icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Enterprise Threat Monitor for SAP
SHA256 checksum (enterprise-threat-monitor-for-sap_3192.tgz) 488db15893d0082d3935eb9bf9ca43763d5bffbdd4b77560980ca17e8a7b086d
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Enterprise Threat Monitor for SAP

ETM integrates real-time SAP security into Splunk. ETM has over 300 SAP specific threat monitoring cases built-in and preconfigured, which includes 0-day SAP attack signatures, common attacks such using debug/replace on SAP to bypass authorizations, and compliance related issues such as SAP account sharing or download of customer master data.

ETM uses machine learning to adapt to your organization's SAP usage patterns and to reduce noise when detecting threats. This allows SOC teams to spend significantly less time in reviewing the events.

With Enterprise Threat Monitor, you don't need to send raw SAP security logs to Splunk and build and maintain your own use cases. It just works.

Integrating SAP security events with Splunk

Enterprise Threat Monitor monitors SAP systems for threats such as:

  • SAP debugging is used for bypassing transaction authorizations
  • A user downloaded customer master data of a production system
  • An SAP system is opened to changes
  • An HR terminated employee's SAP account is used for connecting to an SAP system
  • Failed logons of multiple SAP users from the same workstation
  • An unauthorized user assigned a critical SAP role to another user
  • Account sharing

ETM connects to SAP systems and analyzes different information sources for determining the threats. Analysis includes SAP security logs, system logs, SAP change documents, transport records, user master data changes, ESNC’s fraud related analysis results and many others.

ETM correlates these events via user behavior analysis and its SAP-specific attack signatures, including zero-day vulnerabilities:

SAP Splunk

Click for more information how you can integrate SAP and Splunk using Enterprise Threat Monitor.

Additional Information:

Below you can find information for configuring and running Enterprise Threat Monitor

Configuring the SAP system

Please click for instructions for activating SAP Security Monitoring on your landscape.

Implementing an Efficient Detection and Response process

Enterprise Threat Monitor uses the Efficient Security Response (ESR) methodology to build an efficient process for responding to threats and training the system so that your business activity is learned and noise is eliminated in a short time.

For more information about the ESR methodology you can refer to: Responding to SAP attacks

Protection against Zero-Days

You can refer to a case study of SAP specific 0-days using the link: Protecting SAP GRC

Protection, Detection and Response for SAP Systems

Enterprise Threat Monitor is the SAP real-time monitoring and threat detection component of ESNC Security Suite. Click to find out how ETM builds a safety net for SAP security vulnerabilities that ESNC Security Suite discovers, including vulnerabilities in custom ABAP code. You can also import your SAP security audit results to ETM.

Downloading the Threat Detection Engine for SAP

Please use this link to download Enterprise Threat Monitor components for connecting your SAP system to Splunk.

Contacting Us

Please don't hesitate to contact us if you require any assistance.

Release Notes

Version 3.1.92
Aug. 19, 2018
  • Over 100 new SAP specific threat monitoring cases added, including detection of malicious SAP transports.
  • Work less: improved Adaptive Noise Reduction (ANR) eliminated over 98% of false positives at a recent real-world implementation.
  • User Behavior Analytics (UBA) specific to SAP applications improved
  • Update ETM agent to latest to receive the 2020 updates.

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.