Change log for ZYWALL

Date	Changes
2025-12-08	- event.idm.read_only_udm.security_result.action: Newly mapped action raw log field(s) with event.idm.read_only_udm.security_result.action UDM field. - Updated conditional logic for the action field to include pass alongside ACCEPT to map to ALLOW. - The intermediate field security_result_action has been replaced with security_action before mapping to the final UDM field. - Removed logic that directly extracted the action field from the msg field. - Removed a condition that set the action field to ACCEPT based on a pattern match in the msg field.
2025-11-18	- event.idm.read_only_udm.additional.fields: Newly mapped app, cef_event_class_id, cef_spec_version, and proto raw log field(s) with event.idm.read_only_udm.additional.fields UDM field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped cef_name raw log field(s) with event.idm.read_only_udm.metadata.product_event_type UDM field. - event.idm.read_only_udm.metadata.product_version: Newly mapped cef_device_version raw log field(s) with event.idm.read_only_udm.metadata.product_version UDM field. - event.idm.read_only_udm.network.sent_bytes: Newly mapped ob raw log field(s) with event.idm.read_only_udm.network.sent_bytes UDM field. - event.idm.read_only_udm.principal.user.userid: Newly mapped user raw log field(s) with event.idm.read_only_udm.principal.user.userid UDM field. - event.idm.read_only_udm.security_result.severity: Newly mapped cef_severity raw log field(s) with event.idm.read_only_udm.security_result.severity UDM field. - event.idm.read_only_udm.security_result.severity_details: Newly mapped ZYlevel raw log field(s) with event.idm.read_only_udm.security_result.severity_details UDM field. - event.idm.read_only_udm.target.asset.hostname: Newly mapped dvchost raw log field(s) with event.idm.read_only_udm.target.asset.hostname UDM field. - event.idm.read_only_udm.target.hostname: Newly mapped dvchost raw log field(s) with event.idm.read_only_udm.target.hostname UDM field. - event.idm.read_only_udm.metadata.product_name: Newly mapped cef_product with event.idm.read_only_udm.metadata.product_name UDM field. - event.idm.read_only_udm.metadata.vendor_name: Newly mapped cef_vendor with event.idm.read_only_udm.metadata.vendor_name UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped src with event.idm.read_only_udm.principal.asset.ip UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped src with event.idm.read_only_udm.principal.ip UDM field. - event.idm.read_only_udm.principal.port: Newly mapped spt with event.idm.read_only_udm.principal.port UDM field. - event.idm.read_only_udm.target.asset.ip: Newly mapped dst with event.idm.read_only_udm.target.asset.ip UDM field. - event.idm.read_only_udm.target.ip: Newly mapped dst with event.idm.read_only_udm.target.ip UDM field. - event.idm.read_only_udm.target.port: Newly mapped dpt with event.idm.read_only_udm.target.port UDM field. - Renamed from ZYnote to note. - Renamed from act to action. - Renamed from ZYclass to class. - Renamed from ZYruleId to rule_name. - Added conditional check for message to support CEF formatted logs.
2024-08-29	- Newly created parser.