---
title: SAP Threat Detection Modeling
description: "Scopri come il threat detection modeling per SAP aiuta a proteggere i sistemi critici da attacchi informatici, integrando sicurezza e operazioni aziendali.

#AgleaSAPSecurity #proudtobehorsa"
image: https://www.aglea.com/hubfs/mappa.jpg
---

[linkedin](https://www.linkedin.com/company/292350?trk=vsrp_companies_res_name&trkInfo=VSRPsearchId%3A3373431891426179412478%2CVSRPtargetId%3A292350%2CVSRPcmpt%3Aprimary) [YouTube](https://www.youtube.com/c/AgleaSAPSecurity?sub_confirmation=1) [Twitter](https://twitter.com/AgleaItaly?lang=it)

[![Logo-Aglea-horsa-company](https://www.aglea.com/hubfs/Aglea/Aglea_November2018%20Theme/Images/Logo-Aglea-horsa-company.webp) ](https://www.aglea.com/)

# SAP Threat Detection Modeling

# SAP Threat Detection Modeling

Posted by [Massimo Manara](https://www.aglea.com/blog/author/massimo-manara) on May 20, 2026 8:15:01 AM

- [Tweet](https://twitter.com/share)

I sistemi SAP sono il cuore pulsante di migliaia di organizzazioni nel mondo: gestiscono processi finanziari, catene di fornitura, dati HR e molto altro. Proprio per questo rappresentano un obiettivo ad altissimo valore per gli attaccanti. Eppure, la sicurezza SAP è spesso trattata come un argomento di nicchia, separato dalle pratiche di cybersecurity tradizionale.

 

![mappa](https://www.aglea.com/hs-fs/hubfs/mappa.jpg?width=397&height=265&name=mappa.jpg)

Il threat detection modeling per SAP colma questo gap: fornisce un framework strutturato per identificare, classificare e monitorare le minacce specifiche dell’ecosistema SAP, integrando queste informazioni con i processi SOC (Security Operations Center) aziendali.

## Perché SAP richiede un approccio dedicato

I sistemi SAP presentano caratteristiche che li rendono unici dal punto di vista della threat detection. A differenza di una normale applicazione web, SAP gestisce transazioni business-critical con un proprio linguaggio (ABAP), protocolli di rete proprietari (RFC, DIAG), e un modello di autorizzazione estremamente granulare.

 

Le principali superfici di attacco includono ad esempio:

 

- Layer RFC/ABAP: chiamate Remote Function Call non autorizzate, esecuzione di codice ABAP malevolo, backdoor nei programmi custom
  
   
- Gestione delle identità: uso improprio di utenze di sistema (es quelle speciali e note DDIC, SAP*), privilege escalation, account condivisi non tracciati
- Interfacce esterne: attacchi tramite SAP Web Dispatcher, ICM (Internet Communication Manager), endpoint HTTP/S non protetti
- Transport & Change: importazione di trasporti malevoli, modifiche non autorizzate in produzione, bypass dei processi di change management

 

## Il framework di threat detection modeling

Un modello di threat detection efficace per SAP si struttura in quattro fasi principali. L’obiettivo non è solo rilevare gli attacchi, ma costruire una mappa completa delle minacce che permetta di prioritizzare gli investimenti in sicurezza.

 

### (1) Asset inventory e data flow mapping

Prima di modellare le minacce, è necessario avere una visione chiara degli asset SAP: sistemi (ECC, S/4HANA, BW, PI/PO, Solution Manager, BTP, Cloud/OnPremise), mandanti, interfacce. Si mappano i flussi di dati tra i sistemi per identificare i punti di ingresso e i percorsi che un attaccante potrebbe seguire.

### (2) Threat categorization con STRIDE + SAP

Il modello [STRIDE](https://en.wikipedia.org/wiki/STRIDE_model) (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) viene esteso con categorie SAP-specifiche.

 

Ogni minaccia viene mappata alle transazioni, ai log e agli indicatori di compromissione (IoC) rilevanti. Ad esempio <https://www.aglea.com/blog/sap-security-audit-log-configurazione>[Security Audit Log](https://www.aglea.com/blog/sap-security-audit-log-configurazione) (SM20 - RSAU_READ_LOG ), [System Log](https://www.aglea.com/blog/sap-audit-log-vs-sap-system-log) (SM21), [table trace Log](https://www.aglea.com/blog/amministratore-di-sistema) (SCU3), Gateway Log e, per i sistemi [HANA](https://www.aglea.com/en/blog/migrazione-sap-hana-security-sap-cosa-cambia), Security Audit log a livello di database.

La verifica ed attivazione dei log è il presupposto indispensabile per qualsiasi attività di detection.

### (3) Detection rule design

Per ogni minaccia identificata si progettano le regole di rilevamento.

 

Una regola è composta da: sorgente del log, condizione di trigger, parametri di correlazione, soglia di alerting e severity.

 

Le regole vengono potenzialmente implementate nel SIEM aziendale (es. Splunk, Microsoft [Sentinel](https://www.aglea.com/blog/sentinel-sap), IBM QRadar) o in soluzioni specifiche come ad esempio SAP Enterprise Threat Detection (ETD), SecurityBridge, redrays, Pathlock (CAC), Onapsis.

 

 

### (4) Threat matrix e priorità

Il risultato finale è una matrice che associa ciascuna minaccia alla sua probabilità, all’impatto potenziale e alla copertura di detection disponibile. Questo strumento guida le decisioni del SOC (Security Operation Center) e degli audit di sicurezza.

 

| Minaccia | Vettore | Log sorgente | Severity |
| --- | --- | --- | --- |
| Login con utenza SAP* o DDIC | Spoofing / Privilege Escalation | SM20-RSAU_READ_LOG (Audit Log) | CRITICA |
| Esecuzione RFC remota non autorizzata | [Lateral Movement](https://en.wikipedia.org/wiki/Lateral_movement_(cybersecurity)) | SAP Security Audit Log | CRITICA |
| Modifica diretta in tabelle di sistema | Tampering | SCU3 (Table Trace) | ALTA |
| Accesso a dati sensibili fuori orario | Information Disclosure | Workload analysis / Security Audit Log / Read Access Log | ALTA |
| Importazione trasporto in produzione |  Tampering  | STMS / Change Document / Table Trace | MEDIA |

 

## Esempio pratico: rilevamento di una RFC call anomala

Scenario: un attaccante ottiene le credenziali di un utente tecnico SAP con autorizzazioni RFC ampie. Inizia a interrogare moduli funzione sensibili ([RFC_READ_TABLE](https://www.aglea.com/blog/rfc_read_table-security), SUSR_USER_AUTH_FOR_OBJ_GET) per estrarre dati e mappare le autorizzazioni.

 

Lo scenario passo per passo:

1. L’attaccante esegue login RFC dall’IP 192.168.10.45 con l’utenza RFC_BATCH, orario inusuale (02:17)
2. Viene chiamato il modulo RFC_READ_TABLE su tabella USR02 (questa tabella contiene l'elenco delle utenze, gli stati attive o meno, gli hash delle password)
3. Seguono 34 chiamate a moduli SUSR* in meno di 90 secondi
4. Il SIEM correla: IP anomalo + orario notturno + tabelle sensibili alert severity CRITICA

 

La logica della regola è volutamente semplice ma efficace. Il risk score combina tre segnali: volume di chiamate, orario notturno (che pesa molto) e diversità di moduli interrogati.

 

## Scenario 2: Privilege Escalation tramite SU01 e SE16N

Il secondo scenario riguarda una delle minacce insider più insidiose nell’ecosistema SAP: un utente con accesso alla transazione SU01 (gestione utenti) che crea o modifica account per ottenere privilegi elevati, combinando l’azione con accessi diretti alle tabelle tramite SE16N per cancellare le tracce o manipolare dati.

Questo attacco è particolarmente pericoloso perché sfrutta funzionalità legittime del sistema infatti, la transazione SU01 è una transazione di amministrazione "ordinaria" per la gestione delle utenze, e la  [SE16/SE16N](https://www.aglea.com/blog/se16-in-sap) è uno strumento di visualizzazione tabelle comunemente usato dai team [IT](https://www.aglea.com/blog/profilazione-personale-it-sap).

 

La deviazione malevola si individua solo analizzando il comportamento nel contesto e nella correlazione degli eventi.

 

Vediamo l'esempio:

1. L’utente ADMBASIS esegue la transazione SU01 e crea il nuovo utente SVCTMP01 (senza seguire il processo di provisioning standard, nessun ticket collegato o strumento di provisioning)
   
    
2. Al nuovo utente viene assegnato il profilo SAP_ALL tramite la transazione  SU01, conferendo accesso illimitato a tutti i moduli SAP
3. SVCTMP01 una volta entrato a sistema avvia la transazione SE16N sulla tabella BSEG (partite contabili, ACDOCA nel contesto S/4HANA) e modifica direttamente valori di importo su transazioni già contabilizzate, sta utilizzando una funzione di DEBUG senza controllo e senza potenziali tracce
   
    
4. Infine, ADMBASIS torna su SU01 e disabilita l’utente  SVCTMP01 nel tentativo di eliminare la traccia dell’account temporaneo

 

## Regola di detection: SU01 Privilege Escalation + SE16N Debug

La strategia di detection si articola in due regole correlate: la prima rileva la creazione di utenti con profili critici senza processo autorizzativo; la seconda individua le scritture dirette su tabelle sensibili tramite SE16N, transazione che per default non dovrebbe avere capacità di modifica in produzione.

 

Il punto di attenzione di questo scenario emerge dalla correlazione delle due regole. Un alert su Regola A seguito ad esempio entro 30 minuti da un alert su Regola B. Con lo stesso utente creatore come denominatore comune. Eleva automaticamente la priorità dell’incidente e deve innescare una risposta immediata del SOC con potenziale blocco preventivo dell’account coinvolto.

 

Non sempre semplice da attuale il tutto, per arrivare qui servono strumenti, regole e maturità aziendale sul tema.

 

## Integrazione con il SOC e best practice

Un threat model SAP non vive in isolamento. Per essere efficace, deve integrarsi con il processo SOC aziendale. Alcuni principi chiave:

 

- contesto business-aware: gli analisti SOC devono conoscere il significato business delle transazioni SAP. Un accesso a SE16N da un utente IT a fine trimestre è probabilmente legittimo; lo stesso accesso da un utente IT alle 3 di notte è sospetto
- Playbook di risposta dedicati: per ogni categoria di minaccia SAP deve esistere un playbook di incident response specifico, che include i passi di triage e le parti da coinvolgere (team Basis, CISO, compliance)
- Revisione continua: il modello va aggiornato ad ogni patch SAP importante, ad ogni nuovo sistema introdotto e almeno semestralmente. Ad esempio l’introduzione di sistemi cloud SAP BTP, SAP Fiori o integrazioni ulteriori introducono nuove superfici che richiedono nuove regole

 

[![Iscriviti al blog se ancora non lo hai fatto!](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/8916761/interactive-168840142679.png) ](https://www.aglea.com/hs/cta/wi/redirect?encryptedPayload=AVxigLK3oHpPPJDoKUfz3UBxrB%2BpqXYqaoWljO%2B%2BeNyRio1hxDUDvZL9%2BdyQDQ8YkLr2OV1T5%2Bx%2FkswwQjjU7TmpyXa3iwwBC%2FOyFZVdfxt%2FvFFCr3WHbKlJQcFuG8LV8JfK9qIKIPcnA%2FGr7oIo%2FHztMT6ehdJ4NhD%2Fbi1VxQ9HqQeUr%2BDJPUwz8Ak%3D&webInteractiveContentId=168840142679&portalId=8916761)

 

 Topics: [audit sap](https://www.aglea.com/blog/tag/audit-sap), [cyber security](https://www.aglea.com/blog/tag/cyber-security), [siem](https://www.aglea.com/blog/tag/siem), [threat detection](https://www.aglea.com/blog/tag/threat-detection)

### Iscriviti qui!

### Blog Aglea, cosa puoi trovare?

Ogni mercoledì pubblichiamo articoli, interviste e documenti relativi alla security SAP.

Cosa puoi trovare:

- Suggerimenti su come mettere in sicurezza i sistemi SAP
- Come fare a … (How To)
- Checklist
- Gli errori comuni che spesso vengono fatti in ambito Security SAP
- Interviste con esperti del settore
- Chi è AGLEA quale è la nostra vision security SAP

### Post recenti

### Post By Topic

- [SAP Security (32)](https://www.aglea.com/blog/tag/sap-security)
- [SAP GRC (24)](https://www.aglea.com/blog/tag/sap-grc)
- [audit sap (22)](https://www.aglea.com/blog/tag/audit-sap)
- [fiori launchpad (20)](https://www.aglea.com/blog/tag/fiori-launchpad)
- [pfcg (19)](https://www.aglea.com/blog/tag/pfcg)
- [authorization concept (18)](https://www.aglea.com/blog/tag/authorization-concept)
- [cyber security (18)](https://www.aglea.com/blog/tag/cyber-security)
- [SAP audit (17)](https://www.aglea.com/blog/tag/sap-audit)
- [audit (16)](https://www.aglea.com/blog/tag/audit)
- [gdpr (16)](https://www.aglea.com/blog/tag/gdpr)
- [sap cyber security (16)](https://www.aglea.com/blog/tag/sap-cyber-security)
- [auditing (15)](https://www.aglea.com/blog/tag/auditing)
- [sap security blog (14)](https://www.aglea.com/blog/tag/sap-security-blog)
- [supporto sap ams (14)](https://www.aglea.com/blog/tag/supporto-sap-ams)
- [PFCG SAP transaction (13)](https://www.aglea.com/blog/tag/pfcg-sap-transaction)
- [SAP Cloud (13)](https://www.aglea.com/blog/tag/sap-cloud)
- [sap FIORI (13)](https://www.aglea.com/blog/tag/sap-fiori)
- [libro SAP (12)](https://www.aglea.com/blog/tag/libro-sap)
- [sod (12)](https://www.aglea.com/blog/tag/sod)
- [SAP GDPR (11)](https://www.aglea.com/blog/tag/sap-gdpr)
- [sap password (11)](https://www.aglea.com/blog/tag/sap-password)
- [sap vulnerability (11)](https://www.aglea.com/blog/tag/sap-vulnerability)
- [SAP cloud identity services (10)](https://www.aglea.com/blog/tag/sap-cloud-identity-services)
- [Segregation of duties (10)](https://www.aglea.com/blog/tag/segregation-of-duties)
- [vulnerability assessment (10)](https://www.aglea.com/blog/tag/vulnerability-assessment)
- [sap btp (9)](https://www.aglea.com/blog/tag/sap-btp)
- [sap license auditing (9)](https://www.aglea.com/blog/tag/sap-license-auditing)
- [SAP Cloud Security (8)](https://www.aglea.com/blog/tag/sap-cloud-security)
- [SAP FIORI Security (8)](https://www.aglea.com/blog/tag/sap-fiori-security)
- [SAP HR (8)](https://www.aglea.com/blog/tag/sap-hr)
- [consulenza sap security (8)](https://www.aglea.com/blog/tag/consulenza-sap-security)
- [idm (8)](https://www.aglea.com/blog/tag/idm)
- [secure coding sap (8)](https://www.aglea.com/blog/tag/secure-coding-sap)
- [security audit log (8)](https://www.aglea.com/blog/tag/security-audit-log)
- [siem (8)](https://www.aglea.com/blog/tag/siem)
- [threat detection (8)](https://www.aglea.com/blog/tag/threat-detection)
- [upgrade (8)](https://www.aglea.com/blog/tag/upgrade)
- [FIORI Security (7)](https://www.aglea.com/blog/tag/fiori-security)
- [S/4HANA (7)](https://www.aglea.com/blog/tag/s-4hana)
- [SAP IAG (7)](https://www.aglea.com/blog/tag/sap-iag)
- [SAP LOG (7)](https://www.aglea.com/blog/tag/sap-log)
- [User Access Management (7)](https://www.aglea.com/blog/tag/user-access-management)
- [governance (7)](https://www.aglea.com/blog/tag/governance)
- [internal audit (7)](https://www.aglea.com/blog/tag/internal-audit)
- [sap consulenza security (7)](https://www.aglea.com/blog/tag/sap-consulenza-security)
- [sap fiori space (7)](https://www.aglea.com/blog/tag/sap-fiori-space)
- [sap grc 12 (7)](https://www.aglea.com/blog/tag/sap-grc-12)
- [security ams (7)](https://www.aglea.com/blog/tag/security-ams)
- [su53 (7)](https://www.aglea.com/blog/tag/su53)
- [HANA Security (6)](https://www.aglea.com/blog/tag/hana-security)
- [SAP ECC (6)](https://www.aglea.com/blog/tag/sap-ecc)
- [autorizzazioni sap (6)](https://www.aglea.com/blog/tag/autorizzazioni-sap)
- [identity management system (6)](https://www.aglea.com/blog/tag/identity-management-system)
- [sap patch (6)](https://www.aglea.com/blog/tag/sap-patch)
- [ISO (5)](https://www.aglea.com/blog/tag/iso)
- [SAP Identity and Access Governance (5)](https://www.aglea.com/blog/tag/sap-identity-and-access-governance)
- [SU01 sap (5)](https://www.aglea.com/blog/tag/su01-sap)
- [access management (5)](https://www.aglea.com/blog/tag/access-management)
- [authorization model (5)](https://www.aglea.com/blog/tag/authorization-model)
- [controlli interni (5)](https://www.aglea.com/blog/tag/controlli-interni)
- [cyber security culture (5)](https://www.aglea.com/blog/tag/cyber-security-culture)
- [data loss prevention (5)](https://www.aglea.com/blog/tag/data-loss-prevention)
- [documentazione sap security (5)](https://www.aglea.com/blog/tag/documentazione-sap-security)
- [log sap (5)](https://www.aglea.com/blog/tag/log-sap)
- [oggetti autorizzativi critici (5)](https://www.aglea.com/blog/tag/oggetti-autorizzativi-critici)
- [rfc security (5)](https://www.aglea.com/blog/tag/rfc-security)
- [ruoli (5)](https://www.aglea.com/blog/tag/ruoli)
- [sap authorization review (5)](https://www.aglea.com/blog/tag/sap-authorization-review)
- [sap fue (5)](https://www.aglea.com/blog/tag/sap-fue)
- [sap_all (5)](https://www.aglea.com/blog/tag/sap_all)
- [securitybridge (5)](https://www.aglea.com/blog/tag/securitybridge)
- [sicurezza sap (5)](https://www.aglea.com/blog/tag/sicurezza-sap)
- [sviluppo codice sicuro (5)](https://www.aglea.com/blog/tag/sviluppo-codice-sicuro)
- [userid (5)](https://www.aglea.com/blog/tag/userid)
- [IAG (4)](https://www.aglea.com/blog/tag/iag)
- [RISE with SAP (4)](https://www.aglea.com/blog/tag/rise-with-sap)
- [SAP IDM (4)](https://www.aglea.com/blog/tag/sap-idm)
- [aglea (4)](https://www.aglea.com/blog/tag/aglea)
- [code vulnerability analysis (4)](https://www.aglea.com/blog/tag/code-vulnerability-analysis)
- [data privacy (4)](https://www.aglea.com/blog/tag/data-privacy)
- [fraud management (4)](https://www.aglea.com/blog/tag/fraud-management)
- [itgc (4)](https://www.aglea.com/blog/tag/itgc)
- [microsoft (4)](https://www.aglea.com/blog/tag/microsoft)
- [patch (4)](https://www.aglea.com/blog/tag/patch)
- [sap data masking (4)](https://www.aglea.com/blog/tag/sap-data-masking)
- [sap gui (4)](https://www.aglea.com/blog/tag/sap-gui)
- [sap gui security (4)](https://www.aglea.com/blog/tag/sap-gui-security)
- [sap hana (4)](https://www.aglea.com/blog/tag/sap-hana)
- [sap logon (4)](https://www.aglea.com/blog/tag/sap-logon)
- [sap super user (4)](https://www.aglea.com/blog/tag/sap-super-user)
- [security awareness (4)](https://www.aglea.com/blog/tag/security-awareness)
- [test system (4)](https://www.aglea.com/blog/tag/test-system)
- [workflow security SAP (4)](https://www.aglea.com/blog/tag/workflow-security-sap)
- [AI (3)](https://www.aglea.com/blog/tag/ai)
- [HANA (3)](https://www.aglea.com/blog/tag/hana)
- [RISE (3)](https://www.aglea.com/blog/tag/rise)
- [Risk Management (3)](https://www.aglea.com/blog/tag/risk-management)
- [SAP AUDIT LOG (3)](https://www.aglea.com/blog/tag/sap-audit-log)
- [SAP NOW (3)](https://www.aglea.com/blog/tag/sap-now)
- [Single Sing On (3)](https://www.aglea.com/blog/tag/single-sing-on)
- [UCON (3)](https://www.aglea.com/blog/tag/ucon)
- [UI logging (3)](https://www.aglea.com/blog/tag/ui-logging)
- [amministratore di sistema (3)](https://www.aglea.com/blog/tag/amministratore-di-sistema)
- [cloud platform (3)](https://www.aglea.com/blog/tag/cloud-platform)
- [consulenti (3)](https://www.aglea.com/blog/tag/consulenti)
- [consulenti sap security (3)](https://www.aglea.com/blog/tag/consulenti-sap-security)
- [corsi sap (3)](https://www.aglea.com/blog/tag/corsi-sap)
- [crittografia SAP (3)](https://www.aglea.com/blog/tag/crittografia-sap)
- [e-learning (3)](https://www.aglea.com/blog/tag/e-learning)
- [emergency users (3)](https://www.aglea.com/blog/tag/emergency-users)
- [formazione sap (3)](https://www.aglea.com/blog/tag/formazione-sap)
- [mail security sap (3)](https://www.aglea.com/blog/tag/mail-security-sap)
- [manuali sap security (3)](https://www.aglea.com/blog/tag/manuali-sap-security)
- [password policy (3)](https://www.aglea.com/blog/tag/password-policy)
- [process control (3)](https://www.aglea.com/blog/tag/process-control)
- [process mining (3)](https://www.aglea.com/blog/tag/process-mining)
- [processi security (3)](https://www.aglea.com/blog/tag/processi-security)
- [profili sap (3)](https://www.aglea.com/blog/tag/profili-sap)
- [reporting (3)](https://www.aglea.com/blog/tag/reporting)
- [rfc (3)](https://www.aglea.com/blog/tag/rfc)
- [rpa sap security (3)](https://www.aglea.com/blog/tag/rpa-sap-security)
- [sap compliance (3)](https://www.aglea.com/blog/tag/sap-compliance)
- [sap custom (3)](https://www.aglea.com/blog/tag/sap-custom)
- [sap data obfuscation (3)](https://www.aglea.com/blog/tag/sap-data-obfuscation)
- [sap dati personali (3)](https://www.aglea.com/blog/tag/sap-dati-personali)
- [sap ias (3)](https://www.aglea.com/blog/tag/sap-ias)
- [sap mail (3)](https://www.aglea.com/blog/tag/sap-mail)
- [sap siem (3)](https://www.aglea.com/blog/tag/sap-siem)
- [sap sso (3)](https://www.aglea.com/blog/tag/sap-sso)
- [sap training (3)](https://www.aglea.com/blog/tag/sap-training)
- [se16 (3)](https://www.aglea.com/blog/tag/se16)
- [sicurezza dei dati sap (3)](https://www.aglea.com/blog/tag/sicurezza-dei-dati-sap)
- [su25 (3)](https://www.aglea.com/blog/tag/su25)
- [suim (3)](https://www.aglea.com/blog/tag/suim)
- [ticket management system (3)](https://www.aglea.com/blog/tag/ticket-management-system)
- [training (3)](https://www.aglea.com/blog/tag/training)
- [transazioni sap (3)](https://www.aglea.com/blog/tag/transazioni-sap)
- [zero trust security (3)](https://www.aglea.com/blog/tag/zero-trust-security)
- [27001 (2)](https://www.aglea.com/blog/tag/27001)
- [NIS2 (2)](https://www.aglea.com/blog/tag/nis2)
- [SAP GRC Process Control (2)](https://www.aglea.com/blog/tag/sap-grc-process-control)
- [SAP Gateway security (2)](https://www.aglea.com/blog/tag/sap-gateway-security)
- [Trace autorizzazioni SAP (2)](https://www.aglea.com/blog/tag/trace-autorizzazioni-sap)
- [UI Masking (2)](https://www.aglea.com/blog/tag/ui-masking)
- [agleasapsecurity (2)](https://www.aglea.com/blog/tag/agleasapsecurity)
- [ams (2)](https://www.aglea.com/blog/tag/ams)
- [corso (2)](https://www.aglea.com/blog/tag/corso)
- [custom (2)](https://www.aglea.com/blog/tag/custom)
- [cyber security exposure (2)](https://www.aglea.com/blog/tag/cyber-security-exposure)
- [epi-use (2)](https://www.aglea.com/blog/tag/epi-use)
- [eventi (2)](https://www.aglea.com/blog/tag/eventi)
- [gxp (2)](https://www.aglea.com/blog/tag/gxp)
- [intelligenza artificiale (2)](https://www.aglea.com/blog/tag/intelligenza-artificiale)
- [joule (2)](https://www.aglea.com/blog/tag/joule)
- [organizzazione (2)](https://www.aglea.com/blog/tag/organizzazione)
- [profili (2)](https://www.aglea.com/blog/tag/profili)
- [progetti sap security (2)](https://www.aglea.com/blog/tag/progetti-sap-security)
- [programmazione sicura (2)](https://www.aglea.com/blog/tag/programmazione-sicura)
- [quality (2)](https://www.aglea.com/blog/tag/quality)
- [quotazione borsa (2)](https://www.aglea.com/blog/tag/quotazione-borsa)
- [s_tabu_dis (2)](https://www.aglea.com/blog/tag/s_tabu_dis)
- [sap business role (2)](https://www.aglea.com/blog/tag/sap-business-role)
- [sap catalog (2)](https://www.aglea.com/blog/tag/sap-catalog)
- [sap data protection (2)](https://www.aglea.com/blog/tag/sap-data-protection)
- [sap developer (2)](https://www.aglea.com/blog/tag/sap-developer)
- [sap enterprise threat detection (2)](https://www.aglea.com/blog/tag/sap-enterprise-threat-detection)
- [sap etd (2)](https://www.aglea.com/blog/tag/sap-etd)
- [sap gxp compliance (2)](https://www.aglea.com/blog/tag/sap-gxp-compliance)
- [sap ilm (2)](https://www.aglea.com/blog/tag/sap-ilm)
- [sap italia (2)](https://www.aglea.com/blog/tag/sap-italia)
- [sap menu (2)](https://www.aglea.com/blog/tag/sap-menu)
- [sap query (2)](https://www.aglea.com/blog/tag/sap-query)
- [sap router security (2)](https://www.aglea.com/blog/tag/sap-router-security)
- [sap security guidelines (2)](https://www.aglea.com/blog/tag/sap-security-guidelines)
- [sap security note (2)](https://www.aglea.com/blog/tag/sap-security-note)
- [sap security partner (2)](https://www.aglea.com/blog/tag/sap-security-partner)
- [sap security patch day (2)](https://www.aglea.com/blog/tag/sap-security-patch-day)
- [sap security tools (2)](https://www.aglea.com/blog/tag/sap-security-tools)
- [sap security video (2)](https://www.aglea.com/blog/tag/sap-security-video)
- [sap sos (2)](https://www.aglea.com/blog/tag/sap-sos)
- [sap workflow (2)](https://www.aglea.com/blog/tag/sap-workflow)
- [se16n (2)](https://www.aglea.com/blog/tag/se16n)
- [secure operation map (2)](https://www.aglea.com/blog/tag/secure-operation-map)
- [slaw (2)](https://www.aglea.com/blog/tag/slaw)
- [smartworking (2)](https://www.aglea.com/blog/tag/smartworking)
- [soar (2)](https://www.aglea.com/blog/tag/soar)
- [social engineering (2)](https://www.aglea.com/blog/tag/social-engineering)
- [solution manager (2)](https://www.aglea.com/blog/tag/solution-manager)
- [success Factors (2)](https://www.aglea.com/blog/tag/success-factors)
- [super utenti sap (2)](https://www.aglea.com/blog/tag/super-utenti-sap)
- [system users (2)](https://www.aglea.com/blog/tag/system-users)
- [tabelle (2)](https://www.aglea.com/blog/tag/tabelle)
- [trasformazione digitale (2)](https://www.aglea.com/blog/tag/trasformazione-digitale)
- [usmm (2)](https://www.aglea.com/blog/tag/usmm)
- [youtube aglea (2)](https://www.aglea.com/blog/tag/youtube-aglea)
- [youtube sap (2)](https://www.aglea.com/blog/tag/youtube-sap)
- [10bklaze (1)](https://www.aglea.com/blog/tag/10bklaze)
- [20000 (1)](https://www.aglea.com/blog/tag/20000)
- [312 (1)](https://www.aglea.com/blog/tag/312)
- [9001 (1)](https://www.aglea.com/blog/tag/9001)
- [ABAP (1)](https://www.aglea.com/blog/tag/abap)
- [Barcellona (1)](https://www.aglea.com/blog/tag/barcellona)
- [CIAM (1)](https://www.aglea.com/blog/tag/ciam)
- [CSR (1)](https://www.aglea.com/blog/tag/csr)
- [CVA (1)](https://www.aglea.com/blog/tag/cva)
- [CVE-2021-44228 (1)](https://www.aglea.com/blog/tag/cve-2021-44228)
- [Cloud ALM (1)](https://www.aglea.com/blog/tag/cloud-alm)
- [DPO (1)](https://www.aglea.com/blog/tag/dpo)
- [ERM (1)](https://www.aglea.com/blog/tag/erm)
- [Enterprise risk management (1)](https://www.aglea.com/blog/tag/enterprise-risk-management)
- [GROW (1)](https://www.aglea.com/blog/tag/grow)
- [Gestione del rischio aziendale (1)](https://www.aglea.com/blog/tag/gestione-del-rischio-aziendale)
- [HANA Roles (1)](https://www.aglea.com/blog/tag/hana-roles)
- [HR Data Reporting (1)](https://www.aglea.com/blog/tag/hr-data-reporting)
- [IAS (1)](https://www.aglea.com/blog/tag/ias)
- [IPS (1)](https://www.aglea.com/blog/tag/ips)
- [Liste distribuzione SAP (1)](https://www.aglea.com/blog/tag/liste-distribuzione-sap)
- [Log4Shell SAP (1)](https://www.aglea.com/blog/tag/log4shell-sap)
- [Milano (1)](https://www.aglea.com/blog/tag/milano)
- [OKR (1)](https://www.aglea.com/blog/tag/okr)
- [Onboarding (1)](https://www.aglea.com/blog/tag/onboarding)
- [P-user (1)](https://www.aglea.com/blog/tag/p-user)
- [Portale SAP note (1)](https://www.aglea.com/blog/tag/portale-sap-note)
- [Privilege Access Management (1)](https://www.aglea.com/blog/tag/privilege-access-management)
- [S-user (1)](https://www.aglea.com/blog/tag/s-user)
- [SAP ABAC (1)](https://www.aglea.com/blog/tag/sap-abac)
- [SAP Assurance and Compliance Software (1)](https://www.aglea.com/blog/tag/sap-assurance-and-compliance-software)
- [SAP C4C (1)](https://www.aglea.com/blog/tag/sap-c4c)
- [SAP DAM (1)](https://www.aglea.com/blog/tag/sap-dam)
- [SAP DLP (1)](https://www.aglea.com/blog/tag/sap-dlp)
- [SAP DRM (1)](https://www.aglea.com/blog/tag/sap-drm)
- [SAP ERP cloud private (1)](https://www.aglea.com/blog/tag/sap-erp-cloud-private)
- [SAP FKOM (1)](https://www.aglea.com/blog/tag/sap-fkom)
- [SAP Fraud Management (1)](https://www.aglea.com/blog/tag/sap-fraud-management)
- [SAP RBAC (1)](https://www.aglea.com/blog/tag/sap-rbac)
- [SAP RECON (1)](https://www.aglea.com/blog/tag/sap-recon)
- [SAP Sales (1)](https://www.aglea.com/blog/tag/sap-sales)
- [SAP Table (1)](https://www.aglea.com/blog/tag/sap-table)
- [SECURITY PATTERN ANALYSIS (1)](https://www.aglea.com/blog/tag/security-pattern-analysis)
- [SLA (1)](https://www.aglea.com/blog/tag/sla)
- [SOX (1)](https://www.aglea.com/blog/tag/sox)
- [SPOOL (1)](https://www.aglea.com/blog/tag/spool)
- [ST01 (1)](https://www.aglea.com/blog/tag/st01)
- [STAUTHTRACE (1)](https://www.aglea.com/blog/tag/stauthtrace)
- [Statistiche security SAP (1)](https://www.aglea.com/blog/tag/statistiche-security-sap)
- [admin (1)](https://www.aglea.com/blog/tag/admin)
- [aglea tribe (1)](https://www.aglea.com/blog/tag/aglea-tribe)
- [analisi dei rischi (1)](https://www.aglea.com/blog/tag/analisi-dei-rischi)
- [azure (1)](https://www.aglea.com/blog/tag/azure)
- [backup (1)](https://www.aglea.com/blog/tag/backup)
- [biolock sap (1)](https://www.aglea.com/blog/tag/biolock-sap)
- [biometria (1)](https://www.aglea.com/blog/tag/biometria)
- [blacklist sap (1)](https://www.aglea.com/blog/tag/blacklist-sap)
- [bot (1)](https://www.aglea.com/blog/tag/bot)
- [brand (1)](https://www.aglea.com/blog/tag/brand)
- [certificazioni sap (1)](https://www.aglea.com/blog/tag/certificazioni-sap)
- [chatGPT (1)](https://www.aglea.com/blog/tag/chatgpt)
- [ciso (1)](https://www.aglea.com/blog/tag/ciso)
- [cloud connector (1)](https://www.aglea.com/blog/tag/cloud-connector)
- [codice sicuro SAP (1)](https://www.aglea.com/blog/tag/codice-sicuro-sap)
- [compatibility packs (1)](https://www.aglea.com/blog/tag/compatibility-packs)
- [continuità del servizio (1)](https://www.aglea.com/blog/tag/continuità-del-servizio)
- [customization sap (1)](https://www.aglea.com/blog/tag/customization-sap)
- [cyber security deception (1)](https://www.aglea.com/blog/tag/cyber-security-deception)
- [data access subject request (1)](https://www.aglea.com/blog/tag/data-access-subject-request)
- [data subject request gdpr (1)](https://www.aglea.com/blog/tag/data-subject-request-gdpr)
- [delete user (1)](https://www.aglea.com/blog/tag/delete-user)
- [developer (1)](https://www.aglea.com/blog/tag/developer)
- [documentazione SAP GRC (1)](https://www.aglea.com/blog/tag/documentazione-sap-grc)
- [documentazione di progetto (1)](https://www.aglea.com/blog/tag/documentazione-di-progetto)
- [dsr (1)](https://www.aglea.com/blog/tag/dsr)
- [dynamic authorization management (1)](https://www.aglea.com/blog/tag/dynamic-authorization-management)
- [esg (1)](https://www.aglea.com/blog/tag/esg)
- [esterni (1)](https://www.aglea.com/blog/tag/esterni)
- [exchange rates (1)](https://www.aglea.com/blog/tag/exchange-rates)
- [external users management (1)](https://www.aglea.com/blog/tag/external-users-management)
- [falsi positivi (1)](https://www.aglea.com/blog/tag/falsi-positivi)
- [feedback (1)](https://www.aglea.com/blog/tag/feedback)
- [firefighter (1)](https://www.aglea.com/blog/tag/firefighter)
- [firefighter HANA (1)](https://www.aglea.com/blog/tag/firefighter-hana)
- [flash (1)](https://www.aglea.com/blog/tag/flash)
- [fornitori sap (1)](https://www.aglea.com/blog/tag/fornitori-sap)
- [ftp (1)](https://www.aglea.com/blog/tag/ftp)
- [go-live (1)](https://www.aglea.com/blog/tag/go-live)
- [grc ram (1)](https://www.aglea.com/blog/tag/grc-ram)
- [handover autorizzazioni (1)](https://www.aglea.com/blog/tag/handover-autorizzazioni)
- [hardening (1)](https://www.aglea.com/blog/tag/hardening)
- [horsa (1)](https://www.aglea.com/blog/tag/horsa)
- [integrazioni sap (1)](https://www.aglea.com/blog/tag/integrazioni-sap)
- [intune (1)](https://www.aglea.com/blog/tag/intune)
- [lavoro agile (1)](https://www.aglea.com/blog/tag/lavoro-agile)
- [libri (1)](https://www.aglea.com/blog/tag/libri)
- [malware (1)](https://www.aglea.com/blog/tag/malware)
- [mandanti (1)](https://www.aglea.com/blog/tag/mandanti)
- [metodologia sap activate (1)](https://www.aglea.com/blog/tag/metodologia-sap-activate)
- [microsoft planner (1)](https://www.aglea.com/blog/tag/microsoft-planner)
- [microsoft stream (1)](https://www.aglea.com/blog/tag/microsoft-stream)
- [multicompany sap security (1)](https://www.aglea.com/blog/tag/multicompany-sap-security)
- [multiple logon (1)](https://www.aglea.com/blog/tag/multiple-logon)
- [naming convention (1)](https://www.aglea.com/blog/tag/naming-convention)
- [nist (1)](https://www.aglea.com/blog/tag/nist)
- [nuovi assunti (1)](https://www.aglea.com/blog/tag/nuovi-assunti)
- [ob08 (1)](https://www.aglea.com/blog/tag/ob08)
- [pa20 (1)](https://www.aglea.com/blog/tag/pa20)
- [parameter sap (1)](https://www.aglea.com/blog/tag/parameter-sap)
- [partner sap (1)](https://www.aglea.com/blog/tag/partner-sap)
- [pfud (1)](https://www.aglea.com/blog/tag/pfud)
- [podcast sap security (1)](https://www.aglea.com/blog/tag/podcast-sap-security)
- [postmand sap api (1)](https://www.aglea.com/blog/tag/postmand-sap-api)
- [progetti security sap (1)](https://www.aglea.com/blog/tag/progetti-security-sap)
- [quantum (1)](https://www.aglea.com/blog/tag/quantum)
- [remediation (1)](https://www.aglea.com/blog/tag/remediation)
- [remote access (1)](https://www.aglea.com/blog/tag/remote-access)
- [rfc destination (1)](https://www.aglea.com/blog/tag/rfc-destination)
- [risorse umane (1)](https://www.aglea.com/blog/tag/risorse-umane)
- [role transport (1)](https://www.aglea.com/blog/tag/role-transport)
- [s_tabu_nam (1)](https://www.aglea.com/blog/tag/s_tabu_nam)
- [s_tabu_rfc (1)](https://www.aglea.com/blog/tag/s_tabu_rfc)
- [sailpoint (1)](https://www.aglea.com/blog/tag/sailpoint)
- [sap TechEd (1)](https://www.aglea.com/blog/tag/sap-teched)
- [sap access control (1)](https://www.aglea.com/blog/tag/sap-access-control)
- [sap acronimi (1)](https://www.aglea.com/blog/tag/sap-acronimi)
- [sap activate (1)](https://www.aglea.com/blog/tag/sap-activate)
- [sap add on (1)](https://www.aglea.com/blog/tag/sap-add-on)
- [sap antivirus (1)](https://www.aglea.com/blog/tag/sap-antivirus)
- [sap asap (1)](https://www.aglea.com/blog/tag/sap-asap)
- [sap assure (1)](https://www.aglea.com/blog/tag/sap-assure)
- [sap backup (1)](https://www.aglea.com/blog/tag/sap-backup)
- [sap bis (1)](https://www.aglea.com/blog/tag/sap-bis)
- [sap business continuity (1)](https://www.aglea.com/blog/tag/sap-business-continuity)
- [sap business integrity screening (1)](https://www.aglea.com/blog/tag/sap-business-integrity-screening)
- [sap business partner (1)](https://www.aglea.com/blog/tag/sap-business-partner)
- [sap bw (1)](https://www.aglea.com/blog/tag/sap-bw)
- [sap covid (1)](https://www.aglea.com/blog/tag/sap-covid)
- [sap cua (1)](https://www.aglea.com/blog/tag/sap-cua)
- [sap cva (1)](https://www.aglea.com/blog/tag/sap-cva)
- [sap earlywatch (1)](https://www.aglea.com/blog/tag/sap-earlywatch)
- [sap frodi (1)](https://www.aglea.com/blog/tag/sap-frodi)
- [sap gamification (1)](https://www.aglea.com/blog/tag/sap-gamification)
- [sap grc app (1)](https://www.aglea.com/blog/tag/sap-grc-app)
- [sap grc fiori (1)](https://www.aglea.com/blog/tag/sap-grc-fiori)
- [sap grc rm (1)](https://www.aglea.com/blog/tag/sap-grc-rm)
- [sap grc tables (1)](https://www.aglea.com/blog/tag/sap-grc-tables)
- [sap gui history (1)](https://www.aglea.com/blog/tag/sap-gui-history)
- [sap ilm gdpr (1)](https://www.aglea.com/blog/tag/sap-ilm-gdpr)
- [sap ips (1)](https://www.aglea.com/blog/tag/sap-ips)
- [sap masking (1)](https://www.aglea.com/blog/tag/sap-masking)
- [sap penetration test (1)](https://www.aglea.com/blog/tag/sap-penetration-test)
- [sap personalization (1)](https://www.aglea.com/blog/tag/sap-personalization)
- [sap roll out (1)](https://www.aglea.com/blog/tag/sap-roll-out)
- [sap scp logon (1)](https://www.aglea.com/blog/tag/sap-scp-logon)
- [sap security MEME (1)](https://www.aglea.com/blog/tag/sap-security-meme)
- [sap security checklist (1)](https://www.aglea.com/blog/tag/sap-security-checklist)
- [sap security integrator (1)](https://www.aglea.com/blog/tag/sap-security-integrator)
- [sap security teal (1)](https://www.aglea.com/blog/tag/sap-security-teal)
- [sap signavio (1)](https://www.aglea.com/blog/tag/sap-signavio)
- [sap splunk (1)](https://www.aglea.com/blog/tag/sap-splunk)
- [sap standard role (1)](https://www.aglea.com/blog/tag/sap-standard-role)
- [sap support package (1)](https://www.aglea.com/blog/tag/sap-support-package)
- [sap tabelle custom (1)](https://www.aglea.com/blog/tag/sap-tabelle-custom)
- [sap tdms (1)](https://www.aglea.com/blog/tag/sap-tdms)
- [sap tipo utente (1)](https://www.aglea.com/blog/tag/sap-tipo-utente)
- [sap translate (1)](https://www.aglea.com/blog/tag/sap-translate)
- [sap_all_only_view (1)](https://www.aglea.com/blog/tag/sap_all_only_view)
- [sap_gui (1)](https://www.aglea.com/blog/tag/sap_gui)
- [sap_new (1)](https://www.aglea.com/blog/tag/sap_new)
- [scc4 (1)](https://www.aglea.com/blog/tag/scc4)
- [scoodo log (1)](https://www.aglea.com/blog/tag/scoodo-log)
- [scrambling (1)](https://www.aglea.com/blog/tag/scrambling)
- [scrum sap (1)](https://www.aglea.com/blog/tag/scrum-sap)
- [secpol (1)](https://www.aglea.com/blog/tag/secpol)
- [security bridge (1)](https://www.aglea.com/blog/tag/security-bridge)
- [security operation center (1)](https://www.aglea.com/blog/tag/security-operation-center)
- [security template (1)](https://www.aglea.com/blog/tag/security-template)
- [security tools (1)](https://www.aglea.com/blog/tag/security-tools)
- [security weaver (1)](https://www.aglea.com/blog/tag/security-weaver)
- [self service (1)](https://www.aglea.com/blog/tag/self-service)
- [semplificare (1)](https://www.aglea.com/blog/tag/semplificare)
- [sentinel (1)](https://www.aglea.com/blog/tag/sentinel)
- [sicurezza codice ABAP (1)](https://www.aglea.com/blog/tag/sicurezza-codice-abap)
- [sicurezza dati (1)](https://www.aglea.com/blog/tag/sicurezza-dati)
- [sistema integrato (1)](https://www.aglea.com/blog/tag/sistema-integrato)
- [sod ruleset (1)](https://www.aglea.com/blog/tag/sod-ruleset)
- [sondaggi (1)](https://www.aglea.com/blog/tag/sondaggi)
- [sost (1)](https://www.aglea.com/blog/tag/sost)
- [sql (1)](https://www.aglea.com/blog/tag/sql)
- [sticker (1)](https://www.aglea.com/blog/tag/sticker)
- [su21 (1)](https://www.aglea.com/blog/tag/su21)
- [system integrator (1)](https://www.aglea.com/blog/tag/system-integrator)
- [tabelle SAP grc access control (1)](https://www.aglea.com/blog/tag/tabelle-sap-grc-access-control)
- [tassi di cambio (1)](https://www.aglea.com/blog/tag/tassi-di-cambio)
- [test autorizzazioni (1)](https://www.aglea.com/blog/tag/test-autorizzazioni)
- [traduzione ruoli (1)](https://www.aglea.com/blog/tag/traduzione-ruoli)
- [traduzione sap (1)](https://www.aglea.com/blog/tag/traduzione-sap)
- [ust04 (1)](https://www.aglea.com/blog/tag/ust04)
- [utenti sap (1)](https://www.aglea.com/blog/tag/utenti-sap)
- [utenze di sistema (1)](https://www.aglea.com/blog/tag/utenze-di-sistema)
- [virtual forge (1)](https://www.aglea.com/blog/tag/virtual-forge)
- [vpn (1)](https://www.aglea.com/blog/tag/vpn)
- [xiting (1)](https://www.aglea.com/blog/tag/xiting)

[Visualizza tutti](https://www.aglea.com/blog/sap-threat-detection-modeling#)

## [SAP Security Blog AGLEA RSS Feed](https://www.aglea.com/blog/rss.xml)

Aglea s.r.l. - Soggetta alla direzione e coordinamento di Horsa S.p.A. - P. IVA: IT 03868780960 - 2026 | [Privacy Policy](https://www.aglea.com/privacy-policy/) - [Cookie Policy](https://www.aglea.com/cookie-policy) - [Whistleblowing](https://whistleblowing.horsa.it/)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Massimo Manara",
    "url" : "https://www.aglea.com/blog/author/massimo-manara"
  },
  "dateModified" : "2026-05-20T06:15:01.136Z",
  "datePublished" : "2026-05-20T06:15:01.000Z",
  "headline" : "SAP Threat Detection Modeling",
  "image" : [ "https://www.aglea.com/hubfs/mappa.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://www.aglea.com/blog/sap-threat-detection-modeling",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject"
    },
    "name" : "Horsa S.p.A."
  }
}
```