Hello,
I am using the latest version of the Default GCP Cloud Audit parser of 2025-11-05.
But unfortunately, when I go through the Audit Logs, I get to see values in the UDM which are absolutely not there in the raw json.
event fields:
I don’t expect this behavior to happen. Why does the parser add more values to the principal object when my other colleague is not mentioned once in the raw json.
Of course I have tried to find other way around this, but other objects like which IAM roles are being added or removed are also getting mixed up within the principal object. So when I want to create a window with IAM policy changes, then it gets mixed up with principal fields:
