Change log for TANIUM_AUDIT

Date	Changes
2025-11-13	Enhancement: - event.idm.read_only_udm.target.resource.attribute.last_update_time: Removed mapping of modification_time from event.idm.read_only_udm.target.resource.attribute.last_update_time UDM field as modification_time represents the event's time, not a resource attribute. - event.idm.read_only_udm.metadata.event_timestamp: Mapped modification_time raw log field with event.idm.read_only_udm.metadata.event_timestamp UDM field. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped createdAt raw log field with event.idm.read_only_udm.metadata.event_timestamp UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped id raw log field with event.idm.read_only_udm.metadata.product_log_id UDM field. - event.idm.read_only_udm.principal.application: Newly mapped state.type raw log field with event.idm.read_only_udm.principal.application UDM field. - event.idm.read_only_udm.metadata.description: Newly mapped state.message raw log field with event.idm.read_only_udm.metadata.description UDM field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped state.legacyType raw log field with event.idm.read_only_udm.metadata.product_event_type UDM field. - event.idm.read_only_udm.principal.user.userid: Newly mapped userId raw log field with event.idm.read_only_udm.principal.user.userid UDM field. - event.idm.read_only_udm.security_result.action_details: Newly mapped action raw log field with event.idm.read_only_udm.security_result.action_details UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped table, username raw log field with event.idm.read_only_udm.principal.resource.attribute.labels UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped rowId, revision, state.count, updatedAt, personaId raw log field with event.idm.read_only_udm.additional.fields UDM field.
2024-05-16	Enhancement: - Added support for JSON logs. - Mapped object_id to target.resource.product_object_id. - Mapped object_name to target.resource.name. - Mapped audit_name to metadata.description. - Mapped creation_time to target.resource.attribute.creation_time. - Mapped modification_time to target.resource.attribute.last_update_time. - Mapped last_modified_by and modifier_user_id to principal.resource.attribute.labels. - Mapped User to principal.user.userid. - Mapped session_id to network.session_id. - Mapped authentication_type to principal.user.attribute.labels. - Mapped ip_address to principal.ip and principal.asset.ip. - Mapped audit_row_id, type, and audit_type to additional.fields. - Mapped type_name to metadata.product_event_type. - Mapped object_type_name to target.resource.attribute.labels.
2023-09-26	Enhancement: - Added on_error check for date filter. - Added a Grok pattern to support new log format. - Mapped Issuer, ActionName, PackageName, StartTime, Expiration, InsertTime and DistributeOver to additional.fields.
2022-06-08