Cyber-attacks have shifted toward organized crime and nation-states that pursue defined targets, with critical business systems, production environments, and sensitive information drawing the most attention. As attackers use increasingly sophisticated methods, detection and management have become difficult, especially when threats involve long-running patterns, compromised credentials, or zero-day techniques that traditional perimeter defenses may miss. Although firewalls, IDS, and IPS remain essential, they generate alert volumes that are impractical to investigate in real time. SIEM is positioned as a remedy, yet it largely functions as a configurable toolset for post-event analysis, reporting, auditing, and compliance rather than delivering timely, actionable intelligence to prevent loss.
Real Time Security Intelligence (RTSI) has emerged to close this gap by applying big data and business intelligence approaches to integrate high-volume, multi-source data and reduce it to a small number of high-confidence alarms quickly enough to act before damage occurs. Managed services are portrayed as essential to RTSI due to rapidly evolving threats and the specialized expertise required to calibrate “normal” activity and distinguish true threats from noise. Organizations are encouraged to select RTSI solutions that embed community and vendor knowledge via managed services and pre-configured analytics, not merely toolsets.
SAP Enterprise Threat Detection (ETD) is presented as an RTSI solution built on SAP HANA analytics and an Event Stream Processor (ESP) that normalizes and enriches log data, supports pseudo-anonymization, and integrates logs from SAP and non-SAP sources, including SIEM tools. ETD includes dashboards, forensic capabilities, standard and expanding attack detection patterns, JSON-based integrations and notifications, and archiving for original and normalized data. Strengths include analytics and visualization, pattern updates, and broad applicability beyond SAP environments, while challenges include limited out-of-the-box SAP context integrations, a tile UI that can become confusing, and no machine learning yet (planned on the roadmap).
