SAP HANA Audit Trail

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/database-sap-hana/generator.yml \
  --id hana \
  --live-mode true

Event Types

Realism Features

• Raw trail line preserved — `message` carries the 38-position audit entry the syslog trail target writes, so a parser can be developed against it while dashboards read the parsed `sap.hana.audit.*` fields
• Audit actions verified against SAP — 48 of the 52 actions come from the auditable set of CREATE AUDIT POLICY, and the four audit-policy actions are the ones HANA always records under MandatoryAuditPolicy
• Policies from the Security Guide — events are reported under the `_SAP_*` policy set SAP recommends, at the levels it assigns, plus the site policies a production system adds for data access
• Logon pairs — a credential check is followed by the connection it authorises or the refusal it causes, sharing session ID, account and client
• Sessions — an accepted connection opens a session that later statements run inside, reusing its ID, account, client host and process; the pools are bounded and sessions retire
• Account lockout — invalid attempts accumulate per account and the sixth reports "user is locked", matching HANA's default maximum_invalid_connect_attempts
• Who does what — application servers send prepared statements with placeholders, loaders read column ranges by delta key, a person at HDB Studio reads whole rows, monitoring accounts read the system views
• Application users — the ABAP stack connects as one technical account and passes the business user through, so the database user and the application user differ
• Sensitivity drives the policy — reads of the HR and password tables are reported by their own policy at warning level, the rest of the schema at info
• Intrusion arc — about 7% of events form a six-phase story: password spraying from an unmanaged host, the connection the guessed credentials open, a backdoor account and privilege grants, bulk reads of the HR and password tables, then audit policy changes and an audit log deletion that MandatoryAuditPolicy records anyway

Sample Output

{
    "@timestamp": "2026-07-31T09:18:35.225797+00:00",
    "message": "2026-07-31T09:18:35.225797Z;indexserver;hana-prod-01.corp.local;HDB;00;30040;HDB_PROD;10.20.9.6;jump02.corp.local;13653;57962;_SAP_authorizations;INFO;GRANT ROLE;SUPPORT_L3;;;;GRANTABLE;Z_S4_HR_DISPLAY;Z_ETL_LOAD;SUCCESSFUL;;;;;;;GRANT \"Z_S4_HR_DISPLAY\" TO Z_ETL_LOAD WITH ADMIN OPTION;400018;SUPPORT_L3;_SYS_REPO;_SYS_REPO;;;;hdbsql;SUPPORT_L3",
    "event": {
        "action": "grant_role",
        "category": ["iam"],
        "dataset": "sap_hana.audit",
        "kind": "event",
        "module": "sap_hana",
        "outcome": "success",
        "severity": 6,
        "type": ["group", "change"]
    },
    "rule": { "name": "_SAP_authorizations", "ruleset": "SAP HANA audit policies" },
    "sap": {
        "hana": {
            "audit": {
                "action": "GRANT ROLE",
                "action_status": "SUCCESSFUL",
                "audit_level": "INFO",
                "database_name": "HDB_PROD",
                "grantable": "GRANTABLE",
                "policy_name": "_SAP_authorizations",
                "role_name": "Z_S4_HR_DISPLAY",
                "role_schema_name": "_SYS_REPO",
                "session_id": 400018,
                "session_user": "SUPPORT_L3",
                "target_principal": "Z_ETL_LOAD"
            }
        }
    },
    "source": { "domain": "jump02.corp.local", "ip": "10.20.9.6", "port": 57962 },
    "user": {
        "name": "SUPPORT_L3",
        "roles": ["Z_S4_HR_DISPLAY"],
        "target": { "name": "Z_ETL_LOAD" }
    }
}

Parameters