Pathlock TDnR - SAP Read Access Logging Data
Detects SAP Read Access Logging (RAL) data events capturing actual sensitive data access, forwarded by Pathlock Threat Detection and Response. RAL data events record when users access sensitive fields (e.g. salary…
Description
Detects SAP Read Access Logging (RAL) data events capturing actual sensitive data access, forwarded by Pathlock Threat Detection and Response. RAL data events record when users access sensitive fields (e.g. salary data, personal information) and may indicate data harvesting or insider threat activity.
Detection logic
Detection requirements
- Platform
- ESXiIaaSLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
- Log source product
- pathlock_tdnr
- Log source service
- pathlock_tdnr_cl
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c44
- Tagged by the source as
- CollectionExfiltration
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1