SAP PowerConnect Content Pack for Splunk Enterprise Security - v1.1.0 Release Notes

Default settings are provided for all content, and it is encouraged that each customer adapt this content to their implementation of Enterprise Security.

Companion PowerConnect Splunk App Version

• 7.3.0

New

• Connectivity Object Change

  • (UCON_LOG) Detects connectivity object changes in SAP.

• Dynamic Profile Parameter Change

  • (SM21_LOG) Detects changes in dynamic profile parameters.

• IDOC Removal

  • (SM21_LOG) Detects removal of IDocs in SAP systems.

• Manual Function Module Execution

  • (SE37_LOG) Indicates function modules that have been executed manually by users in an SAP system.

• OS Command Change

  • (SM69) Detects execution of an OS command.

• Profile Change

  • (SUIM) Detects profile change in SAP systems.

• SM59 Destination Change

  • (SM21_LOG) Detects deletion of SM59 destinations in SAP systems.

• SM59 Destination Deletion

  • (SM21_LOG) Detects deletion of SM59 destinations in SAP systems.

• Static Profile Parameter Change

  • (RZ10_LOG) Detects changes to static profile parameters in SAP systems.

• Transport Added to import Queue

  • (STMS_TPLOG) Detects when a user adds a transport to the import queue on an SAP system.

• Transport Removed from Import Queue

  • (STMS_TPLOG) Detects when a user removes a transport to the import queue on an SAP system.

• User Change

  • (SUIM) Detects user changes in SAP. Does not conflict with correlation searches for admin profile assignments.

Fixes        

• CIM Mapping removed from this app. Mapping in core app modified to share globally.