How to Build Custom SAP Security Monitoring Scripts

Understanding SAP Security Monitoring Requirements

Before writing a single line of ABAP, you must define what you are monitoring and why. SAP security monitoring scripts generally fall into five functional categories:

• Transaction usage monitoring — Tracking which users execute high-risk transactions like SE16 (data browser), SU01 (user maintenance), or SM30 (table maintenance).
• Authorization change detection — Capturing modifications to user roles, profiles, or direct authorization assignments via SU10 or PFCG.
• Segregation of duties (SoD) violation scanning — Detecting users holding conflicting authorization combinations, such as both goods receipt posting and vendor master creation in procurement.
• Insider threat behavior analytics — Identifying anomalous patterns like after-hours login, excessive failed RFC logins, or unexpected download activities.
• Configuration drift monitoring — Tracking changes to security-relevant system parameters in table TPARA, RFC destinations, or system profile parameters.

SAP Basis administrators and IT security managers responsible for ERP environments should prioritize monitoring the highest-risk areas first: production system access, sensitive authorization objects (S_TABU_DIS, S_TCODE), and RFC gateway activity. These areas represent the most common attack vectors in real-world SAP compromises documented by the SAP Security Response Team.

Core ABAP Techniques for Security Scripting

Effective SAP security scripts rely on a standard set of ABAP development patterns. You are not building a full application — you are building targeted, reusable data extraction and analysis routines.

Accessing the Security Audit Log

The primary data source for transaction-level monitoring is the SAP Security Audit Log, which records auditable events based on your audit configuration (SM19). To extract records programmatically, use function module SM20_GET_LOG_DATA:

DATA: lt_audit_log TYPE sm20_tab,
      lv_date_from TYPE sm20_date VALUE '20250101',
      lv_time_from TYPE sm20_time VALUE '000000'.

CALL FUNCTION 'SM20_GET_LOG_DATA'
  EXPORTING
    date_from = lv_date_from
    time_from = lv_time_from
  TABLES
    sm20_tab  = lt_audit_log.

This returns a list of all audit records matching your filter criteria. You can then loop over lt_audit_log and evaluate fields like USERNAME, TCODE, EVENTID, and MESSAGE to detect unauthorized transaction execution. For sustained monitoring, schedule this report via SM36 with a frequency of 10–15 minutes in production systems.

User Authorization and Role Analysis

To check current user authorizations programmatically, you can call the ABAP authorization check function modules directly:

DATA: lv_user(12) TYPE c VALUE 'DEVELOPER01',
      lv_tcode(20) TYPE c VALUE 'SE16'.

CALL FUNCTION 'AUTHORITY_CHECK_TCODE'
  EXPORTING
    user  = lv_user
    tcode = lv_tcode
  EXCEPTIONS
    no_authority = 1
    user_does_not_exist = 2
    OTHERS = 3.

IF sy-subrc = 1.
  " User lacks authorization — log for monitoring
ENDIF.

For role composition analysis, query tables AGR_USERS (user-to-role assignment), AGR_1251 (role-to-authorization object mapping), and AGR_TEXTS (role descriptions). Joining these tables lets you reconstruct effective authorizations per user, critical for SoD scanning.

RFC and Gateway Monitoring

RFC abuse is a common vector in SAP attacks. Monitor RFC destinations using table RFC_DEST and logon attempts via table USR41 for current sessions. The function module RFC_GET_CLIENT_INFORMATION provides real-time connection data. For historical RFC activity, query the security audit log filtered by event class RFC_LOGON.

Building a Script Framework for SoD Detection

Segregation of duties violations remain one of the most common findings in SAP security audits under SOX and ISO 27001. A custom SoD detection script follows a three-step process:

This framework runs efficiently when scheduled as a weekly background job via SM36. In environments with more than 5,000 users where performance becomes a concern, consider using SAP's bundled AIS (Access Intelligence Service) or evaluating dedicated tools like CyberSilo SAP Guardian, which pre-packages SoD rules for common SAP modules and runs risk analysis without heavy ABAP development.

Integrating Custom Scripts with SIEM and Alerting

Raw script output is only useful if it reaches the security operations center (SOC) in a timely, parsable format. There are three integration approaches that enterprise teams typically use:

File-Based Export to SIEM

Write monitoring results to a dedicated application server directory using ABAP's OPEN DATASET statement in Unicode mode. Format the output as structured JSON or syslog-compatible CEF (Common Event Format). The SIEM's file collector can then ingest these flat files on a cron schedule. This method works for any SIEM platform — Splunk, QRadar, or Microsoft Sentinel — but introduces latency equal to your collection interval.

RFC-Based Push to SOAR or SIEM

For near-real-time alerting, write a BAPI or RFC-enabled function module that your SIEM or SOAR platform can call. For example, configure ThreatHawk SIEM to pull SAP monitoring records via RFC every 60 seconds. This approach reduces latency but places more load on the SAP application server — limit the data volume by pushing only delta changes rather than full extracts.

Integration via Asynchronous Messaging

For organizations using SAP's own eventing infrastructure, publish monitoring alerts as IDocs or XML messages to an integration middleware layer (SAP PI/PO or third-party ESB). The middleware then transforms and forwards alerts to the SOC. This pattern is the most scalable for large deployments but requires significant infrastructure setup.

Scheduling and Maintenance Best Practices

Custom ABAP scripts require ongoing care. SAP system upgrades, support package installations, and authorization object changes can all break your monitoring logic silently. Follow these operational guidelines:

• Version control all scripts in ABAP git (gCTS) or a transport management system. Never maintain monitoring scripts only in the development environment — transport them through the standard Quality-to-Production pipeline.
• Set a quarterly review cycle for authorization tables that your scripts query. SAP releases new authorization objects with each support package stack — if your script checks a deprecated object, it will return false positives or miss new risks.
• Monitor the monitor. Implement a watchdog job that confirms your monitoring script ran successfully within its expected window. A silent failure of your SAP security monitoring can create months of unmonitored exposure.
• Define data retention per compliance frameworks. SOX requires audit log retention for seven years. If your custom script generates its own monitoring tables, ensure those tables are included in your SAP archiving cycle (transaction SARA).

Comparing Custom Scripts vs. Dedicated SAP Security Solutions

Organizations evaluating whether to build or buy SAP security monitoring capabilities should consider this comparison across key decision criteria:

Custom scripts remain a viable option for organizations with dedicated ABAP development capacity and relatively small SAP landscapes (under 1,000 users). For larger enterprises across financial services cybersecurity, manufacturing cybersecurity, or regulated sectors with multiple SAP instances, a dedicated monitoring solution reduces long-term operational risk. Teams that already use top 10 SIEM tools will find that SAP Guardian integrates directly with their existing SOC workflow, eliminating the need for custom middleware bridges.

Extending Scripts with Threat Intelligence and Behavioral Analytics

Advanced monitoring scripts can incorporate threat intelligence feeds and behavioral baseline comparisons to detect sophisticated attacks that static rule checks miss. For example, you can cross-reference RFC source IPs against known malicious indicators from a ThreatSearch TIP. While custom scripting makes this possible, it requires ongoing feed maintenance and integration development.

Behavioral baselines are more straightforward to implement in ABAP. Collect historical usage data per user and transaction over a 30-day window, compute standard deviation thresholds, and flag sessions that exceed three standard deviations from the mean. Store baseline results in a periodic table like ZMON_BASELINE and refresh it weekly via an SM36 scheduled job.

For organizations monitoring specifically for insider threats, consider combining download activity logs (table SM04 for active sessions, table USR02 for last logon timestamp) with HR master data to detect users accessing the system after their last employment date — a classic indicator of terminated employee account abuse.

Compliance Implications for SOX and ISO 27001

Custom monitoring scripts must satisfy the same audit requirements as any other security control. For SOX compliance, your script inventory should include:

• Program documentation describing what the script monitors, how it extracts data, and how it escalates findings.
• Change management records for every script modification, including transport history and approval sign-offs.
• Configurable threshold justification — audit teams will ask why you chose a specific polling interval or SoD rule set.
• Evidence of execution — retain job logs from SM37 showing that your monitoring scripts ran without error during the audit period.

Under ISO 27001 Annex A.9 (Access Control), your scripts must demonstrate that monitoring covers both logical access controls (user ID management, privilege review) and physical separation of duties. Ensure your script outputs are timestamped and immutable — write results to tables that prohibit direct updates by application users.

Migrating from Custom Scripts to Enterprise-Grade Monitoring

At some threshold of SAP landscape complexity, custom scripts become a liability. Common pain points include scripts failing silently, alert fatigue from unvalidated false positives, and inability to correlate SAP activity with network or endpoint telemetry. Leaders across government and defense cybersecurity and energy sectors have shared that the breaking point is typically around three SAP instances or 2,000 users — beyond that, dedicated monitoring infrastructure is more cost-effective than ABAP maintenance.

When transitioning, keep your custom scripts running in parallel with the new solution for at least one full audit cycle. Compare findings to validate the new tool's coverage and tune its rule sensitivity. Retire scripts only after confidence in the replacement tool is established through two consecutive months of identical or superior detection results.

Many teams start with a hybrid approach: they deploy CyberSilo SAP Guardian to handle high-volume monitoring (audit log ingestion, SoD scanning, real-time alerts) while keeping one or two specialized custom scripts for niche requirements unique to their environment. This gives them the best of both worlds: enterprise-grade monitoring coverage and the flexibility to address edge cases without full ABAP dependency.