Sap Se

Omar-Alexander Al-Hujaj

Volker Guzman

Thorsten Menke

Jens Baumgart

Kathrin Nos

Jona Hassforther

Anne Jacobi

Florian Kraemer

Thanh-Phong Lam

Harish Mehta

Wei-Guo Peng

Eugen Pritzkau

Lin Luo

Kevin Schwab

Hartwig Seifert

Stefan Rossmanith

Masoud Aghadavoodi Jolfaei

Thomas Kunz

Marco Rodeck

Florian Chrosziel

Michael Acker

Sasan Memar-Zahedani

Marc Noe

Alexander Wachter

Daniel Walz

Hong-Nghiep Phan

Michael Kraemer

Thomas Weiss

A content replication connector receives control data associated with replication of content data from a source system. Based on the control data, the content replication connector fetches the content data from the source system, converts the content data from a first data format to a second data format, and sends the content data to a content replication server. The content replication server replicates the content data, and a target system fetches the content data from the content replication server.

Bi-directional content replication logic for enterprise threat detection

A computer-implemented method receives a program code and a signature associated with the program code from a database persistency associated with an enterprise threat detection (ETD) system. The received program code is associated with a configuration check, and the configuration check is developed at a development computing system and can collect information associated with a computing system. The received program code and the signature associated with the program code is distributed to a plurality of computing systems that are monitored by the ETD system. At least one configuration check result is received, and the configuration check result is generated by executing the program code on the computing system. The at least one configuration check result then transmitted to the database persistence, and the at least one result is displayed on a database graphical user interface (GUI) associated with the database persistency.

Real-time configuration check framework

A selection of data types is defined from available log data for an evaluation of events associated with an entity. One or more evaluations associated with the entity are defined and reference data is generated from the selection of data types based on the one or more defined evaluations. The one or more evaluations are grouped into a pattern. A three dimensional (3D) score diversity diagram visualization is initialized for display in a graphical user interface, where a point representing the entity in the visualization is localized in 3D space at a coordinate based on two-dimensional (2D) coordinates in a 2D coordinate system of a centroid of the calculated area of a polygon placed to into the 2D coordinate system and defined by the values of each evaluation associated with the entity.

Anomaly detection in enterprise threat detection

A first Event is identified from a normalized log persistency layer, where the first Event is associated with an attack on a computing system. A plurality of Events are fetched from the normalized log persistency layer, where each fetched Event correlates with its neighboring fetched Event by at least one correlation attribute, and each of the fetched Event and the first Event are presented on a graphical user interface as a chain of events. A workspace is generated, where the workspace comprises a series of attack paths, where each attack path corresponds to one Event in the chain of events. An ETD pattern is created based on the attack paths in the workspace.

Pattern creation based on an attack path

A Content Service executing in a cloud-computing-based Cloud Platform receives enterprise threat detection (ETD) Content transmitted from an ETD Content Development System (CDS) as a publication of the ETD Content from the ETD CDS. The received ETD Content is stored into a Content Management System (CMS). A determination is made of a registered Client ETD System for which the ETD Content is relevant. The ETD Content is published to the registered Client ETD System.

Distributing cloud-computing platform content to enterprise threat detection systems

A log processing job executing on a log producing computing system is initiated for processing log data associated with the log producing computing system. Log entries are determined to be available for processing. At least one instance of a Log Extractor Factory, Reader, and Transformation component are instantiated for reading and transforming the log data. Read log data is transformed into a common semantic format as transformed log data and transmitted in real-time to a Streaming Component for storage in an Enterprise Threat Detection (ETD) System. A recovery point is stored with a recovery timestamp indicating a next log entry in the log data to process.

Providing semantic connectivity between a java application server and enterprise threat detection system using a J2EE data

A method, a system, and a computer-program product for providing a unified connectivity to a plurality of business processes are disclosed. A plurality of business processes for connection to a server are provided. A uniform configuration connection assembly for connecting the plurality of business processes to the server is generated. The uniform configuration connection assembly is configured based on at least one profile corresponding to at least one business process in the plurality of business processes and contains at least one connectivity artifact for performing at least one connectivity task for at least one business process in the plurality of business processes. At least a portion of the plurality of business processes to the server is connected based on the generated uniform configuration connection assembly.

ABAP Unified connectivity

Growing community of inventors

Bad Schönborn, Germany

Omar-Alexander Al-Hujaj