SM04
Data Description
The SM04 event is used in SAP to view users logged in.
Potential Use Cases
This event could be used in the following scenarios:
Identify potential security threats from user log-in events.
Trend user log-ins over time.
Splunk Event
The event will look like this in Splunk:
![](../__attachments/3042050079/image-20210406-185813.png?inst-v=cc5d1456-4022-4264-b658-e73cfc9f0416)
SAP Navigation
Log into the managed system and execute the SM04 transaction code. The data that is displayed will match the data that is extracted and sent to Splunk.
![](../__attachments/3042050079/image-20210406-185941.png?inst-v=cc5d1456-4022-4264-b658-e73cfc9f0416)