ProTip for SIEM: SAP data source configuration with the SIEM

Version 1

    ESM supports the collection of SAP user, user role, and user authorization events from SAP tables without requiring auditing to be turned on in SAP.  For information on how to do this, see KB77396 (https://kc.mcafee.com/corporate/index?page=content&id=KB77396 )