Sap Se

Sap Ag

Florian Chrosziel

Marco Rodeck

Thomas Kunz

Harish Mehta

Rita Merkel

Hartwig Seifert

Wei-Guo Peng

Eugen Pritzkau

Lin Luo

Nan Zhang

Thorsten Menke

Jona Hassforther

Kathrin Nos

Hristina Dinkova

Otto Boehrer

Joerg Kraemer

Daniel Kartmann

Joscha Philipp Bohn

Stefan Rossmanith

Omar-Alexander Al-Hujaj

Jens Baumgart

Frank Gales

Otto Böhrer

Fritz Hoffmeister

Rene Zink

A content replication connector receives control data associated with replication of content data from a source system. Based on the control data, the content replication connector fetches the content data from the source system, converts the content data from a first data format to a second data format, and sends the content data to a content replication server. The content replication server replicates the content data, and a target system fetches the content data from the content replication server.

Bi-directional content replication logic for enterprise threat detection

Search results are received from an initiated free text search of log data from one or more logs, where the free text is performed using search terms entered into a free text search graphical user interface. A set of at least one search result is selected from the search results containing an event desired to be identified in a completed enterprise threat detection (ETD) pattern. A forensic lab application is rendered to complete an ETD pattern. An event filter is added for an event type based on normalized log data to a path. A relative ETD pattern time range is set and an ETD pattern is completed based on the added event filter.

Pattern creation in enterprise threat detection

A computer-implemented method generates a trigger registration for a selected triggering type. The generated trigger registration is stored in a triggering persistency. A received event from an event persistency is analyzed and data associated with the analyzed event is compared with the triggering persistency. Based on the comparison and using a pattern execution framework, an enterprise threat detection (ETD) pattern is processed to perform actions responsive to the received event.

Realtime triggering framework

One or more entities are selected for which logged Events are to be displayed in an Event Series Chart. One or more filters and a timeframe are selected. Events are fetched from one or more selected log files based on the one or more selected filters and the timeframe. The fetched Events are displayed in an Event Series Chart according to an associated timestamp and identification Event property value associated with each fetched Event.

Displaying a series of events along a time axis in enterprise threat detection

A filter is selected from one or more filters defined for an ETD Network Graph. Events are fetched from the selected log files based on the selected filter and entities identified based on the fetched Events. Relationships are determined between the identified entities, and the determined relationships and identified entities are displayed in the ETD Network Graph. An identified entity is selected to filter data in an ETD Event Series Chart. An Event is selected in the ETD Event Series Chart to display Event Attributes in an Event Attribute Dialog. An Event Attribute is selected in the Event Attribute Dialog to filter Events in the ETD Event Series Chart.

Analysis of complex relationships among information technology security-relevant entities using a network graph

An enterprise threat detection (ETD) forensic workspace is established according to a particular timeframe and permitting defining a selection of data types from available log data for an evaluation of events associated with one or more entities. A chart is defined illustrating a graphical distribution of a particular data type in the forensic workspace. A snapshot associated with the chart is generated, the snapshot saving a copy of all data necessary to re-create the chart into an associated snapshot object. The snapshot is associated with a snapshot page for containing the snapshot and the snapshot page is saved within the ETD forensic workspace.

Snapshot of a forensic investigation for enterprise threat detection

A log entry is received at a streaming component of an enterprise threat detection (ETD) system from a real-time push application programming interface (API) associated with a backend computing system. The received log entry is parsed using a runtime parser associated with the streaming component into mapped data in an ETD format compatible with the ETD system. The mapped data is transferred to an ETD streaming project and enriched. The streaming component writes the enriched data into a database associated with the ETD system.

Real-time push API for log events in enterprise threat detection

Subnet information and location information is received from a database by a smart data streaming engine (SDS). A particular subnet of the subnet information is associated with a particular location of the location information by a globally unique location ID value. Log event data received in the SDS is normalized as normalized log event data. The normalized log event data is enriched with subnet and location information as enriched log event data and written into a log event persistence in the database. A subnet ID value retrieved from an enriched log event of the enriched log event data is used by an enterprise threat detection (ETD) system to determine a location associated with the enriched log event using a location ID value associated with the subnet ID.

Location enrichment in enterprise threat detection

A path associated with a set of selected log data is defined. An indication is received on a graphical user interface (GUI) to generate a bubblegram associated with the path, wherein the bubblegram comprises one or more bubbles, each bubble representing a particular dimension associated with the selected path. The one or more bubbles are rendered on the GUI according to a performed ranking of the one or more bubbles. A bubble is selected to generate a filter for the path based on the dimension associated with the bubble. A subsequent bubblegram is rendered based on a narrowed set of the selected log data.

Visualization of data distributed in multiple dimensions

Published enterprise threat detection (ETD) security notes are accessed in a computer data store. Applicability of the published ETD security notes are determined for an information technology computing (IT) landscape. A determination is made that a particular applicable ETD security note has not yet been implemented in the IT computing landscape. Aggregated impact of compromise (IoC) and state of compromise (SoC) values associated with the published ETD security note are analyzed and a computing system patching action is performed based on the aggregated IoC and SoC values.

Real-time evaluation of impact- and state-of-compromise due to vulnerabilities described in enterprise threat detection security notes

Data characterizing a plurality of data accesses of objects at one or more log points is received by a data access framework. Thereafter, data accesses requiring logging are identified and one or more corresponding pre-specified attributes are then logged. Related apparatus, systems, techniques and articles are also described.

Data access logging

Systems, computer products, and computer-implemented methods may be directed to publishing information about a service offered by a service provider at a first services registry. The information about the service can be communicated to a second services registry. An indication of a subscription to the service may be received by a service consumer from the second services registry. Information about the subscribed service can be communicated to the second services registry.

Distribution of messages in system landscapes

Techniques for managing information exchange between business entities include identifying a plurality of routing rules stored in a database of a first business entity computing system; receiving a request for a business transaction through an application of a plurality of applications of the first business entity computing system; determining, based on the identified routing rules, an identifiable business context reference (IBCR) associated with a second business entity computing system, the IBC comprising a unique identifier associated with the second business entity and a first plurality of business data attributes associated with the second business entity; determining, based on the identified IBCR, a communication connection associated with the IBC and an identifiable business context (IBC) associated with the first business entity computing system; and initiating the business transaction between the first business entity computing system and the second business entity computing system through the determined communication connection.

Growing community of inventors

St. Leon-Rot, Germany

Florian Chrosziel