共用方式為

ABAPAuditLog 數據表的查詢

  • 發行項

如需在 Azure 入口網站 中使用這些查詢的相關信息，請參閱Log Analytics教學課程。 如需 REST API，請參閱 查詢。

ABAP 稽核記錄多個IP登入

顯示來自相同ip的多個使用者登入。

let perIPLimit = 1;
SAPAuditLog
| where MessageId == 'AUM'
| extend DetailsBy = pack("User", User, "Email", Email, "SystemId", SystemId, "ClientId", ClientId)
| summarize LoginbyIPAttempts = count(), Details = make_set(DetailsBy), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
    by TerminalIpV6
| where LoginbyIPAttempts > perIPLimit
| mv-expand Details
| evaluate bag_unpack(Details, "Details_")

ABAP 稽核記錄檔下載

顯示檔案下載活動。

let TableAccessTcodes= dynamic(["SE16", "SE16N", "SE11", "SE16H", "SM30", "SE12", "SM31", "SE16H", "SE14", "SE54","SE17", "SE16T", "DB01", "DB02"]);
// get data read actions
ABAPAuditLog
    | where MessageID == "AU3"
    | where TransactionCode in (TableAccessTcodes) or Variable1 in (TableAccessTcodes)
    | summarize by TimeAccessed= bin(TimeGenerated, 1h), SystemId, ClientId, User, AbapProgramName