We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for OFFICE_365_MESSAGETRACE

Date	Changes
2026-04-29	Enhancement: - `event.idm.read_only_udm.metadata.product_log_id`: Newly mapped `id` raw log field with `event.idm.read_only_udm.metadata.product_log_id` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `receivedDateTime` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `fromIP` raw log field with `event.idm.read_only_udm.principal.ip` and `event.idm.read_only_udm.principal.asset.ip` UDM field. - `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip`: Newly mapped `toIP` raw log field with `event.idm.read_only_udm.target.ip` and `event.idm.read_only_udm.target.asset.ip` UDM fields. - `event.idm.read_only_udm.security_result.action_details`: Newly mapped `status` raw log field with `event.idm.read_only_udm.security_result.action_details` UDM field. - `event.idm.read_only_udm.network.received_bytes`: Newly mapped `size` raw log field with `event.idm.read_only_udm.network.received_bytes` UDM field. - `event.idm.read_only_udm.network.email.from`: Newly mapped `senderAddress` raw log field with `event.idm.read_only_udm.network.email.from` UDM field. - `event.idm.read_only_udm.network.email.to`: Newly mapped `recipientAddress` raw log field with `event.idm.read_only_udm.network.email.to` UDM field. - `event.idm.read_only_udm.network.email.subject`: Newly mapped `subject` raw log field with `event.idm.read_only_udm.network.email.subject` UDM field. - `event.idm.read_only_udm.network.email.mail_id`: Newly mapped `messageId` raw log field with `event.idm.read_only_udm.network.email.mail_id` UDM field. - `event.idm.read_only_udm.security_result.action`: If `Status` is `delivered`, updated the value of `event.idm.read_only_udm.security_result.action` to `ALLOW`. - `event.idm.read_only_udm.security_result.action`: If `Status` is `resolved`, updated the value of `event.idm.read_only_udm.security_result.action` to `ALLOW`. - `event.idm.read_only_udm.security_result.action`: If `Status` is `failed`, updated the value of `event.idm.read_only_udm.security_result.action` to `BLOCK`. - `event.idm.read_only_udm.security_result.action`: If `Status` is `quarantined`, updated the value of `event.idm.read_only_udm.security_result.action` to `QUARANTINE`.
2025-08-21	Enhancement: - event.idm.read_only_udm.network.received_bytes: Newly mapped Size raw log field to event.idm.read_only_udm.network.received_bytes UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `Index`, `__metadata.type`, `__metadata.id` raw log fields to event.idm.read_only_udm.additional.fields UDM field. - Enhanced timestamp parsing for the `Received` raw log field to handle UNIX millisecond format and mapped to `event.idm.read_only_udm.metadata.event_timestamp` UDM field.
2024-06-07	Enhancement: - When the timestamps are in dd/MMM/yyyy HH:mm:ss format, then added support to parse `Received` to `metadata.event_timestamp`. - Mapped `ToIP` to `target.ip`.
2024-05-28	Enhancement: - Mapped `properties.SenderMailFromDomain`, `properties.UserLevelAction`, and `properties.UserLevelPolicy` to `principal.user.attribute.labels`. - Mapped `properties.SenderFromDomain` to `principal.administrative_domain`. - Mapped `properties.EmailDirection` to `network.direction`. - Mapped `properties.DeliveryAction`, `properties.DeliveryLocation`, `properties.Connectors`, `properties.OrgLevelAction`, `properties.OrgLevelPolicy`, `properties.AdditionalFields`, and `properties.UrlLocation` to `additional.fields`. - Mapped `properties.Subject` to `network.email.subject`. - Mapped `properties.ConfidenceLevel` to `additional.fields`. - Mapped `properties.Url` to `target.url`. - Mapped `properties.UrlDomain` to `target.hostname` and `target.asset.hostname`. - Mapped `properties.AuthenticationDetails` to `extensions.auth.auth_details`.
2024-04-18	Enhancement: - Mapped `time` to `metadata.event_timestamp`. - Mapped `tenantId` to `metadata.product_deployment_id`. - Mapped `operationName`, `Tenant` to `additional.fields`. - Mapped `category` to `metadata.product_event_type`. - Mapped `properties.SenderFromAddress` to `principal.user.email_addresses` and `network.email.from`. - Mapped `properties.RecipientEmailAddress` to `network.email.to` and `target.user.email_addresses`. - Mapped `properties.FileName` to `principal.process.file.names`. - Mapped `properties.SHA256` to `principal.process.file.sha256`. - Mapped `properties.FileSize` to `principal.process.file.size`. - Mapped `properties.RecipientObjectId` to `target.user.product_object_id`. - Mapped `properties.SenderObjectId` to `principal.user.product_object_id`. - Mapped `properties.SenderDisplayName` to `principal.user.user_display_name`. - Mapped `properties.ThreatNames` to `security_result.threat_name`. - Mapped `properties.DetectionMethods` to `security_result.detection_fields`.
2023-05-10	Newly created parser.