Consulting

Cybersecurity & Security Monitoring

What is Cybersecurity Management?

Xiting Security Monitoring Solutions

At Xiting, our Cybersecurity & Security Monitoring (CSM) Team is dedicated to helping organizations protect their SAP landscapes with cutting-edge, subscription-based security monitoring solutions. We offer both expert consulting services and a fully managed Security Monitoring as a Service tailored for SAP, powered by our own Xiting Security Monitoring products. With a clear focus on innovation, scalability, and actionable insight, we support our customers in adopting modern detection and response strategies that align with today’s evolving threat landscape.

Fachkräfte planen Herausforderungen bei der SAP Cloud Benutzerverwaltung, inklusive einheitlichem ID-Lifecycle, automatisierter Berechtigungsvergabe und On-Prem-Integration.

SAP Security is Our Expertise
We See the Bigger IT Security Picture

At Xiting, we understand that SAP systems don’t exist in isolation. That’s why our security monitoring approach bridges the gap between SAP-specific risks and your broader IT security landscape — enabling end-to-end visibility, smarter threat detection, and stronger collaboration between SAP teams and customer enterprise non-SAP SOC (Security Operation Center). We help you secure your most critical assets without losing sight of the bigger cybersecurity strategy.

What is NIST Cybersecurity Framework (CSF)?

The NIST Cybersecurity Framework (CSF) 2.0 is a set of guidelines developed by the U.S. National Institute of Standards and Technology to help organizations manage and reduce cybersecurity risk. It consists of core functions—Govern, Identify, Protect, Detect, Respond, and Recover—which provide a structured approach to improving cybersecurity posture. Version 2.0 expands its scope to support all organizations, regardless of size or industry, and places a stronger emphasis on governance and supply chain risk management.

Information

What you need to know

Compliance & Regulatory Uncertainty

Effective Threat Detection Without Business Disruption

Limited Resources delay SAP threat detection and response

End-to-End Incident Response & Integration

Lack of SAP Security Expertise

Advanced Persistent Security Threats

Streamline Your SAP Security Monitoring Journey – From Strategy to Execution

To address these challenges, we designed Xiting SAP Security Monitoring Journey specifically tailored for SAP environments. Based on our experience and focus on SAP Security Monitoring solutions, the model helps organizations structure their journey toward effective, scalable, and use-case-driven monitoring across On-Prem systems (ABAP, HANA, JAVA) as well as SAP Cloud solutions such as SAP BTP. 

Xiting SAP security monitoring solutions

Our Services

No Monitoring / Not Established

Customer Situation

Risk

Goal

Xiting
Solutions

Xiting
Services

No Monitoring / Not Established

Customer Situation

Risk

Goal

Xiting
Solutions

Xiting
Services

Level 0

No Monitoring / Not Established

No log configuration or monitoring in plave. Security Audit Log is disabled or misconfigured.

Complete lack of visibility; compliance violations; undetected threats

Raise awareness of missing SAP log sources and visibility.

i

Level 1

Basic Monitoring Initiatives

Logs are enabgled (e.g., SAL), but not fine-tuned. No structured process.

Manual effort, no alerting or automation, audit-only driven.

Initial activation of logs (e.g. Security Audit Log) and compliance support.

Level 2

Technical Log Collection

Logs are forwarded to SIEM. No use-case correlation. No alert triage.

No active monitoring or alerting, false sense of security.

Ensure reliable log forwarding to central SIEM.

No Monitoring / Not Established

Customer Situation

Risk

Goal

Xiting
Solutions

Xiting
Services

Level 3

Initial Monitoring & Manual Review

First alerts in SIEM, Basis team checks manually. No triage or defined roles.

Inconsistent analysis, resource bottlenecks.

Evaluate and respond to selected events.

Level 4

SOC (as a Service) for SAP Security Monitoring

SAP systems monitored 24/7. Clear responsibilities & SLAs

Risk mitigated

Continuous SAP security Monitoring by a specialized provider with clear responsibilites and SLAs.

Fachkräfte planen Herausforderungen bei der SAP Cloud Benutzerverwaltung, inklusive einheitlichem ID-Lifecycle, automatisierter Berechtigungsvergabe und On-Prem-Integration.

Our solution

The holistic SAP security monitoring approach is complemented by the Xiting SIEM Cockpit to establish centralized SAP log analysis and real-time SAP threat detection. Through complex rule-based detection of suspicious activities in your SAP system, we offer proactive defense against potential threats.

Our experts leverage intelligent evaluation of log information to identify anomalies and take appropriate countermeasures.

Xiting Security Monitoring Services

Services We Offer

Xiting Security Monitoring
Foundation

Xiting Security Monitoring
Implementation

Xiting Security Monitoring
SoCaaS (Managed Service Operation)

Xiting Security Monitoring
Tabletop (TTX) Exercise

First-Time SAP Security Monitoring Implementation
We deliver a focused Proof of Concept (PoC) based on Xiting Security Monitoring Solutions, designed for organizations starting their SAP security monitoring journey. The PoC focuses on achieving initial visibility and basic threat detection by onboarding relevant SAP log sources (e.g., Security Audit Log, SYSTEM Logs), activating core use cases, and integrating with your existing SIEM. It offers a real-world introduction into SAP Security Monitoring, helping you assess feasibility, value, and next steps toward a full-scale implementation.
Efficient & Compliance-Ready SAP Security Monitoring & Incident Response
Enable robust, scalable SAP security monitoring aligned with compliance requirements such as SOX, GDPR, or ISO 27001. This includes efficient alert triage, clear escalation workflows, and standardized incident handling tailored to SAP-specific threats. Leveraging our Xiting Security Monitoring Solution, you gain a solid foundation for SOC readiness, with two possible deployment scenarios:
SAP Security Monitoring as a Managed Service (SOCaaS)
Deliver end-to-end SAP Security Monitoring as a fully managed service — covering everything from log collection and threat detection to analysis, response recommendations, and reporting. The Xiting Managed Service operates according to a defined SOC operation model (e.g., 24/7, 8/5, or custom TBD) with a flexible cost structure and service-level agreements (SLAs), such as guaranteed reaction times for critical alerts. This approach significantly reduces internal effort while ensuring professional, continuous SAP threat monitoring tailored to your business needs.
Empowering SOC Teams with SAP Security Expertise
Support existing SOC teams with deep SAP security expertise, ready-to-use detection content, and targeted SAP-specific training. This unique offering from Xiting focuses on hands-on enablement, combining real log examples, guided alert triage, and practical exercises based on real-world SAP threat scenarios (e.g. Insider Threats, Data Breach, Privilege Escalation). The goal is to close the SAP knowledge gap and enable your internal analysts to independently investigate and respond to SAP-related security incidents. Our practical approach is the key differentiator — tailored to SOC workflows and based on operational experience from real environments.

Your Contact

Moritz Holeschovsky
Head of SAP Cybersecurity

Integration of SAP Security Monitoring into a SIEM System

Cyber attacks often transcend system and application boundaries, exploiting interfaces. Therefore, it makes sense to integrate SAP security monitoring and threat analysis into a platform-agnostic SIEM system to better protect IT landscapes and leverage synergies in attack detection. We seamlessly integrate our SAP security monitoring and SAP threat analysis into a SIEM system for effective monitoring of large IT landscapes and optimal attack detection.

What do we offer?

With these solutions and products, we support our clients in implementing holistic SAP security monitoring and integrating it into an overarching cybersecurity framework. Through log filters, threat patterns, and false-positive detection, we provide a cost-effective solution for your security monitoring, preventing exponentially high costs by pre-filtering and optimizing the data volume in SIEM operations.

Your Contact

Moritz Holeschovsky
Head of Cybersecurity Management

Use Cases

Our TOP Use Cases

SAP Vulnerability & Compliance Monitoring (IKS)

Monitor vulnerabilities and compliance requirements in your SAP landscape automatically and centrally.

Real-Time SAP Security Monitoring & Threat Detection

Establishing a centralized SAP security monitoring solution for threat detection.

more information

Our SAP Cloud Service Ebook

solutions

Other Areas of Xiting

Authorization
Management

Our Consulting Unit Authorization Management focuses on properly and efficiently managing permissions and access controls in the SAP system.

Identity & Access Management

We focus on Identity and Access Management in hybrid SAP environments, with an emphasis on identities and permissions, as well as secure authentication.

Governance, Risk & Compliance

Meet the policies and compliance requirements in your organization with GRC Access Control!