topic Re: Security audit log for user specific and table in DevOps and System Administration Forum

Security audit log for user specific and table

former_member850355 — Mon, 10 Apr 2023 01:34:18 GMT

Hi,

I would like to activate the security audit log for a set of tables user specific. Is it possible in SM19? If yes, which option i would need to select.

Does it capture the changes in DBTABLOG or any other table available?

Re: Security audit log for user specific and table

Neeraj_Jain1 — Mon, 10 Apr 2023 01:49:19 GMT

Hello cravisap,

Please check transaction AUT10 if it's works for you.

Regards,

Neeraj Jain

Re: Security audit log for user specific and table

former_member850355 — Mon, 10 Apr 2023 02:13:43 GMT

Hi Neeraj,

Thank you for sharing the information. I do not have AUT10 tcode in my system. I am using SAP BW on oracle system.

I tried to check the data in SCU3 which would display all the data logs especially what data has been changed.

I want to capture the log data for a user specific for a list of tables. For instance, i have 100 users with 1000 tables.

I want to capture USER10 manual activity on TABLE05 data. I dont want to capture all the users information. How to configure it.

Re: Security audit log for user specific and table

Neeraj_Jain1 — Mon, 10 Apr 2023 02:18:33 GMT

Please refer below SAP help link if it works:

https://help.sap.com/docs/SAP_NETWEAVER_740/56bf1265a92e4b4d9a72448c579887af/6c57bf393b57ac22e10000000a11402f.html?locale=en-US

Re: Security audit log for user specific and table

marco_hammel2 — Tue, 11 Apr 2023 09:56:41 GMT

Hi @cravisap ,

What you want to achieve is not possible by security audit log (standard) events only. I'd either require:

1. A correlation of security audit log events with events recorded in DBTablog (Table change log - requires the table to be activated for logging). For example: SAL Event -> User starts SE16N and subsequentially DU9 event for the loaded table and susequential record edits for the table. This is one of many possible use cases with different possible event sources.

2. Implement BAdIs and user exists where necessary to log custom SAL events as per note 1941568.

3. Adressing such events on the user's endpoints for example with EDR tooling

4. A combination of 1 too 3

Certain SAP security solution and service providers (like us at NO MONKEY ) provide consultancy and training for such detection scenarios and can guide through the process of implementing such capabilities.

As a general advice: Start with understanding and model your threats and attack surface first to decide on a meaningful prioritization to implement detection capabilities.

Marco