what is "idm" in UDM fields in Chronicle?

"identity management" and it's likely used to categorize users or groups within in a specific organization or indicate it was categorized for SSO authentication, workforce identity, etc.

It stands for "internal data model". The reason initially was that there were fields that were not necessarily parsed from the log, but that may change the behavior (in fact the first use case was is_alert that added a little red triangle to the parser based alerts, is_significant that exposed them to the ListAlerts api etc. There were also disambiguation keys other internal uses). So initially it was just a couple of fields that changed how things behaved. Over time this evolved as the Chronicle internal data model started including the Entity Data model as parallel to UDM, so now idm is the wrapper around idm.entity and idm.read_only_udm, both of which you can access in rules in their own ways.