We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for CYBERARK_PTA

Date	Changes
2026-05-28	Enhancement: - Added grok pattern to support LEEF log format. - `event.idm.read_only_udm.metadata.id`: Newly mapped `leef_eventid` raw log field with `event.idm.read_only_udm.metadata.id` UDM field. - `event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `eventID` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - `event.idm.read_only_udm.metadata.product_version`: Newly mapped `leef_version` raw log fields with `event.idm.read_only_udm.metadata.product_version` UDM field. - `event.idm.read_only_udm.metadata.vendor_name`: Newly mapped `vendor_data` raw log field with `event.idm.read_only_udm.metadata.vendor_name` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `timestamp` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `devTime` raw log field with `event.idm.read_only_udm.metadata.collected_timestamp` UDM field. - `event.idm.read_only_udm.principal.user.user_display_name`: Newly mapped `suser` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field. - `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `src` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - `event.idm.read_only_udm.principal.ip`: Newly mapped `src` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - `event.idm.read_only_udm.target.user.userid`: Newly mapped `usrName` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field. - `event.idm.read_only_udm.target.asset.ip`: Newly mapped `dst` raw log field with `event.idm.read_only_udm.target.asset.ip` UDM field. - `event.idm.read_only_udm.target.ip`: Newly mapped `dst` raw log field with `event.idm.read_only_udm.target.ip` UDM field. - `event.idm.read_only_udm.intermediary.asset.ip`: Newly mapped `inter_ip` raw log field with `event.idm.read_only_udm.intermediary.asset.ip` UDM field. - `event.idm.read_only_udm.intermediary.ip`: Newly mapped `inter_ip` raw log field with `event.idm.read_only_udm.intermediary.ip` UDM field. - `event.idm.read_only_udm.about.url`: Newly mapped `externalLink` raw log field with `event.idm.read_only_udm.about.url` UDM field. - `event.idm.read_only_udm.security_result.category_details`: Newly mapped `Cat` raw log field with `event.idm.read_only_udm.security_result.category_details` UDM field. - `event.idm.read_only_udm.security_result.description`: Newly mapped `suspiciousSessionActivity` raw log field with `event.idm.read_only_udm.security_result.description` UDM field. - `event.idm.read_only_udm.security_result.severity`: Newly mapped `sev` raw log field with `event.idm.read_only_udm.security_result.severity` UDM field. - `event.idm.read_only_udm.security_result.severity_details`: Newly mapped `sev` raw log field with `event.idm.read_only_udm.security_result.severity_details` UDM field. - `event.idm.read_only_udm.security_result.url_back_to_product`: Newly mapped `ptaLink` raw log field with `event.idm.read_only_udm.security_result.url_back_to_product` UDM field. - `event.idm.read_only_udm.additional.fields`: Newly mapped `externalLinkLabel`, `suspiciousSessionActivityLabel`, `eventIdLabel`, `linkLabel`, `suserLabel`, `extraDataLabel`, `extraData`,`prod_version` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field. - `event.idm.read_only_udm.metadata.event_type`: Updated the `event.idm.read_only_udm.metadata.event_type` to `NETWORK_CONNECTION` and `USER_UNCATEGORIZED` when necessary raw log fields are present.
2024-08-13	Newly created parser.

Date

Changes

2026-05-28

Enhancement:
- Added grok pattern to support LEEF log format.
- `event.idm.read_only_udm.metadata.id`: Newly mapped `leef_eventid` raw log field with `event.idm.read_only_udm.metadata.id` UDM field.
- `event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `eventID` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field.
- `event.idm.read_only_udm.metadata.product_version`: Newly mapped `leef_version` raw log fields with `event.idm.read_only_udm.metadata.product_version` UDM field.
- `event.idm.read_only_udm.metadata.vendor_name`: Newly mapped `vendor_data` raw log field with `event.idm.read_only_udm.metadata.vendor_name` UDM field.
- `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `timestamp` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field.
- `event.idm.read_only_udm.metadata.collected_timestamp`: Newly mapped `devTime` raw log field with `event.idm.read_only_udm.metadata.collected_timestamp` UDM field.
- `event.idm.read_only_udm.principal.user.user_display_name`: Newly mapped `suser` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field.
- `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `src` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field.
- `event.idm.read_only_udm.principal.ip`: Newly mapped `src` raw log field with `event.idm.read_only_udm.principal.ip` UDM field.
- `event.idm.read_only_udm.target.user.userid`: Newly mapped `usrName` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field.
- `event.idm.read_only_udm.target.asset.ip`: Newly mapped `dst` raw log field with `event.idm.read_only_udm.target.asset.ip` UDM field.
- `event.idm.read_only_udm.target.ip`: Newly mapped `dst` raw log field with `event.idm.read_only_udm.target.ip` UDM field.
- `event.idm.read_only_udm.intermediary.asset.ip`: Newly mapped `inter_ip` raw log field with `event.idm.read_only_udm.intermediary.asset.ip` UDM field.
- `event.idm.read_only_udm.intermediary.ip`: Newly mapped `inter_ip` raw log field with `event.idm.read_only_udm.intermediary.ip` UDM field.
- `event.idm.read_only_udm.about.url`: Newly mapped `externalLink` raw log field with `event.idm.read_only_udm.about.url` UDM field.
- `event.idm.read_only_udm.security_result.category_details`: Newly mapped `Cat` raw log field with `event.idm.read_only_udm.security_result.category_details` UDM field.
- `event.idm.read_only_udm.security_result.description`: Newly mapped `suspiciousSessionActivity` raw log field with `event.idm.read_only_udm.security_result.description` UDM field.
- `event.idm.read_only_udm.security_result.severity`: Newly mapped `sev` raw log field with `event.idm.read_only_udm.security_result.severity` UDM field.
- `event.idm.read_only_udm.security_result.severity_details`: Newly mapped `sev` raw log field with `event.idm.read_only_udm.security_result.severity_details` UDM field.
- `event.idm.read_only_udm.security_result.url_back_to_product`: Newly mapped `ptaLink` raw log field with `event.idm.read_only_udm.security_result.url_back_to_product` UDM field.
- `event.idm.read_only_udm.additional.fields`: Newly mapped `externalLinkLabel`, `suspiciousSessionActivityLabel`, `eventIdLabel`, `linkLabel`, `suserLabel`, `extraDataLabel`, `extraData`,`prod_version` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field.
- `event.idm.read_only_udm.metadata.event_type`: Updated the `event.idm.read_only_udm.metadata.event_type` to `NETWORK_CONNECTION` and `USER_UNCATEGORIZED` when necessary raw log fields are present.

2024-08-13

Newly created parser.