ABAPAuditLog

ABAPAuditLog Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel SAP security audit log is used to keep records of important user transactions and system events within an SAP system. This table stores information such as who accessed the system, which transactions were executed, and when. It provides a useful tool for monitoring activity and detecting potential security breaches.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AbapProgramName The AbapProgramName is a four-character alphanumeric code that is used identify a specific program within the SAP system. String
AgentId Unique agent or integration suite identifier. String
AlertSeverity The AlertSeverity is a number between 0 and 255; the larger the number, the greater the severity. Double
AlertSeverityText The AlertSeverityText refers to the text description associated with a specific alert or notification severity level. It provides a detailed explanation of the severity level and is used in various SAP transactions and reports. String
AlertValue The AlertValue represents the importance of the message of a log attribute, characterized by color and severity. Double
AuditClassId The AuditClassId is a numeric identifier used to classify different types of audit events in SAP. It helps group similar events together and is used in various transactions and reports to provide information about audit events and to help with auditing and compliance requirements. Double
ClientId The ClientId is a three-digit number that identifies a specific client within an SAP system. The ClientId is used in various SAP transactions and configuration settings to identify the client and ensure that the correct client is being accessed or configured. String
Computer The Computer refers to the name or IP address of the user’s machine. It is used to identify the machine from which a specific activity or event was performed. String
Email The Email refers to the email address associated with a specific user. It is used to identify the user via email within the SAP system. String
Host The Host refers to the name of the computer or server on which the SAP system is running. It is used to identify and locate the SAP system within a network. String
Instance The Instance refers to a specific installation of an SAP system on a server. An SAP system can have multiple instances running on the same server, each with its own set of processes and resources. The Instance is identified by a unique name that is set during the installation of the SAP system, following syntax: . String
MessageClass The MessageClass is a grouping or category for specific messages or log entries used to organize and classify messages and log entries within an SAP system. String
MessageContainerId The MessageContainerId is a unique identifier for a specific message container, which is a logical grouping of related messages or log entries within an SAP system. String
MessageId The MessageId is a unique identifier for a specific message or log entry used to identify and track messages and log entries within an SAP system. String
MessageText The MessageText is the text of a specific message or log entry. It provides information about the event or issue that is being logged and is used in various SAP transactions and reports to provide context and details about specific messages or log entries. String
MonitoringObjectName The MonitoringObjectName is the name of the object being monitored by a specific monitoring activity. It is used in various SAP monitoring tools and reports to provide information about the status and performance of the monitored object. String
MonitorShortName The MonitorShortName is the short name of the MTE(Monitoring Tree Element) in which the alert occurred. String
RemoteIpCountry The country of the TerminalIpV6 according to the GEO information at the time of the record ingestion. String
RemoteIpLatitude The Latitude of the TerminalIpV6 according to the GEO information at the time of the record ingestion. Double
RemoteIpLongitude The Longitude of the TerminalIpV6 according to the GEO information at the time of the record ingestion. Double
SalDateChar8 The SalDateChar8 is the date the event occured in char8 format (yyyyMMdd) eg: 20190101. String
SalIpAddress The SALIpAddress refers to the IP address associated with a specific user or system that generated a specific log entry. String
SalTimeChar6 The SalTimeChar6 is the time the event occured in char6 format (hhMMss) eg: 110804. String
SapProcessType The SapProcessType refers to the type of process that is being executed within the SAP system. This can include various types of processes such as background jobs, dialog processes, or update processes. String
SapWorkProcessName The SapWorkProcessName refers to the name of a specific work process within the SAP system used to identify and monitor specific work processes. It is typically a unique alphanumeric code. String
SourceSystem String
SystemId The SystemId is a unique identifier for a specific SAP system. It is a three-character alphanumeric code that is used to distinguish between different SAP systems. String
SystemNumber The SystemNumber is a two-digit number that identifies a specific SAP system. It is set during the installation of an SAP system and cannot be changed afterwards. The SystemNumber is used in various SAP transactions and configuration settings to identify the system and ensure that the correct system is being accessed or configured. String
SystemRole The SAP system’s role. String
SystemUniqueId Unique system identifier. String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TerminalIpV6 The TerminalIPv6 refers to the IPv6 address associated with the user’s terminal or device. It is used to identify the location and origin of specific activities or events performed by the user within the SAP system. String
TimeGenerated Date and time when the record was generated DateTime
TransactionCode the TransactionCode is a unique identifier for a specific SAP transaction used to identify and execute a specific transaction within the SAP system. It is typically a four-character alphanumeric code and can be used in various SAP transactions and reports. String
Type The name of the table String
UpdatedOn The date and time of the event occured in the SAP system in UTC format. DateTime
User The User who performed the a specific event or activity. String
Variable1 The Variable1 used by the SAP system for additional information regarding the event or activity that was performed. String
Variable2 The Variable2 used by the SAP system for additional information regarding the event or activity that was performed. String
Variable3 The Variable3 used by the SAP system for additional information regarding the event or activity that was performed. String
Variable4 The Variable4 used by the SAP system for additional information regarding the event or activity that was performed. String

Schema changes #

Date Action
2026-01-02 Table added to tracking