SAP_ICM parser captures events related to the SAP Internet Communication Manager (ICM), which handles HTTP, HTTPS, and SMTP requests for the SAP NetWeaver Application Server.
For information about Google SecOps for SAP, see Secure SAP applications with Google SecOps.
Field mapping reference
The following table describes the mapping between SAP ICM log fields and Google SecOps UDM fields.
| Log field | UDM mapping | Logic |
|---|---|---|
thread_id |
event.idm.read_only_udm.principal.process.pid |
Thread ID of the SAP ICM process that generated the log entry. |
message |
event.idm.read_only_udm.metadata.description |
Contains the raw log message. |