We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for SAP_HANA

Date Changes

2026-02-19 Newly created parser:
- Added support to parse CSV format of logs.
- event.idm.read_only_udm.metadata.event_timestamp: Newly mapped event_timestamp_str fields with event.idm.read_only_udm.metadata.event_timestamp UDM field.
- event.idm.read_only_udm.principal.hostname: Newly mapped principal_hostname field with event.idm.read_only_udm.principal.hostname UDM field.
- event.idm.read_only_udm.principal.asset.hostname: Newly mapped principal_hostname field with event.idm.read_only_udm.principal.asset.hostname UDM field.
- event.idm.read_only_udm.principal.user.userid: Newly mapped principal_userid field with event.idm.read_only_udm.principal.user.userid UDM field.
- event.idm.read_only_udm.principal.application: Newly mapped application field with event.idm.read_only_udm.principal.application UDM field.
- event.idm.read_only_udm.principal.ip: Newly mapped principal_IP field with event.idm.read_only_udm.principal.ip UDM field.
- event.idm.read_only_udm.principal.asset.ip: Newly mapped principal_IP field with event.idm.read_only_udm.principal.asset.ip UDM field.
- event.idm.read_only_udm.target.ip: Newly mapped target_IP field with event.idm.read_only_udm.target.ip UDM field.
- event.idm.read_only_udm.target.asset.ip: Newly mapped target_IP field with event.idm.read_only_udm.target.asset.ip UDM field.
- event.idm.read_only_udm.metadata.product_event_type: Newly mapped message_id field with event.idm.read_only_udm.metadata.product_event_type UDM field.
- event.idm.read_only_udm.metadata.description: Newly mapped description field with event.idm.read_only_udm.metadata.description UDM field.
- event.idm.read_only_udm.target.resource.name: Newly mapped object_name field with event.idm.read_only_udm.target.resource.name UDM field.
- event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped sap_client, system_id fields with event.idm.read_only_udm.principal.resource.attribute.labels UDM field.
- event.idm.read_only_udm.additional.field: Newly mapped program_name field with event.idm.read_only_udm.additional.field UDM field.
- event.idm.read_only_udm.metadata.vendor_name: Newly mapped SAP field with event.idm.read_only_udm.metadata.vendor_name UDM field.
- event.idm.read_only_udm.metadata.product_name: Newly mapped SAP_HANA field with event.idm.read_only_udm.metadata.product_name UDM field.
- event.idm.read_only_udm.metadata.event_type: The event_type is set asUSER_RESOURCE_ACCESS, NETWORK_CONNECTION, USER_UNCATEGORIZED, or STATUS_UPDATE based on the presence of necessary principal and target data, defaulting to GENERIC_EVENT if those details are missing.

Date	Changes
2026-02-19	Newly created parser: - Added support to parse CSV format of logs. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `event_timestamp_str` fields with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - `event.idm.read_only_udm.principal.hostname`: Newly mapped `principal_hostname` field with `event.idm.read_only_udm.principal.hostname` UDM field. - `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `principal_hostname` field with `event.idm.read_only_udm.principal.asset.hostname` UDM field. - `event.idm.read_only_udm.principal.user.userid`: Newly mapped `principal_userid` field with `event.idm.read_only_udm.principal.user.userid` UDM field. - `event.idm.read_only_udm.principal.application`: Newly mapped `application` field with `event.idm.read_only_udm.principal.application` UDM field. - `event.idm.read_only_udm.principal.ip`: Newly mapped `principal_IP` field with `event.idm.read_only_udm.principal.ip` UDM field. - `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `principal_IP` field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - `event.idm.read_only_udm.target.ip`: Newly mapped `target_IP` field with `event.idm.read_only_udm.target.ip` UDM field. - `event.idm.read_only_udm.target.asset.ip`: Newly mapped `target_IP` field with `event.idm.read_only_udm.target.asset.ip` UDM field. - `event.idm.read_only_udm.metadata.product_event_type`: Newly mapped `message_id` field with `event.idm.read_only_udm.metadata.product_event_type` UDM field. - `event.idm.read_only_udm.metadata.description`: Newly mapped `description` field with `event.idm.read_only_udm.metadata.description` UDM field. - `event.idm.read_only_udm.target.resource.name`: Newly mapped `object_name` field with `event.idm.read_only_udm.target.resource.name` UDM field. - `event.idm.read_only_udm.principal.resource.attribute.labels`: Newly mapped `sap_client`, `system_id` fields with `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - `event.idm.read_only_udm.additional.field`: Newly mapped `program_name` field with `event.idm.read_only_udm.additional.field` UDM field. - `event.idm.read_only_udm.metadata.vendor_name`: Newly mapped `SAP` field with `event.idm.read_only_udm.metadata.vendor_name` UDM field. - `event.idm.read_only_udm.metadata.product_name`: Newly mapped `SAP_HANA` field with `event.idm.read_only_udm.metadata.product_name` UDM field. - `event.idm.read_only_udm.metadata.event_type`: The event_type is set as`USER_RESOURCE_ACCESS`, `NETWORK_CONNECTION`, `USER_UNCATEGORIZED`, or `STATUS_UPDATE` based on the presence of necessary principal and target data, defaulting to `GENERIC_EVENT` if those details are missing.