.target.resource.attribute.roles` UDM field.
- `event1.idm.read_only_udm.target.user.userid`: Mapped `data.granted_by` raw log field with `event1.idm.read_only_udm.target.user.userid` UDM field.
- `event1.idm.read_only_udm.security_result.severity`: Mapped `data.level` raw log field with `event1.idm.read_only_udm.security_result.severity` UDM field.
- `event1.idm.read_only_udm.security_result.action_details`: Mapped `data.state` raw log field with `event1.idm.read_only_udm.security_result.action_details` UDM field.
- `event1.idm.read_only_udm.metadata.event_type`: Updated the condition to set `event1.idm.read_only_udm.metadata.event_type` to `USER_UNCATEGORIZED` when `principal user` data is present else mapped to `GENERIC_EVENT`.