Monitoring Security Alerts with SAP Solution Manager
There are several apps available in SAP Solution Manager for monitoring security alerts for SAP systems. The most longstanding is the Alert Inbox which provides an overview of alerts by process area. Guided procedures for investigating security alerts are executed from the Alert Inbox. Another option is System Monitoring which provides a more user-friendly interface for navigating incidents than the Alert Inbox. System Monitoring includes the Alert Ticker displayed in the right pane of the app for monitoring incidents in real-time.
SAP Solution Manager 7.2 SP07 introduced a third option for monitoring alerts called Monitor Systems. The app is delivered in the new work center Application Operations.
System Monitoring and the Alert Inbox are Web Dynpro applications. Monitor Systems, however, is a SAPUI5 application based on the Fiori framework. Therefore, Monitor Systems delivers exceptional performance with alerts loading and refreshing at much faster rates than both the Alert Inbox and System Monitoring. The performance gains are considerable even for SAP Solution Manager installations running on conventional databases rather than SAP HANA.
You can access Monitor Systems from the SAP Fiori Launchpad using the roles SAP_STUI_APPOPS_AUTH and SAP_STUI_APPOPS_TCR.
The initial screen summarizes alerts open alerts by systems and components.
Alerts are categorized by the groups below. Security alerts triggered by the Cybersecurity Extension for SAP Solution Manager are categorized in the Configuration and Exception classes.
Results can be filtered or sorted by clicking by system and category.
Systems can also be labeled as favorites for fast selection.
You can view details of open alerts for each system by clicking on the system. Below are alerts for security configuration issues impacting system AS2.
Below are security exceptions detected through real-time monitoring of event logs in the system.
We can drill down into the details of each alert by clicking on Critical Metrics. For example, we can investigate the alert below for the Actions by the Standard SAP* User Alert by reviewing the relevant metric.
The Metric Details reveals that there was an attempted logon with the SAP* user from IP address 10.8.91.2 at 12:51 on 2019-08-14. We can execute a guided procedure that will investigate other actions from the source IP directly in the Security Audit Log.
The results can be shared with security operations teams through email by clicking on the Notify option in the Metric Details.
In another example, we can drill down into the alert for active users logged into the system with SAP_ALL in their user buffer to investigate potential privilege escalation. The profile should not be used in productive systems.
