Standard
Quick Success and Management Visibility
Includes latest threat monitoring cases and SAP-specific zero-day attack signatures for SAP FI, HR, CRM, SRM, and BASIS components, and Energy, Retail, Healthcare, and Automotive industry solutions, and payment interfaces. Starting from $950 per system/month.
Advanced
In-Depth SAP Security Monitoring and Integration
Includes advanced threat monitoring cases, latest SAP-specific zero-day attack signatures, SAP fraud detection signatures (basic set) and SAP system configuration monitoring additional to standard edition solution capabilities.
Enterprise Threat Monitor Add-on Features and Services
SIEM Integration
Allows forwarding correlated ETM events to SIEM solutions such as Splunk, HP ArcSight or IBM QRadar, so that you get high quality SAP specific events directly in your SIEM solution.
“Ask an Expert”
Ideal for SOC teams that lack SAP expertise, this option allows live communication with an SAP security expert for any questions related to ETM or your specific incident with a click of a button through the ETM portal interface.
Additional Fraud Cases
Development of new fraud cases or customizations to existing ones for your business processes in FI, HR, CRM or SRM modules. This service requires Enterprise Threat Monitor Advanced Edition subscription.
Analytics Add-on
Analyze usage of SE16, SE38, and other transactions to improve your SAP roles and authorizations with the help of ETM’s built-in queries and integration to SQL Server or SAP Hana. Respond to requests coming from auditors asking for usage data of SAP transactions and reports.
Frequently Asked Questions About Licensing
You can find the most common licensing related questions below.
How is Enterprise Threat Monitor licensed?
ETM uses a monthly subscription model. No pre-investment is necessary and you can cancel the subscription anytime if you are not satisfied with the service. Licensing pricing is based on the number of SAP systems (SIDs) + monthly log volume for standard and advanced editions. A special discount is available for annual commitments.
ETM maintenance and support includes all ETM release and version updates during the subscription period.
How can we find out our monthly log volume?
When you download and run Enterprise Threat Monitor, you can use the built-in log volume analyzer to find out this information. After configuring your systems, simply click on the “Security Event Volume Analyzer” tile on the main screen.
Then you can select your system and run an analysis on the selected period. If you don’t store 30 days of logs, please select the earliest available logs, ETM will predict the monthly statistics and show you the estimates.
You need to repeat this for each system in your scope to get the totals.
What is the difference between standard and advanced edition?
Main difference is the advanced threat monitoring cases and fraud detection signatures (ETM Advanced includes basic set of the rules of the Fraud Detection add-on), for example if someone manipulates bank account of a vendor and posts an invoice on it, the attacker may steal large sums of money from a company at the next payment run.
ETM Advanced also includes SAP configuration monitoring. It checks for SAP security configuration best practices and detects when security-related configuration settings are not compliant with the organization’s policy or SAP’s recommendations.
Standard edition can be upgraded to advanced edition anytime and existing settings and customizations are retained.
Find out the common approach of our customers
for implementing real-time SAP security monitoring