Vendor fields are now aliased to the client namespace where source was previously used, as client better describes the role of devices initiating authentication flows whereas source is intended for network details

client fields are aliased to source at the end of the parser to avoid a breaking change. This allows the source fields to be easily removed from the parser at a later date

event.dataset of duo.administrator is now assigned when Vendor.action = * AND Vendor.isotimestamp = * rather than when Vendor.description = * (as "description":null often occurs, meaning that the Vendor.description field is not created)

Categorization now matches on event.dataset first, then event.action to handle repeat event.action values across different log types (e.g., event.action of enrollment appears in both Authentication and Telephony logs)

Added use of user.target fields - with logic implemented to make sure this is only applied on applicable event

Added parsing of nested JSON in duo.activity logs from the fields: Vendor.actor.details/Vendor.target.details/Vendor.old_target.details

Removed the Host fields section for duo.authentication and duo.trustmonitor events. As auth_device is the MFA device used in the auth process - not the host on which the event happened. Also Vendor.target fields are not present in this log type. So this section was not accurate

Moved the determination of event.outcome after the default values are set in categorization - so that these default values can be overwritten when outcome information is available in the event

Updated the handling of object arrays to use objectArray:eval() instead of concatArray and splitString

Added observer.type := "identity"

Additional normalization of ECS fields

Updates to the assignment of event.category for cloudsso_update_routing_rule and user_restore events

Updated CPS version to 1.1.0

Updated ECS version to 9.0.0

Updated parser version to 3.0.0