Change log for WORKDAY_AUDIT
| Date | Changes |
|---|---|
| 2025-12-17 | Enhancement:
- `event.idm.read_only_udm.about.resource.attribute.labels`: Removed mapping of `AuthenticationChannel` from `event.idm.read_only_udm.about.resource.attribute.labels` UDM field which was previously mapped to deprecated field `about.labels` and is now mapped to `additional.fields` since that is a more appropriate field. - Added conditional check for `AuthFailMessage`. |
| 2025-11-20 | Enhancement:
- event.idm.read_only_udm.target.application: Newly mapped `Worker` raw log field to `event.idm.read_only_udm.target.application`. - event.idm.read_only_udm.target.user.user_display_name: Newly mapped `target_name` raw log field to `event.idm.read_only_udm.target.user.user_display_name`. - event.idm.read_only_udm.about.labels: Removed mapping of `AuthenticationChannel` from `event.idm.read_only_udm.about.labels` as the `about.labels` UDM field is deprecated. - event.idm.read_only_udm.about.resource.attribute.labels: Newly mapped `AuthenticationChannel` raw log field to `event.idm.read_only_udm.about.resource.attribute.labels`. - Updated mapping for `event.idm.read_only_udm.security_result.action_details` from the static string "IsDeviceManaged" to the value of the `IsDeviceManaged` raw log field. |
| 2025-07-28 | Enhancement:
- Added grok patterns to parse unparsed logs. - event.idm.read_only_udm.network.session_id: Newly mapped `sessionid` raw log field with `event.idm.read_only_udm.network.session_id`. - event.idm.read_only_udm.principal.ip: Newly mapped `src_ip` raw log field with `event.idm.read_only_udm.principal.ip`. - event.idm.read_only_udm.principal.asset.ip: Newly mapped `src_ip` raw log field with `event.idm.read_only_udm.principal.asset.ip`. - Removed redundant mapping of `event.idm.read_only_udm.target.asset.hostname`. - event.idm.read_only_udm.network.http.response_code: Newly mapped `status_code` raw log field with `event.idm.read_only_udm.network.http.response_code`. - event.idm.read_only_udm.metadata.event_type: Set `event.idm.read_only_udm.metadata.event_type` to "STATUS_UPDATE" if src_ip is not empty. - event.idm.read_only_udm.metadata.event_type: Set `event.idm.read_only_udm.metadata.event_type` to "USER_UNCATEGORIZED" if primaryName is not empty. - event.idm.read_only_udm.additional.fields: Newly mapped `context`, `devicetype`, `browser`, `authmethod` raw log fields with `event.idm.read_only_udm.additional.fields`. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `date` raw log fields with `event.idm.read_only_udm.metadata.event_timestamp`. |
| 2025-01-30 | Enhancement:
- "about_*" fields are changed to avoid duplicate fields. - Removed the field "ClassOfInstance" field from "column8". - Mapped "column11" to "SecurityGroupModified". - Mapped "SecurityGroupModified" to "security_result.about.group.group_display_name". - Removed the field "ChangedRelationship" from "target.user.attributes.roles.name". - Removed the field "target.resource.attribute.labels.key/value" from "InstancesRemoved". |
| 2024-11-06 | Enhancement:
- Mapped "ClassOfInstance" to "metadata.description". - Mapped "ChangedRelationship" to "target.user.attribute.roles.name". - Mapped "InstancesRemoved" to "target.resource.attribute.labels". |
| 2024-10-04 | Enhancement:
- Modified the Grok patterns to parse the fields correctly. |
| 2023-12-08 | Newly created parser. |
| 2023-12-08 | Newly created parser. |