Change log for WORKSPACE_ACTIVITY

Date Changes
2024-10-18 - Mapped "message_info.post_delivery_info.action_type" raw log field to "about.labels[post_delivery_action_type]" UDM field.
- Mapped "message_info.post_delivery_info.interaction.link_url" raw log field to "about.url" UDM field
2024-10-04 Updated mapping of the "chrome" application log for workspace activity to be consistent with the Chrome Management parser.
2024-09-17 - Mapped each email address of raw log field "resource_recipients" separately to "principal.user.email_addresses" UDM field.
2024-09-17 - Mapped each email address of raw log field "resource_recipients" separately to "principal.user.email_addresses" UDM field.
2024-09-09 - Updated mapping of field "from_header_address" to "principal.network.email.from".
2024-07-26 - Added support to parse the logs having "events" marked as hidden and the logs that are out of scope parsed as GENERIC_EVENT.
2024-06-05 - Added support for "access_url", "access_item_content", and "sheets_import_url" events.
2024-05-15 - Added additional mapping for "target_user" field.
- Added support for "team_drive_settings_change", "presentation_stopped", and "content_unmatched" events.
- Added support for "BLOCKED_API_ACCESS" and "MONITOR_MODE_ACCESS_DENY_EVENT" events.
- Added support of field "TAB_URL" for event "MALWARE_TRANSFER".
2024-05-09 - Added support for logs of applicationName "google_meet".
2024-05-08 - Added support for "team_drive_membership_change", "change_owner_hierarchy_reconciled", and "publish_new_version" events.
- Added support of field "file_name" for Gmail logs.
2024-03-06 - Added support for "call_ended", "presentation_started", and "invitation_sent" events.
- Mapped "login_challenge_method" count to "security_result.detection_fields".
- Handled different timestamp format.
- Update mapping of actor.profileId field to noun.user.product_object_id.
- Added support of new events "DELETE_GROUP", "SECURITY_CENTER_RULE_THRESHOLD_TRIGGER", "RELEASE_FROM_QUARANTINE" and "deny".
2023-12-13 Added support for "ADD_TO_BLOCKED_OAUTH2_APPS", "ADD_TO_TRUSTED_OAUTH2_APPS",
"UPDATE_ACCESS_LEVEL_V2", "sharing_blocked", "UPDATE_AUTO_PROVISIONED_USER",
"SECURITY_INVESTIGATION_EXPORT_QUERY", and "SECURITY_INVESTIGATION_ACTION_CANCELLATION" events.
2023-11-29 - Added support for "email_collaborators", "message_deleted" and "unsubscribe_via_mail" events.
- Added additional mappings for deprecated labels.
2023-11-01 1. Added support for "download_forms_response", "ACTION_REQUESTED", "change_email_subscription_type", and "reaction_added" events.
2. Updated mapping of field "target" for "applicationName"="drive" to "target.user.email_addresses".
3. Enhancement to use "base64" hex decode function to parse IP addresses.
2023-10-04 Added support for "invitation_sent", "SECURITY_INVESTIGATION_ACTION_COMPLETION",
"CREATE_GMAIL_SETTING", "CHANGE_GMAIL_SETTING" and "DELETE_GMAIL_SETTING" events.
2023-09-20 Added logic to map "actor.key" to "noun.user.userid" where "actor.callType" is "KEY".
2023-09-06 Added support for new events.
2023-08-24 Modified the logic to parse "TARGET_USER_EMAIL" field for events.name "CHANGE_USER_ACCESS".
2023-08-23 Modified logic for "events.name=CHROME_OS_LOGIN_EVENT".
2023-08-09 1. Added support for GMAIL_LOGS.
2. Added support for events "CHANGE_EMAIL_SETTING",
"SECURITY_INVESTIGATION_ACTION",
"SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION",
"REMOVE_GROUP_MEMBER",
"UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS", "UPDATE_GROUP_MEMBER",
and "SECURITY_CHART_DRILLDOWN".
2023-07-26 Added support for events "label_applied", "risky_sensitive_action_blocked",
"ALERT_CENTER_LIST_FEEDBACK", "ALERT_CENTER_GET_SIT_LINK",
"ALERT_CENTER_LIST_CHANGE", "ALERT_CENTER_LIST_RELATED_ALERTS",
"EMAIL_LOG_SEARCH", "SECURITY_INVESTIGATION_QUERY", "CHANGE_GROUP_SETTING",
"ADD_GROUP_MEMBER", "CREATE_GROUP", "USER_LICENSE_ASSIGNMENT",
"USER_LICENSE_REVOKE", and "blocked_sender".
2023-07-12 - Added support of event "label_field_value_changed" for "applicationName=rules".
2023-06-14 1. Additional mapping of "actor.email" field with "security_result.about.email" UDM field.
2. Updated the parser to include "parse_network_http_user_agent" to use "Parsed User Agent" and "User Agent".
2023-05-31 1. Added support of events "ASSIGN_ROLE", "CREATE_ROLE" for "applicationName=admin" and "events.type = DELEGATED_ADMIN_SETTINGS".
2. Added support of events "AUTHORIZE_API_CLIENT_ACCESS" for "applicationName=admin" and "events.type = DOMAIN_SETTINGS".
3. Added support of events "ALERT_CENTER_VIEW" for "applicationName=admin" and "events.type = ALERT_CENTER".
4. Added support of events "risky_sensitive_action_allowed" for "applicationName=login" and "events.type = login".
5. Modified logic for "USER_LOGIN" events.
2023-05-29 Update mapping of "actor" field for "USER_LOGIN" and "USER_LOGOUT" events.
2023-04-12 Promoted WORKSPACE_ACTIVITY parser to default.
For the field mapping reference, see Collect Google Workspace logs.