We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for SAP_SM20

Date	Changes
2025-07-07	- Added support for new pattern of SYSLOG logs. - `event.idm.read_only_udm.network.session_id`: Newly mapped `session_id` raw log field with `event.idm.read_only_udm.network.session_id` UDM field. - `event.idm.read_only_udm.target.application`: Newly mapped `application` raw log field with `event.idm.read_only_udm.target.application` UDM field. - `event.idm.read_only_udm.target.resource.product_object_id`: Newly mapped `resource_id` raw log field with `event.idm.read_only_udm.target.resource.product_object_id` UDM field. - `event.idm.read_only_udm.principal.hostname`: Newly mapped `hostname` raw log field with `event.idm.read_only_udm.principal.hostname` UDM field. - `event.idm.read_only_udm.principal.asset.hostname`: Newly mapped `hostname` raw log field with `event.idm.read_only_udm.principal.asset.hostname` UDM field. - `event.idm.read_only_udm.principal.ip`: Newly mapped `ip` raw log field with `event.idm.read_only_udm.principal.ip` UDM field. - `event.idm.read_only_udm.principal.asset.ip`: Newly mapped `ip` raw log field with `event.idm.read_only_udm.principal.asset.ip` UDM field. - `event.idm.read_only_udm.metadata.event_timestamp`: Newly mapped `date` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field.
2024-04-16	- Mapped `ALGSYSTEM` to `principal.hostname` and `principal.asset.hostname`.
2024-01-29	- Added support for newly ingested logs. - Mapped `WP_PID` to `target.process.pid`. - Mapped `WP_SERVER` to `intermediary.hostname`. - Mapped `WP_STATUS` to `security_result.summary`. - Mapped `INSTANCE_NAME` to `principal.hostname` and `principal.asset.hostname`. - Mapped `TXSEVERITY` to `security_result.severity`. - Mapped `TXSUBCLSID` to `security_result.description`. - Mapped `ALGSYSTEM` to `principal.hostname` and `principal.asset.hostname`. - If `ALGLTERM` is an IP address, then mapped it to `target.ip` and `target.asset.ip`, else mapped it to `target.hostname` and `target.asset.hostname`. - Mapped `ALGCLIENT` and `ALGINST` to `target.resource.attribute.labels`. - Mapped `ALGUSER` to `target.user.userid`. - Mapped `ALGTEXT` to `metadata.description`. - If `ALGTEXT` is nearly equals to `logon successful` and `has_principal` and `has_target` is equals to `true` then `metadata.event_type` is set to `USER_LOGIN`. - Mapped `WP_TYP`, `ALGREPNA`, `ALGAREA`, `ALGFILENO`, `ALGFILEPOS`, `ALGSUBID`, `UTCDIFF`, `ALGTASKNO`, `ALGTASKTYPE`, `ALGTCODE` to `additional.fields`.
2023-12-07	- Newly created parser.