Mappings: Zoom - Recording Deleted or Trashed

Input Requirements

Input	Value
Vendor	Zoom
Product	Zoom
Log Format	JSON
Event ID Regex Pattern	`recording.batch_deleted\|recording.deleted\|recording.batch_trashed\|recording.trashed`

Record Output

Output	Value
Vendor	Zoom
Product	Zoom
Record Type	Audit

Fields Mapped

Cloud SIEM Schema Field	Original Record Key	Notes
action	event
targetUser_email	payload.object.email
targetUser_userId	payload.object.topic
targetUser_username	payload.object.topic
user_email	payload.operator
user_userId	payload.operator_id
user_username	payload.operator