File Activity Anomaly Alert

Hi @SSchmidt , thanks for the post!

On the backend, there’s an algorithm that determines what file appears anomalous, though it’s internal, nothing public.

  That KB article does a great job in explaining how to investigate the results.

Tagging in @DMCVault for awareness.

Hey Mike,

do you know if there is any report which show the pathes or is the way still the same like in the KB ? 

Because in a small envirmoment i get 4 - 9 mails per day with this alert when i hafe to do this research for each alert happy birthday :) 

Hi,

is there any possibilty to exclude an path from the File Activity Anomaly Alert ?

Yes you can!

As per the main doc:

Note: You can use the sAnomalyFilters additional setting to skip a path from anomaly monitoring. However, note that this additional setting does not recognize paths that include special characters (for example, the character "é"). If a special character is present in a path, you cannot use the sAnomalyFilters additional setting to skip it from anomaly monitoring.

Hi,

sAnomalyFilters add. settings I want to filter the following path using. However, since the SAP_RSPO_CF_LDDA33.clf part is constantly changing, Add. I wrote D:\usr\sap\BWP\D00\work\ in the value part of the Settings setting, but it didn't do any filtering. Could I be doing something wrong?

D:\usr\sap\BWP\D00\work\SAP_RSPO_CF_LDDA33.clf

Regards.

Drop the last \.  Sometimes the filters/content definitions are REALLLLLY sensitive.