Security investigations are often complex and time-consuming. Monitoring agents must sift through vast amounts of log data, evaluate the risk posed by individual ABAP objects, and translate technical findings into clear, actionable recommendations.
Since August we've introduced three AI-assisted features in SAP Enterprise Threat Detection, cloud edition that help monitoring agents work more efficiently: Behavior analysis, criticality assessments for ABAP objects, and recommendation templates.
Let's take a closer look at what's new.
Behavior analysis: Let AI surface suspicious activity for you
When an investigation is underway and you've identified suspicious users through alerts, the harder question surfaces: what exactly did they do, and how serious was it? Manually reviewing large volumes of log data to answer that takes time you often don't have.
That's where behavior analysis comes in. From the Behavior Analysis tab on the investigation details page, you can trigger an AI-powered analysis of the users already linked to your investigation—without leaving your current context. The AI examines their activity across your event data and returns a list of suspicious log events, each tagged with a severity level (Very High, High, Medium, or Low) and an explanation of the AI's reasoning. You can then select individual events and assign them to your investigation as evidence.
What you'll need: The UEBAManager role and accepted SAP AI Terms and Conditions
For more information, see Running a Behavior Analysis | SAP Help Portal.
Criticality information for ABAP objects: Know your risk at a glance
Not every ABAP object carries the same risk — but assessing that risk manually takes expertise and time. AI-assisted criticality assessments are now available for four ABAP object types: HTTP paths, function modules, transactions, and reports.
The assessment is available directly within the apps where you already work as a monitoring agent: Analyze Log Events, Manage Value Lists, Manage Investigations, and Manage Alerts. When you request criticality information for an object, the system returns:
- A criticality level (Very High, High, Medium, Low, or Unknown)
- A plain-language explanation of why the object is security-critical
- Remediation recommendations to reduce the risk
- Where applicable, details about relevant SAP Security Notes, including CVSS scores and publication dates
A feedback option lets you flag inaccurate or misleading AI-generated content helping improve results over time.
What you'll need: The roles CriticalObjectsAIManager and accepted SAP AI Terms and Conditions.
For more information, see Criticality Information for ABAP Objects | SAP Help Portal.
AI-assisted recommendation templates: Faster, more consistent investigation reports
When closing an investigation, monitoring agents write a recommendation for the customer — what happened, why it matters, and what to do next. Getting that right, consistently, across many different patterns, can be a challenge.
We've made it easier with AI-assisted recommendation templates. In the Manage Patterns app, you can now use a chat interface to describe the template you need, and the system generates a structured draft. You can then refine it through the chat or edit it directly before saving.
Each template follows a clear three-part structure: what happened (investigation result), why it matters (alert reason), and what to do (recommended action). Placeholders in the template are automatically filled with real event data when a monitoring agent generates a recommendation for a specific investigation.
You can create templates at two levels: global templates that apply across all tenants, and tenant-specific templates. SAP-provided templates for standard patterns are also available to view as a reference.
What you'll need: The roles CriticalObjectsAIManager and CrossTenantCriticalObjectsManager and accepted SAP AI Terms and Conditions.
For more information, see Creating Recommendation Templates | SAP Help Portal.
Wrapping up
These three features reflect a broader direction we're taking with SAP Enterprise Threat Detection: putting AI where it reduces friction in security work. Behavior analysis helps you focus on the activities that matter most. Criticality assessments give you instant context on risky ABAP objects without having to dig through documentation. And AI-assisted recommendation templates help you produce clearer, more consistent reports in less time.
Together, these innovations help security teams make better-informed decisions and respond faster to potential threats.
Source link
