How to Integrate Your SAP Log with a Splunk SIEM?

Introduction

Configure SAP NetWeaver to Generate Audit Log Events

Dynamic Configuration

Static Configuration

Install a SPLUNK Forwarder on the SAP System

Create a New Index and Configure a Data Receiver on the Splunk Indexer

Forward SAP Audit Logs to the Splunk Indexer

SAP Audit Log Parsing

First SAP SIEM Use Case - Detect Account Brute-Force Attacks

Create a Brute-Force Splunk Alert

Further SAP SIEM Use Cases