Hello,
I'm parsing Qumulo JSON audit logs in Google SecOps and I'm able to successfully extract top-level and nested fields such as:
{
"operation": "fs_write_metadata",
"details": {
"file_id": "9283XXXXXXXXXX329",
"path": "/smb/underwritingscan/Windows (C) - Shortcut.lnk",
"before": {
"ctime": "2026-07-16T16:06:05.106082716Z"
},
"after": {
"ctime": "2026-07-16T17:56:43.431152651Z"}}}
-- Using statedump, I can confirm the parser is exposing:
details.before.ctime
details.after.ctime
--- and temporary test fields are populated:
before_ctime_test = 2026-07-16T16:06:05.106082716Z
after_ctime_test = 2026-07-16T17:56:43.431152651Z
------Current UDM mappings work successfully for:
principal.user.userid
principal.ip
target.file.full_path
metadata.product_log_id
metadata.product_event_type
------- My goal is to expose the following fields in UDM for dashboarding:
details.before.ctime
details.after.ctime
details.before.mtime
details.after.mtime
------I attempted to use:
event.idm.read_only_udm.additional.fields
---but received:
repeated key "event.idm.read_only_udm.additional.fields" in option
---------------Questions:
- What is the recommended UDM field for storing before/after file timestamps?
- Is additional.fields the correct approach?
- How are others handling nested metadata values such as:
- before.ctime
- after.ctime
- before.mtime
- after.mtime
- Any examples of dashboarding historical vs updated file metadata timestamps in Google SecOps?
------------------The end goal is to build dashboard panels showing:
Event Timestamp
Before CTime
After CTime
Before MTime
After MTime
User
File Path
Operation
