A SIEM platform is built to correlate events across networks, endpoints, and infrastructure — and it does that well. But SAP doesn't generate security-relevant activity the way a firewall or an endpoint agent does. It speaks in RFC calls, authorization objects, transaction codes, and change documents. Feed that into a generic SIEM without translation, and most of what matters gets flattened into noise or missed entirely.
Authorization objects aren't just permissions
An SAP authorization object encodes far more context than a simple role or group membership — it's the combination of transaction, activity, and organizational scope that determines what someone can actually do. A generic SIEM sees a login. It doesn't see that the same user just gained the ability to post journal entries outside their normal cost center.
RFC and interface traffic looks like nothing to outside tools
A lot of real SAP activity happens over RFC connections between systems, not through the GUI a security analyst would recognize. To a network-level tool, that traffic can look like routine system-to-system chatter. To someone who understands SAP, an unusual RFC call pattern can be the clearest sign of an intrusion in progress.
Transaction codes need domain context to mean anything
Knowing that a user ran SE38 or SU01 is meaningless without knowing what those transactions do and whether this user, in this context, should be running them at all. Generic tools can log the event. They can't tell you it's dangerous.
Change documents are the audit trail nobody's watching in real time
SAP keeps detailed records of what changed and who changed it — but those records live inside the application, not in a format most infrastructure tools ingest cleanly. That gap is exactly where configuration drift and unauthorized changes go unnoticed the longest.
None of this means SIEM is the wrong tool — it's the right tool for the layer it was built for. SAP just needs a layer of its own, one that speaks the application's language instead of translating it after the fact.