what is `event.idm.read_only_udm`

In the following doc:

https://cloud.google.com/chronicle/docs/reference/udm-field-list

it says:

> When writing configuration-based normalizer (CBN) parsers, use the <prefix> pattern event.idm.read_only_udm for UDM Event fields and event.idm.graph for UDM Entity fields. 

I am very confused. What does `idm`, `read_only_udm`, and `graph` mean here?

 

 

0 3 484
3 REPLIES 3