We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for SHAREPOINT

Date Changes

2025-03-15 Newly created parser.
Mapped the following fields:
- database to principal.process.file.names
- SamAccountName to principal.hostname and principal.asset.hostname
- UserName to principal.user.user_display_name
- UserEmail to principal.user.email_addresses
- ItemType to target.resource.type
- EventType to security_result.description
- Directory to target.file.full_path
- Leaf to target.file.names
- EventData to metadata.product_version
- Created to principal.asset.attribute.labels
- LastModified to principal.asset.attribute.labels
- SecGroupName to target.user.group_identifiers
- SecSamAccountName to target.user.userid
- SecUserName to target.user.user_display_name
- SecUserEmail to target.user.email_addresses
- SecUserRole to target.user.attribute.roles
- SecUserURL to target.url
- SourceModuleName to metadata.product_version
- SourceModuleType to metadata.product_event_type
- SHAREPOINT to metadata.vendor_name and metadata.product_name

Date	Changes
2025-03-15	Newly created parser. Mapped the following fields: - `database` to `principal.process.file.names` - `SamAccountName` to `principal.hostname` and `principal.asset.hostname` - `UserName` to `principal.user.user_display_name` - `UserEmail` to `principal.user.email_addresses` - `ItemType` to `target.resource.type` - `EventType` to `security_result.description` - `Directory` to `target.file.full_path` - `Leaf` to `target.file.names` - `EventData` to `metadata.product_version` - `Created` to `principal.asset.attribute.labels` - `LastModified` to `principal.asset.attribute.labels` - `SecGroupName` to `target.user.group_identifiers` - `SecSamAccountName` to `target.user.userid` - `SecUserName` to `target.user.user_display_name` - `SecUserEmail` to `target.user.email_addresses` - `SecUserRole` to `target.user.attribute.roles` - `SecUserURL` to `target.url` - `SourceModuleName` to `metadata.product_version` - `SourceModuleType` to `metadata.product_event_type` - `SHAREPOINT` to `metadata.vendor_name` and `metadata.product_name`