We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for SAP_IDENTITY_AND_AUTH_DATA

Date Changes

2026-02-04 - Newly created parser.
- event.idm.read_only_udm.principal.user.userid: Newly mapped changeUsr, uname, aname, modifier, modbe raw log field with event.idm.read_only_udm.principal.user.userid UDM field.
- event.idm.read_only_udm.principal.hostname: Newly mapped hostname raw log field with event.idm.read_only_udm.principal.hostname UDM field.
- event.idm.read_only_udm.target.user.userid: Newly mapped bname, username raw log field with event.idm.read_only_udm.target.user.userid UDM field.
- event.idm.read_only_udm.target.group.group_display_name: Newly mapped agrName raw log field with event.idm.read_only_udm.target.group.group_display_name UDM field.
- event.idm.read_only_udm.about.group.group_display_name: Newly mapped childAgr raw log field with event.idm.read_only_udm.about.group.group_display_name UDM field.
- event.idm.read_only_udm.target.resource.name: Newly mapped tcode raw log field with event.idm.read_only_udm.target.resource.name UDM field.
- event.idm.read_only_udm.target.user.group_identifiers: Newly mapped class, profile raw log field with event.idm.read_only_udm.target.user.group_identifiers UDM field.
- event.idm.read_only_udm.principal.process.file.full_path: Newly mapped repid raw log field with event.idm.read_only_udm.principal.process.file.full_path UDM field.
- event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped field, struct, mandt, parentAgr, type, fromDat, toDat, ustyp, langu, ianatzonecode, trdat, ltime, pwdchgdate, pwdlgndate, pwdlockdate, pwdsaltedhash raw log field with event.idm.read_only_udm.target.resource.attribute.labels UDM field.
- event.idm.read_only_udm.principal.asset.attribute.labels: Newly mapped systemid, partype raw log field with event.idm.read_only_udm.principal.asset.attribute.labels UDM field.
- event.idm.read_only_udm.security_result.detection_fields: Newly mapped direct, uflag, securityPolicy raw log field with event.idm.read_only_udm.security_result.detection_fields UDM field.
- event.idm.read_only_udm.additional.fields: Newly mapped attributes, changeDat, changeTim, createUsr, exclude, inherited, folder, colFlag, orgFlag, pardate, parname, parvalue, parstate, gltgv, gltgb, passcode, accnt, pwdinitial, stcod, spld, splg, dcpfm, hdest, hmand, hname, menon, menue, strtt, cattkennz, spdb, spda, datfm, timefm, bcode, ocod1, bcda1, codv1, ocod2, bcda2, codv2, ocod3, bcda3, codv3, ocod4, bcda4, codv4, ocod5, bcda5, codv5, versn, codvn, tzone, zbvmaster, pwdstate, reserved, pwdhistory, pwdsetdate, moddate, modtime, createDat, createTim, createTmp, changeTmp, changeTst, modda, modti, erdat, locnt raw log field with event.idm.read_only_udm.additional.fields UDM field.
- event.idm.read_only_udm.metadata.vendor_name: Newly mapped SAP static value with event.idm.read_only_udm.metadata.vendor_name UDM field.
- event.idm.read_only_udm.metadata.product_name: Newly mapped SAP_IDENTITY_AND_AUTH_DATA static value with event.idm.read_only_udm.metadata.product_name UDM field.
- event.idm.read_only_udm.metadata.event_type: The event_type is set to USER_UNCATEGORIZED, USER_CHANGE_PASSWORD, USER_RESOURCE_UPDATE_CONTENT, GROUP_MODIFICATION, or STATUS_UPDATE based on the presence of fields like aname, bname, modifier, username, and hostname, defaulting to GENERIC_EVENT` if the conditions for these types are not met.

Date	Changes
2026-02-04	- Newly created parser. - event.idm.read_only_udm.principal.user.userid: Newly mapped `changeUsr`, `uname`, `aname`, `modifier`, `modbe` raw log field with `event.idm.read_only_udm.principal.user.userid` UDM field. - event.idm.read_only_udm.principal.hostname: Newly mapped `hostname` raw log field with `event.idm.read_only_udm.principal.hostname` UDM field. - event.idm.read_only_udm.target.user.userid: Newly mapped `bname`, `username` raw log field with `event.idm.read_only_udm.target.user.userid` UDM field. - event.idm.read_only_udm.target.group.group_display_name: Newly mapped `agrName` raw log field with `event.idm.read_only_udm.target.group.group_display_name` UDM field. - event.idm.read_only_udm.about.group.group_display_name: Newly mapped `childAgr` raw log field with `event.idm.read_only_udm.about.group.group_display_name` UDM field. - event.idm.read_only_udm.target.resource.name: Newly mapped `tcode` raw log field with `event.idm.read_only_udm.target.resource.name` UDM field. - event.idm.read_only_udm.target.user.group_identifiers: Newly mapped `class`, `profile` raw log field with `event.idm.read_only_udm.target.user.group_identifiers` UDM field. - event.idm.read_only_udm.principal.process.file.full_path: Newly mapped `repid` raw log field with `event.idm.read_only_udm.principal.process.file.full_path` UDM field. - event.idm.read_only_udm.target.resource.attribute.labels: Newly mapped `field`, `struct`, `mandt`, `parentAgr`, `type`, `fromDat`, `toDat`, `ustyp`, `langu`, `ianatzonecode`, `trdat`, `ltime`, `pwdchgdate`, `pwdlgndate`, `pwdlockdate`, `pwdsaltedhash` raw log field with `event.idm.read_only_udm.target.resource.attribute.labels` UDM field. - event.idm.read_only_udm.principal.asset.attribute.labels: Newly mapped `systemid`, `partype` raw log field with `event.idm.read_only_udm.principal.asset.attribute.labels` UDM field. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `direct`, `uflag`, `securityPolicy` raw log field with `event.idm.read_only_udm.security_result.detection_fields` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `attributes`, `changeDat`, `changeTim`, `createUsr`, `exclude`, `inherited`, `folder`, `colFlag`, `orgFlag`, `pardate`, `parname`, `parvalue`, `parstate`, `gltgv`, `gltgb`, `passcode`, `accnt`, `pwdinitial`, `stcod`, `spld`, `splg`, `dcpfm`, `hdest`, `hmand`, `hname`, `menon`, `menue`, `strtt`, `cattkennz`, `spdb`, `spda`, `datfm`, `timefm`, `bcode`, `ocod1`, `bcda1`, `codv1`, `ocod2`, `bcda2`, `codv2`, `ocod3`, `bcda3`, `codv3`, `ocod4`, `bcda4`, `codv4`, `ocod5`, `bcda5`, `codv5`, `versn`, `codvn`, `tzone`, `zbvmaster`, `pwdstate`, `reserved`, `pwdhistory`, `pwdsetdate`, `moddate`, `modtime`, `createDat`, `createTim`, `createTmp`, `changeTmp`, `changeTst`, `modda`, `modti`, `erdat`, `locnt` raw log field with event.idm.read_only_udm.additional.fields UDM field. - event.idm.read_only_udm.metadata.vendor_name: Newly mapped `SAP` static value with `event.idm.read_only_udm.metadata.vendor_name` UDM field. - event.idm.read_only_udm.metadata.product_name: Newly mapped `SAP_IDENTITY_AND_AUTH_DATA` static value with `event.idm.read_only_udm.metadata.product_name` UDM field. - event.idm.read_only_udm.metadata.event_type: The event_type is set to `USER_UNCATEGORIZED`, `USER_CHANGE_PASSWORD`, `USER_RESOURCE_UPDATE_CONTENT`, `GROUP_MODIFICATION`, `or` STATUS_UPDATE `based on the presence of fields like` aname`,` bname`,` modifier`,` username`,` and hostname`, defaulting to` GENERIC_EVENT` if the conditions for these types are not met.