SAP ICM UDM mapping

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

The SAP_ICM parser captures events related to the SAP Internet Communication Manager (ICM), which handles HTTP, HTTPS, and SMTP requests for the SAP NetWeaver Application Server.

For information about Google SecOps for SAP, see Secure SAP applications with Google SecOps.

Field mapping reference

The following table describes the mapping between SAP ICM log fields and Google SecOps UDM fields.

Log field	UDM mapping	Logic
thread_id	event.idm.read_only_udm.principal.process.pid	Thread ID of the SAP ICM process that generated the log entry.
message	event.idm.read_only_udm.metadata.description	Contains the raw log message.