Enterprise Threat Monitor Editions


Quick Success and Management Visibility

Includes latest threat monitoring cases and SAP-specific zero-day attack signatures for SAP FI, HR, CRM, SRM, and BASIS components, and Energy, Retail, Healthcare, and Automotive industry solutions, and payment interfaces. Starting from $950 per system/month.


In-Depth SAP Security Monitoring and Integration

Includes advanced threat monitoring cases, latest SAP-specific zero-day attack signatures, SAP fraud detection signatures (basic set) and SAP system configuration monitoring additional to standard edition solution capabilities.

Enterprise Threat Monitor Add-on Features and Services

SIEM Integration

Allows forwarding correlated ETM events to SIEM solutions such as Splunk, HP ArcSight or IBM QRadar, so that you get high quality SAP specific events directly in your SIEM solution.

“Ask an Expert”

Ideal for SOC teams that lack SAP expertise, this option allows live communication with an SAP security expert for any questions related to ETM or your specific incident with a click of a button through the ETM portal interface.

Contact us for more info

Additional Fraud Cases

Development of new fraud cases or customizations to existing ones for your business processes in FI, HR, CRM or SRM modules. This service requires Enterprise Threat Monitor Advanced Edition subscription.

Analytics Add-on

Analyze usage of SE16, SE38, and other transactions to improve your SAP roles and authorizations with the help of ETM’s built-in queries and integration to SQL Server or SAP Hana. Respond to requests coming from auditors asking for usage data of SAP transactions and reports.

Frequently Asked Questions About Licensing

You can find the most common licensing related questions below.

How is Enterprise Threat Monitor licensed?

ETM uses a monthly subscription model. No pre-investment is necessary and you can cancel the subscription anytime if you are not satisfied with the service. Licensing pricing is based on the number of SAP systems (SIDs) + monthly log volume for standard and advanced editions. A special discount is available for annual commitments.

ETM maintenance and support includes all ETM release and version updates during the subscription period.

How can we find out our monthly log volume?

When you download and run Enterprise Threat Monitor, you can use the built-in log volume analyzer to find out this information. After configuring your systems, simply click on the “Security Event Volume Analyzer” tile on the main screen.

Enterprise Threat Monitor Main Screen

Then you can select your system and run an analysis on the selected period. If you don’t store 30 days of logs, please select the earliest available logs, ETM will predict the monthly statistics and show you the estimates.

ETM SAP Log Volume Analyzer

You need to repeat this for each system in your scope to get the totals.

What is the difference between standard and advanced edition?

Main difference is the advanced threat monitoring cases and fraud detection signatures (ETM Advanced includes basic set of the rules of the Fraud Detection add-on), for example if someone manipulates bank account of a vendor and posts an invoice on it, the attacker may steal large sums of money from a company at the next payment run.

ETM Advanced also includes SAP configuration monitoring. It checks for SAP security configuration best practices and detects when security-related configuration settings are not compliant with the organization’s policy or SAP’s recommendations.

Standard edition can be upgraded to advanced edition anytime and existing settings and customizations are retained.

 Find out the common approach of our customers
for implementing real-time SAP security monitoring