Set up custom security logs

[christineha]

Hello Community,

I have a request from a customer who needs to implement monitoring on the following events to comply with their internal Security requirements :

• User logons and logon attempts (successful and failed)
• User account modifications (creation, modification, deletion, role changes)
• Access to sensitive data and critical transactions
• Unauthorized access attempts (authorization failures)
• System configuration and security parameter changes
• Privileged user activities (administrators)

Their Security requirements are the following:

1. Confirmation that the Security Audit Log is enabled on their tenant with capture of critical security events
2. Access to the “Display Security Audit Log” Fiori application for security/audit teams
3. Documentation on the complete list of events captured in their Cloud edition
4. Ability to export these logs to enable automated security alerting and monitoring

I was advised that CAS (Cloud Application Services) could address these kind of needs but these are not for "one shot" request, CAS are indeed used for recurring activities ; I also raised a CISA request but the URL they've provided seems to be outdated. 

Thanks much in advance

[jude_bradley]

Are you using SM20 or RSAU_READ_LOG for capturing this data? 

https://community.sap.com/t5/application-development-and-automation-blog-posts/analysis-and-recommen... is a good starting point.