SAP ICM UDM mapping

The SAP_ICM parser captures events related to the SAP Internet Communication Manager (ICM), which handles HTTP, HTTPS, and SMTP requests for the SAP NetWeaver Application Server.

For information about Google SecOps for SAP, see Secure SAP applications with Google SecOps .

Field mapping reference

The following table describes the mapping between SAP ICM log fields and Google SecOps UDM fields.

Log field	UDM mapping	Logic
thread_id	event.idm.read_only_udm.principal.process.pid	Thread ID of the SAP ICM process that generated the log entry.
message	event.idm.read_only_udm.metadata.description	Contains the raw log message.