Change log for VMWARE_AVINETWORKS_IWAF

Date	Changes
2026-03-10	Enhancement: - event.idm.read_only_udm.intermediary.ip: Removed mapping of service_engine from event.idm.read_only_udm.intermediary.ip UDM field when service_engine is not an IP address. - event.idm.read_only_udm.intermediary.hostname: Mapped service_engine raw log field with event.idm.read_only_udm.intermediary.hostname UDM field. - event.idm.read_only_udm.metadata.log_type: Newly mapped VMWARE_AVINETWORKS_IWAF to event.idm.read_only_udm.metadata.log_type UDM field.
2026-02-19	Enhancement: - event.idm.read_only_udm.security_result.detection_fields: Newly mapped significant, udf, vcpu_id, rewritten_uri_path, compression_percentage, client_insights, max_ingress_latency_fe, avg_ingress_latency_fe, conn_est_time_fe, tenant_name raw log fields with event.idm.read_only_udm.security_result.detection_fields UDM field. - Modified the mapping logic for the service_engine raw log field: if service_engine is an IP address then maps to event.idm.read_only_udm.intermediary.ip else maps to event.idm.read_only_udm.intermediary.hostname UDM field. - Modified the mapping logic for the log_id_syslog raw log field: if log_id_syslog is not similar to NIL then maps to event.idm.read_only_udm.metadata.product_log_id. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped log_id raw log field with event.idm.read_only_udm.metadata.product_log_id UDM field. - event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip: Newly mapped source_ip raw log field with event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip UDM field. - Added a new grok pattern to parse new format of logs this is allowing the following UDM fields to be mapped correctly: - event.idm.read_only_udm.about.hostname - event.idm.read_only_udm.additional.fields - event.idm.read_only_udm.intermediary.port - event.idm.read_only_udm.network.http.method - event.idm.read_only_udm.network.http.referral_url - event.idm.read_only_udm.network.http.response_code - event.idm.read_only_udm.network.http.user_agent - event.idm.read_only_udm.network.received_bytes - event.idm.read_only_udm.network.sent_bytes - event.idm.read_only_udm.network.session_duration.seconds - event.idm.read_only_udm.observer.ip - event.idm.read_only_udm.principal.asset.ip - event.idm.read_only_udm.principal.ip - event.idm.read_only_udm.principal.port - event.idm.read_only_udm.security_result.description - event.idm.read_only_udm.target.asset.hostname - event.idm.read_only_udm.target.asset.ip - event.idm.read_only_udm.target.hostname - event.idm.read_only_udm.target.ip - event.idm.read_only_udm.target.port - event.idm.read_only_udm.target.resource.attribute.labels.key - event.idm.read_only_udm.target.resource.attribute.labels.value - event.idm.read_only_udm.target.url
2025-11-10	- event.idm.read_only_udm.observer.ip: Removed mapping of service_engine from event.idm.read_only_udm.observer.ip UDM field to better reflect the service engine role as an active component in the event path rather than a passive observer. - event.idm.read_only_udm.intermediary.ip: Newly mapped service_engine raw log field to the event.idm.read_only_udm.intermediary.ip UDM field. - event.idm.read_only_udm.metadata.product_name: Updated value from Vmware to AVI Load Balancer. - event.idm.read_only_udm.metadata.vendor_name: Updated value from Vmware Avinetworks iWAF to Vmware.
2025-10-16	- Modified the grok pattern to parse new log formats. - event.idm.read_only_udm.target.url: Newly mapped redirected_uri raw log field with event.idm.read_only_udm.target.url UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped server_side_redirect_uri, all_request_headers_accept_language, all_request_headers_cookie, all_response_headers_location, all_response_headers_x_frame_options, all_response_headers_content_length, headers_sent_to_server_x_forwarded_proto raw log fields with event.idm.read_only_udm.additional.fields UDM field.
2025-09-25	- Added a grok pattern to parse the logs. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped report_timestamp raw log field with event.idm.read_only_udm.metadata.event_timestamp UDM field. - event.idm.read_only_udm.target.hostname: Newly mapped vs_name_syslog raw log field with event.idm.read_only_udm.target.hostname UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped log_id_syslog raw log field with event.idm.read_only_udm.metadata.product_log_id UDM field. - event.idm.read_only_udm.principal.port: Newly mapped client_src_port raw log field with event.idm.read_only_udm.principal.port UDM field. - event.idm.read_only_udm.target.ip and event.idm.read_only_udm.target.asset.ip: Newly mapped vs_ip raw log field with event.idm.read_only_udm.target.ip and event.idm.read_only_udm.target.asset.ip UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped virtualservice, pool_name, pool raw log field with event.idm.read_only_udm.target.resource.attribute.labels UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped all_response_headers_date, all_response_headers_expires, rule_log.phase, rule_log.rule_id, rule_log.rule_group, rule_log.msg, rule_log_rule_name, tag, cacheable, persistent_session_id, uri_path, adf, server_rtt, server_response_length, server_response_code, compression, servers_tried, waf_log.latency_request_header_phase, response_content_type, response_time_first_byte, response_time_last_byte, http_version, request_headers, response_headers, request_id, value, ssl_session_id, ssl_version, ssl_cipher, host, server_response_time_first_byte, server_response_time_last_byte, server_ssl_session_id, server_connection_reused, waf_log.rules_configured, waf_log.rules_executed, waf_log.latency_request_body_phase, waf_log.latency_response_header_phase, waf_log.latency_response_body_phase, all_request_headers.pragma, all_request_headers.accept, all_request_headers.connection, all_request_headers.host, all_request_headers.iv-user, all_request_headers.referer, all_request_headers.via, all_request_headers.x-requestmanager-memo, all_request_headers.x-request-memo, all_request_headers.iv_server_name, all_request_headers.x-scan-memo, all_request_headers.x-wipp, all_response_headers_content_type, all_response_headers_transfer_encoding, all_response_headers_connection, all_response_headers_pscache_handler, all_response_headers_ignoreportalregisteredurl, all_response_headers_pscache_excludeparams, all_response_headers_portalcachecontent, all_response_headers_set_cookie, all_response_headers_pscache_control, all_response_headers_portalregisteredurl, all_response_headers_strict_transport_security, headers_sent_to_server_host, headers_sent_to_server_accept, headers_sent_to_server_iv_user, headers_sent_to_server_referer, headers_sent_to_server_user_agent,headers_sent_to_server_via, headers_sent_to_server_x_requestmanager_memo, headers_sent_to_server_x_request_memo, headers_sent_to_server_iv_server_name, headers_sent_to_server_x_scan_memo, headers_sent_to_server_x_wipp, headers_sent_to_server_pragma, headers_received_from_server_transfer_encoding, headers_received_from_server_content_type, headers_received_from_server_pscache_handler, headers_received_from_server_ignoreportalregisteredurl, headers_received_from_server_pscache_excludeparams, headers_received_from_server_portalcachecontent, headers_received_from_server_set_cookie, headers_received_from_server_pscache_control, headers_received_from_server_portalregisteredurl, headers_received_from_server_usesportalrelativeurl, matches.is_internal, matches.match_element, matches.match_value raw log field with event.idm.read_only_udm.additional.fields UDM field. - event.idm.read_only_udm.network.session_duration.seconds: Newly mapped client_rtt raw log field with event.idm.read_only_udm.network.session_duration.seconds UDM field. - event.idm.read_only_udm.network.http.user_agent: Newly mapped user_agent raw log field with event.idm.read_only_udm.network.http.user_agent UDM field. - event.idm.read_only_udm.network.http.method: Newly mapped method raw log field with event.idm.read_only_udm.network.http.method UDM field. - event.idm.read_only_udm.network.http.response_code: Newly mapped response_code raw log field with event.idm.read_only_udm.network.http.response_code UDM field. - event.idm.read_only_udm.network.sent_bytes: Newly mapped request_length raw log field with event.idm.read_only_udm.network.sent_bytes UDM field. - event.idm.read_only_udm.network.received_bytes: Newly mapped response_length raw log field with event.idm.read_only_udm.network.received_bytes UDM field. - event.idm.read_only_udm.security_result.description: Newly mapped request_state raw log field with event.idm.read_only_udm.security_result.description UDM field. - event.idm.read_only_udm.target.url: Newly mapped uri_query raw log field with event.idm.read_only_udm.target.url UDM field. - event.idm.read_only_udm.network.http.referral_url: Newly mapped referer raw log field with event.idm.read_only_udm.network.http.referral_url UDM field. - event.idm.read_only_udm.about.hostname: Newly mapped server_name raw log field with event.idm.read_only_udm.about.hostname UDM field. - event.idm.read_only_udm.intermediary.port: Newly mapped server_src_port raw log field with event.idm.read_only_udm.intermediary.port UDM field. - event.idm.read_only_udm.observer.ip: Newly mapped service_engine, server_conn_src_ip raw log field with event.idm.read_only_udm.observer.ip UDM field. - event.idm.read_only_udm.detection_fields: Newly mapped waf_log.status raw log field with event.idm.read_only_udm.detection_fields UDM field. - event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip: Newly mapped client_ip raw log field with event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip UDM field. - event.idm.read_only_udm.target.ip and event.idm.read_only_udm.target.asset.ip: Newly mapped server_ip raw log field with event.idm.read_only_udm.target.ip and event.idm.read_only_udm.target.asset.ip UDM field.
2025-01-31	- Newly created parser.