We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for TANIUM_INTEGRITY_MONITOR

Date Changes

2025-10-28 Enhancement:
- event.idm.read_only_udm.principal.asset.hostname: Newly mapped Computer_Name raw log field with event.idm.read_only_udm.principal.asset.hostname UDM field.
- event.idm.read_only_udm.target.process.file.full_path: Newly mapped Process_Path raw log field with event.idm.read_only_udm.target.process.file.full_path UDM field.
- event.idm.read_only_udm.metadata.event_timestamp: Newly mapped Event_Time, Hashed_At raw log field with event.idm.read_only_udm.metadata.event_timestamp UDM field.
- event.idm.read_only_udm.additional.fields: Newly mapped Event_Time, Hashed_At, and Watchlists raw log field with event.idm.read_only_udm.additional.fields UDM field.
- event.idm.read_only_udm.metadata.event_type: Setting event.idm.read_only_udm.metadata.event_type to FILE_MODIFICATION if has_principal is true, has_file is true and message contains write.
- Renamed from computer_name to Computer_Name.
- Renamed from process_path to Process_Path.
- Renamed from file_path to File_Path.
- Renamed from change_type to Change_Type.
- Renamed from hashed_at to Hashed_At.

2022-10-12 Newly Created Parser.

Date	Changes
2025-10-28	Enhancement: - event.idm.read_only_udm.principal.asset.hostname: Newly mapped `Computer_Name` raw log field with `event.idm.read_only_udm.principal.asset.hostname` UDM field. - event.idm.read_only_udm.target.process.file.full_path: Newly mapped `Process_Path` raw log field with `event.idm.read_only_udm.target.process.file.full_path` UDM field. - event.idm.read_only_udm.metadata.event_timestamp: Newly mapped `Event_Time`, `Hashed_At` raw log field with `event.idm.read_only_udm.metadata.event_timestamp` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `Event_Time`, `Hashed_At`, and `Watchlists` raw log field with `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.metadata.event_type: Setting `event.idm.read_only_udm.metadata.event_type` to `FILE_MODIFICATION` if `has_principal` is `true`, `has_file` is `true` and `message` contains `write`. - Renamed from computer_name to Computer_Name. - Renamed from process_path to Process_Path. - Renamed from file_path to File_Path. - Renamed from change_type to Change_Type. - Renamed from hashed_at to Hashed_At.
2022-10-12	Newly Created Parser.