sap shared source ip across multiple users

Google SecOps@GoogleSecOps

•updated 6 days ago•0•0•0

Detects multiple distinct SAP users authenticating successfully from a single source IP address within a short time window (30 minutes), potentially indicating compromised credentials or shared access anomalies.