Enterprise Threat Monitor for SAP

4638

ESNC - Enterprise Security and Compliance Community

App Support Tiers

OpenText SUPPORTED

Support via OpenText Software Support, with a ticket filed against the associated product.

PARTNER

OpenText offers a content partnership program for select partners. Support for Partner Content offerings is provided by the partner and not by OpenText of the OpenText community.

OpenText COMMUNITY

OpenText Community Content is provided by OpenText for the benefit of customers, support for it is not available via OpenText Software Support but through specific community content forums.

COMMUNITY

Community Contributed Content is provided by OpenText customers and supported by them.

EARLY ACCESS

Show less ...Show more

The downloads referenced under the "Cybersecurity Early Access" category are made available to subscribers to mitigate time-critical issues but have not undergone formal quality and performance testing associated with official OpenText/Cybersecurity product releases. OpenText has a multi-stage Quality Assurance process. During Stage 1 we conduct a resource analysis, field mapping, ensure content level 1 functionality and analysis in our sandbox environment. Stage 2 is a complete validation including production validation. This package has cleared Stage 1 validation and therefore should be deployed with the appropriate pre-production validation. OpenText strongly recommends that any downloaded content is first checked and tested thoroughly in a non-production environment before committing to production. We welcome feedback and, should any content be shown to be faulty, detrimental or carry an incorrect claim of authorship, we shall endeavor to remove or correct such content as promptly as reasonably possible once notified and validated.

ESNC - Enterprise Security and Compliance | Community

ETM integrates real-time SAP security into ArcSight. ETM has over 300 SAP-specific threat monitoring cases built-in and preconfigured, including 0-day SAP attack signatures and common attacks such as misusing debug/replace on SAP to bypass authorizations.

158 downloads

Description

Enterprise Threat Monitor monitors SAP systems for threats such as:

SAP debugging is used for bypassing transaction authorizations
An unauthorized user assigned a critical SAP role to another user
A user downloaded customer master data of a production system
An SAP system is opened to changes
An HR terminated employee's SAP account is used for connecting to an SAP system
Failed logins of multiple SAP users from the same workstation
Account sharing

ETM connects to SAP systems and analyzes different information sources for determining the threats. The analysis includes SAP security logs, system logs, SAP change documents, transport records, user master data changes, ESNC’s fraud-related analysis results, and many others. ETM correlates these events via user behavior analysis and its SAP-specific attack signatures, including zero-day vulnerabilities.

ETM uses adaptive noise reduction for eliminating false positives and delivering high-quality offense information.