sap
March 22, 2023 · View on GitHub
Expression
product = "sap"
Fields
| Field | Core | Detection | Informational |
|---|---|---|---|
| severity | ✓ | ||
| src_ip | ✓ | ||
| server | ✓ | ||
| src_mac | ✓ | ||
| activity_id | ✓ | ||
| user_sid | ✓ | ||
| client | ✓ | ||
| result_code | ✓ | ||
| category | ✓ | ||
| aid | ✓ | ||
| transaction | ✓ | ||
| object | ✓ |
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| app-activity | |||||
| app-login | additional_info | Default | ✓ | ||
| file-download | |||||
| user-create | |||||
| user-delete | |||||
| user-lock | |||||
| user-unlock |