A Risk-Centric Methodology for Detecting Cyber Threats Across SAP Landscapes Using Security Event Correlation, Statistical Anomaly Profiling, and Enterprise-Wide SIEM Analytics

Abstract

This study presents a risk-centric methodology for detecting cyber threats across SAP landscapes through security event correlation, statistical anomaly profiling, and enterprise-wide Security Information and Event Management (SIEM) analytics. The research addresses the limitations of fragmented log monitoring, isolated security alerts, and conventional rule-based detection in complex SAP environments. A mixed-methods approach combines qualitative analysis of SAP security events and attack scenarios with quantitative evaluation of event frequency, behavioral deviations, alert correlation, and detection accuracy. The proposed methodology integrates SAP audit logs, application events, authentication records, and system activity indicators into a centralized analytical framework for identifying suspicious behavior and prioritizing security incidents according to operational risk. Evaluation criteria include detection precision, false-positive rates, incident identification time, and correlation effectiveness. The framework establishes a structured relationship between user behavior, technical anomalies, business process exposure, and potential security violations, enabling investigators to distinguish routine operational variations from meaningful threat indicators. Its principal contribution lies in connecting SAP-specific security context with enterprise SIEM capabilities to improve investigative consistency, threat visibility, and incident response prioritization. The findings provide a foundation for more reliable security monitoring, improved audit readiness, and evidence-based cybersecurity decisions across interconnected enterprise systems. The methodology also contributes to academic research by offering a repeatable model for evaluating log-based threat detection and anomaly analysis. Its practical significance extends to SAP security teams, auditors, and enterprise risk managers seeking measurable improvements in threat identification, investigation efficiency, and protection of critical business information.