We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for GTB_DLP

Date	Changes
2026-05-07	Enhancement: - Added a grok pattern to parse the new format of logs. - Added a grok pattern on `kvData` to extract `Subject` as we have two `cs5` fields within kvData. - Modified the parsing of the `dhost` field to remove spaces before mapping to `event.idm.read_only_udm.network.email.to`. - `event.idm.read_only_udm.additional.fields`: Removed the mapping of `cs5` from `event.idm.read_only_udm.additional.fields` UDM field when `cs5Label` is `Subject` to map to more appropriate UDM field. - `event.idm.read_only_udm.network.email.subject`: Mapped `Subject` raw log field with `event.idm.read_only_udm.network.email.subject` UDM field. - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `cs7` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field when `cs7Label` is `IP Address`. - `event.idm.read_only_udm.target.application`: Newly mapped `cs8` raw log field with `event.idm.read_only_udm.target.application` UDM field when `cs8Label` is `Application`. - `event.idm.read_only_udm.principal.user.user_display_name`: Newly mapped `cs5` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field when `cs5Label` is `Login name`. - `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`: Newly mapped `cs14` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM field when `cs14Label` is `Destination IP`. - `event.idm.read_only_udm.target.url`: Newly mapped `cs15` raw log field with `event.idm.read_only_udm.target.url` UDM field when `cs15Label` is `URL`. - `event.idm.read_only_udm.additional.fields`: Newly mapped `cs14` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field when `cs14Label` is not `Destination IP`. - `event.idm.read_only_udm.additional.fields`: Newly mapped `cs15` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field when `cs15Label` is not `URL`. - `event.idm.read_only_udm.additional.fields`: Newly mapped `cs13` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field when `cs13` is not a valid ip address.
2025-10-28	- Newly created parser - event.idm.read_only_udm.network.application_protocol: Newly mapped `proto` raw log field with `event.idm.read_only_udm.network.application_protocol` UDM field. - event.idm.read_only_udm.network.email.to: Newly mapped `dhost` raw log field with `event.idm.read_only_udm.network.email.to` UDM field. - event.idm.read_only_udm.principal.user.userid: Newly mapped `suser`, `cs6` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - event.idm.read_only_udm.network.email.from: Newly mapped `shost` raw log field with `event.idm.read_only_udm.network.email.from` UDM field. - event.idm.read_only_udm.principal.user.user_display_name: Newly mapped `suser` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field. - event.idm.read_only_udm.principal.ip: Newly mapped `src`, `cs13` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - event.idm.read_only_udm.principal.asset.ip: Newly mapped `src`, `cs13` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - event.idm.read_only_udm.principal.port: Newly mapped `spt`, `port` raw log field with `event.idm.read_only_udm.principal.port` UDM field. - event.idm.read_only_udm.target.port: Newly mapped `dpt` raw log field with `event.idm.read_only_udm.target.port` UDM field. - event.idm.read_only_udm.target.user.email_addresses: Newly mapped `duser` raw log field with `event.idm.read_only_udm.target.user.email_addresses` UDM field. - event.idm.read_only_udm.intermediary.ip: Newly mapped `dvc` raw log field with `event.idm.read_only_udm.intermediary.ip` UDM field. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `rt` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped `timestamp` raw log field with `event.idm.read_only_udm.metadata.collected_timestamp` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `act`, `cs1`, `cs3`, `cs4`, `cs8`, `cs10`, `cs11`, `cs12`, `cs2`, `cs5`, `cs6`, `cs18`, `cs19`, `cert`, `deviceExternalId` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.intermediary.hostname: Newly mapped `hostname` raw log field with `event.idm.read_only_udm.intermediary.hostname` UDM field. - event.idm.read_only_udm.metadata.vendor_name: Newly mapped `vendor` raw log field with `event.idm.read_only_udm.metadata.vendor_name` UDM field. - event.idm.read_only_udm.metadata.product_name: Newly mapped `product` raw log field with `event.idm.read_only_udm.metadata.product_name` UDM field. - event.idm.read_only_udm.metadata.product_version: Newly mapped `version` raw log field with `event.idm.read_only_udm.metadata.product_version` UDM field. - event.idm.read_only_udm.security_result.rule_name: Newly mapped `rulename` raw log field with `event.idm.read_only_udm.security_result.rule_name` UDM field. - event.idm.read_only_udm.metadata.product_event_type: Newly mapped `peventtype` raw log field with `event.idm.read_only_udm.metadata.product_event_type` UDM field. - event.idm.read_only_udm.security_result.severity: Newly mapped `severity` raw log field with `event.idm.read_only_udm.security_result.severity` UDM field. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `externalId`, `error.innerError.client-request-id` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - event.idm.read_only_udm.metadata.description: Newly mapped `message_data` raw log field with `event.idm.read_only_udm.metadata.description` UDM field. - event.idm.read_only_udm.metadata.description: Newly mapped `cs4` raw log field with `event.idm.read_only_udm.metadata.description` UDM field if it matches the grok pattern. - event.idm.read_only_udm.network.http.method: Newly mapped `http_method` raw log field with `event.idm.read_only_udm.network.http.method` UDM field. - event.idm.read_only_udm.network.http.response_code: Newly mapped `http_response` raw log field with `event.idm.read_only_udm.network.http.response_code` UDM field. - event.idm.read_only_udm.target.url: Newly mapped `target_url` raw log field with `event.idm.read_only_udm.target.url` UDM field. - event.idm.read_only_udm.target.file.size: Newly mapped `cs7` raw log field with `event.idm.read_only_udm.target.file.size` UDM field. - event.idm.read_only_udm.target.file.full_path: Newly mapped `cs9` raw log field with `event.idm.read_only_udm.target.file.full_path` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `cs16`, `cs17`, `error.code`, `error.innerError.date` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.target.file.sha256: Newly mapped `sha256` raw log field with `event.idm.read_only_udm.target.file.sha256` UDM field. - event.idm.read_only_udm.security_result.description: Newly mapped `error.message` raw log field with `event.idm.read_only_udm.security_result.description` UDM field. - event.idm.read_only_udm.network.session_id: Newly mapped `error.innerError.request-id` raw log field with `event.idm.read_only_udm.network.session_id` UDM field. - event.idm.read_only_udm.metadata.event_type: If has_principal is "true" and has_target is "true", updated to "NETWORK_CONNECTION". - event.idm.read_only_udm.metadata.event_type: If has_user is "true" and message contains "login", updated to "USER_LOGIN". - event.idm.read_only_udm.metadata.event_type: If has_user is "true" and message contains "logout", updated to "USER_LOGOUT". - event.idm.read_only_udm.metadata.event_type: If has_user is "true" and has_principal_email is "true" and has_target_email is "true", updated to "EMAIL_TRANSACTION". - event.idm.read_only_udm.metadata.event_type: If has_principal is "true", updated to "STATUS_UPDATE". - event.idm.read_only_udm.metadata.event_type: If has_user is "true", updated to "USER_UNCATEGORIZED". - event.idm.read_only_udm.metadata.event_type: Otherwise, updated to "GENERIC_EVENT".

Date

Changes

2026-05-07

Enhancement:
- Added a grok pattern to parse the new format of logs.
- Added a grok pattern on `kvData` to extract `Subject` as we have two `cs5` fields within kvData.
- Modified the parsing of the `dhost` field to remove spaces before mapping to `event.idm.read_only_udm.network.email.to`.
- `event.idm.read_only_udm.additional.fields`: Removed the mapping of `cs5` from `event.idm.read_only_udm.additional.fields` UDM field when `cs5Label` is `Subject` to map to more appropriate UDM field.
- `event.idm.read_only_udm.network.email.subject`: Mapped `Subject` raw log field with `event.idm.read_only_udm.network.email.subject` UDM field.
- `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `cs7` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field when `cs7Label` is `IP Address`.
- `event.idm.read_only_udm.target.application`: Newly mapped `cs8` raw log field with `event.idm.read_only_udm.target.application` UDM field when `cs8Label` is `Application`.
- `event.idm.read_only_udm.principal.user.user_display_name`: Newly mapped `cs5` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field when `cs5Label` is `Login name`.
- `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`: Newly mapped `cs14` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM field when `cs14Label` is `Destination IP`.
- `event.idm.read_only_udm.target.url`: Newly mapped `cs15` raw log field with `event.idm.read_only_udm.target.url` UDM field when `cs15Label` is `URL`.
- `event.idm.read_only_udm.additional.fields`: Newly mapped `cs14` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field when `cs14Label` is not `Destination IP`.
- `event.idm.read_only_udm.additional.fields`: Newly mapped `cs15` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field when `cs15Label` is not `URL`.
- `event.idm.read_only_udm.additional.fields`: Newly mapped `cs13` raw log fields with `event.idm.read_only_udm.additional.fields` UDM field when `cs13` is not a valid ip address.

2025-10-28

- Newly created parser
- event.idm.read_only_udm.network.application_protocol: Newly mapped `proto` raw log field with `event.idm.read_only_udm.network.application_protocol` UDM field.
- event.idm.read_only_udm.network.email.to: Newly mapped `dhost` raw log field with `event.idm.read_only_udm.network.email.to` UDM field.
- event.idm.read_only_udm.principal.user.userid: Newly mapped `suser`, `cs6` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field.
- event.idm.read_only_udm.network.email.from: Newly mapped `shost` raw log field with `event.idm.read_only_udm.network.email.from` UDM field.
- event.idm.read_only_udm.principal.user.user_display_name: Newly mapped `suser` raw log field with `event.idm.read_only_udm.principal.user.user_display_name` UDM field.
- event.idm.read_only_udm.principal.ip: Newly mapped `src`, `cs13` raw log field with `event.idm.read_only_udm.principal.ip` UDM field.
- event.idm.read_only_udm.principal.asset.ip: Newly mapped `src`, `cs13` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field.
- event.idm.read_only_udm.principal.port: Newly mapped `spt`, `port` raw log field with `event.idm.read_only_udm.principal.port` UDM field.
- event.idm.read_only_udm.target.port: Newly mapped `dpt` raw log field with `event.idm.read_only_udm.target.port` UDM field.
- event.idm.read_only_udm.target.user.email_addresses: Newly mapped `duser` raw log field with `event.idm.read_only_udm.target.user.email_addresses` UDM field.
- event.idm.read_only_udm.intermediary.ip: Newly mapped `dvc` raw log field with `event.idm.read_only_udm.intermediary.ip` UDM field.
- event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `rt` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field.
- event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped `timestamp` raw log field with `event.idm.read_only_udm.metadata.collected_timestamp` UDM field.
- event.idm.read_only_udm.additional.fields: Newly mapped `act`, `cs1`, `cs3`, `cs4`, `cs8`, `cs10`, `cs11`, `cs12`, `cs2`, `cs5`, `cs6`, `cs18`, `cs19`, `cert`, `deviceExternalId` raw log field with `event.idm.read_only_udm.additional.fields` UDM field.
- event.idm.read_only_udm.intermediary.hostname: Newly mapped `hostname` raw log field with `event.idm.read_only_udm.intermediary.hostname` UDM field.
- event.idm.read_only_udm.metadata.vendor_name: Newly mapped `vendor` raw log field with `event.idm.read_only_udm.metadata.vendor_name` UDM field.
- event.idm.read_only_udm.metadata.product_name: Newly mapped `product` raw log field with `event.idm.read_only_udm.metadata.product_name` UDM field.
- event.idm.read_only_udm.metadata.product_version: Newly mapped `version` raw log field with `event.idm.read_only_udm.metadata.product_version` UDM field.
- event.idm.read_only_udm.security_result.rule_name: Newly mapped `rulename` raw log field with `event.idm.read_only_udm.security_result.rule_name` UDM field.
- event.idm.read_only_udm.metadata.product_event_type: Newly mapped `peventtype` raw log field with `event.idm.read_only_udm.metadata.product_event_type` UDM field.
- event.idm.read_only_udm.security_result.severity: Newly mapped `severity` raw log field with `event.idm.read_only_udm.security_result.severity` UDM field.
- event.idm.read_only_udm.metadata.product_log_id: Newly mapped `externalId`, `error.innerError.client-request-id` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field.
- event.idm.read_only_udm.metadata.description: Newly mapped `message_data` raw log field with `event.idm.read_only_udm.metadata.description` UDM field.
- event.idm.read_only_udm.metadata.description: Newly mapped `cs4` raw log field with `event.idm.read_only_udm.metadata.description` UDM field if it matches the grok pattern.
- event.idm.read_only_udm.network.http.method: Newly mapped `http_method` raw log field with `event.idm.read_only_udm.network.http.method` UDM field.
- event.idm.read_only_udm.network.http.response_code: Newly mapped `http_response` raw log field with `event.idm.read_only_udm.network.http.response_code` UDM field.
- event.idm.read_only_udm.target.url: Newly mapped `target_url` raw log field with `event.idm.read_only_udm.target.url` UDM field.
- event.idm.read_only_udm.target.file.size: Newly mapped `cs7` raw log field with `event.idm.read_only_udm.target.file.size` UDM field.
- event.idm.read_only_udm.target.file.full_path: Newly mapped `cs9` raw log field with `event.idm.read_only_udm.target.file.full_path` UDM field.
- event.idm.read_only_udm.security_result.detection_fields: Newly mapped `cs16`, `cs17`, `error.code`, `error.innerError.date` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field.
- event.idm.read_only_udm.target.file.sha256: Newly mapped `sha256` raw log field with `event.idm.read_only_udm.target.file.sha256` UDM field.
- event.idm.read_only_udm.security_result.description: Newly mapped `error.message` raw log field with `event.idm.read_only_udm.security_result.description` UDM field.
- event.idm.read_only_udm.network.session_id: Newly mapped `error.innerError.request-id` raw log field with `event.idm.read_only_udm.network.session_id` UDM field.
- event.idm.read_only_udm.metadata.event_type: If has_principal is "true" and has_target is "true", updated to "NETWORK_CONNECTION".
- event.idm.read_only_udm.metadata.event_type: If has_user is "true" and message contains "login", updated to "USER_LOGIN".
- event.idm.read_only_udm.metadata.event_type: If has_user is "true" and message contains "logout", updated to "USER_LOGOUT".
- event.idm.read_only_udm.metadata.event_type: If has_user is "true" and has_principal_email is "true" and has_target_email is "true", updated to "EMAIL_TRANSACTION".
- event.idm.read_only_udm.metadata.event_type: If has_principal is "true", updated to "STATUS_UPDATE".
- event.idm.read_only_udm.metadata.event_type: If has_user is "true", updated to "USER_UNCATEGORIZED".
- event.idm.read_only_udm.metadata.event_type: Otherwise, updated to "GENERIC_EVENT".