Change log for SLACK_AUDIT
| Date | Changes |
|---|---|
| 2026-09-21 |
Enhancement: - event.idm.read_only_udm.principal.labels: Removed mappings of actor.type, details.previous_ip_address, and details.previous_ua raw log fields from event.idm.read_only_udm.principal.labels UDM field as the field is deprecated.- event.idm.read_only_udm.additional.fields: Mapped actor.type, details.previous_ip_address, and details.previous_ua raw log fields with event.idm.read_only_udm.additional.fields UDM field.- event.idm.read_only_udm.about.resource.id: Removed mapping of context.location.id raw log field from event.idm.read_only_udm.about.resource.id UDM field as the field is deprecated.- event.idm.read_only_udm.about.resource.product_object_id: Mapped context.location.id raw log field with event.idm.read_only_udm.about.resource.product_object_id UDM field.- event.idm.read_only_udm.additional.fields: Newly mapped details.action_timestamp raw log field with event.idm.read_only_udm.additional.fields UDM field.- event.idm.read_only_udm.security_result.detection_fields: Newly mapped details.ip_address_details raw log field with event.idm.read_only_udm.security_result.detection_fields UDM field.- event.idm.read_only_udm.principal.location.state and event.idm.read_only_udm.principal.location.country_or_region: Newly mapped details.location raw log field with event.idm.read_only_udm.principal.location.state and event.idm.read_only_udm.principal.location.country_or_region UDM fields.
|
| 2025-03-28 |
Enhancement: - The Gsub pattern was updated to \\r\\n from \r\n to fix the problem of rn being stripped from the generated output.- A conversion block was added to explicitly convert the details.type field to a string. - Mapped actor.user.id to principal.user.userid.- Mapped details.url_private to target.url.- Mapped details.shared_with.channel_id target.labels.- Mapped details.reason to security_result.description.- Mapped details.previous_ip_address to principal.labels.- Mapped details.previous_ua to principal.labels.
|
| 2023-10-27 |
Enhancement: - Mapped details.reason to security_result.description.
|
| 2022-08-03 |
Enhancement: - Modified mapping for prin_ip from principal.nat_ip to principal.ip.
|
| 2022-04-07 |
- Corrected mapping for product_object_id. - Corrected the user mappings for second log format. |