sap critial role assigned to new user
This rule monitors SAP environments by correlating Change Document logs (PFCG) with Security Audit logs (AUD) to detect when a sensitive or critical SAP role is assigned to a user. It specifically triggers when a change entry for the AGR_USERS table (User assignment to roles) is identified as an addition (CHNGIND='I') and the role is part of a predefined sensitive role list, while using the audit log to provide attribution for the action.
YARA-L
