|
CorrelationSearch |
DataModel |
EventType |
Description |
|---|---|---|---|
|
Initial or WellKnown PW |
Alerts |
RSUSR003 |
Detects when an account password is too common or has not yet been reset from its initial state. |
|
Dialog User PW Expiration Violation |
N/A |
RSUSR200 |
Detects when an SAP Dialog user is violating the password expiration policy. |
|
PW Reset NonDialog |
N/A |
RSUSR200 |
Detects password reset on a non-dialog user in SAP. |
|
Static Profile Parameter Change |
Change |
RZ10_LOG |
Detects changes to static profile parameters in SAP systems. |
|
Client Open for Change |
N/A |
SCC4 |
Detects when an SAP client has been opened for a change. |
|
New Client Created |
N/A |
SCC4 |
Detects a new client in SAP. |
|
Namespace Open for Change |
N/A |
SE06 |
Detects when an SAP namespace is open for change. |
|
Manual Function Module Execution |
Data_Access |
SE37_LOG |
Indicates function modules that have been executed manually by users in an SAP system. |
|
Many Accounts One Terminal |
Network_Sessions |
SM04 |
Detects multiples accounts logging in from a single terminal. |
|
One Account Many Geos |
N/A |
SM04 |
Detects one account logging in from multiple geographies. |
|
One Account Many Terminals |
Network_Sessions |
SM04 |
Detects one account logging in from multiple terminals. |
|
Account High Transaction Failure |
Authentication |
SM20 |
Detects a high number of transaction failures in the set timeframe. |
|
Account Multiple Login Failures |
Authentication |
SM20 |
Detects multiple login failures from a user account on an SAP system. |
|
Audit Log Deletion |
Authentication |
SM20 |
Detects an audit log deletion. |
|
File Downloads |
Authentication |
SM20 |
Detects data downloads from SAP systems, indicating potential data theft. |
|
Logical Path Access Failure |
Authentication |
SM20 |
Detects logical path access failure in an SAP system. |
|
Privileged Account Login |
Authentication |
SM20 |
Detects login events for privileged SAP accounts SAP* and DDIC. |
|
SM59 Destination Deletion |
Alerts |
SM21_LOG |
Detects deletion of SM59 destinations in SAP systems. |
|
Dynamic Profile Parameter Change |
Alerts |
SM21_LOG |
Detects changes in dynamic profile parameters. |
|
IDOC Removal |
Alerts |
SM21_LOG |
Detects removal of IDocs in SAP systems. |
|
SM59 Destination Change |
Alerts |
SM21_LOG |
Detects deletion of RFC destinations in SAP systems. |
|
Debug Mode Execution |
Alerts |
SM21_LOG |
Detects execution of debug mode on SAP systems. |
|
OS Command Change |
Change |
SM69 |
Detects execution of an OS command. |
|
Sensitive Transaction Execution |
N/A |
STAD |
Detects execution of a set of predefined sensitive transactions. Uses the PowerConnect app's "sensitive_tcodes" lookup to define sensitive transactions. |
|
Transport Added to Import Queue |
Change |
STMS_TPLOG |
Detects when a user adds a transport to the import queue on an SAP system. |
|
Transport Removed from Import Queue |
Change |
STMS_TPLOG |
Detects when a user removes a transport to the import queue on an SAP system. |
|
Certificate Expired |
Certificates |
STRUST |
Detects expired SSL certificates. |
|
Certificate Changes |
Change |
STRUST_HISTORY |
Detects changes in SSL certificates. |
|
Profile Change |
Change |
SUIM |
Detects profile change in SAP systems. |
|
User Change |
Change |
SUIM |
Detects user changes in SAP. Does not conflict with correlation searches for admin profile assignments. |
|
Admin Profile Assigned |
Change |
SUIM |
Detects assignment of admin profile in SAP. |
|
New User Created |
Change |
SUIM |
Detects creation of a new user in SAP. |
|
Sensitive Role Assigned |
N/A |
SUIM |
Detects assignment of a sensitive user role in SAP. Uses the PowerConnect app's "sensitive_user_roles" lookup to define sensitive roles. |
|
User Type Changed |
Change |
SUIM |
Detects change in user type in SAP. |
|
User Unlocked |
Change |
SUIM |
Detects user unlocks in SAP. |
|
Connectivity Object Change |
Change |
UCON_LOG |
Detects connectivity object changes in SAP. |
|
User with multiple composite roles |
Authentication |
SU01 |
Scans user security config to determine when a user has been assigned multiple composite roles. |
|
Potential Duplicate Users |
Authentication |
SU01 |
Scans user security configuration data to detect accounts with identical first and last names. |