SAP Application Log Analysis pilot dataset

<p>A CSV file prepared from application logs stemming from an SAP BI Warehouse system. This realistic dataset was generated as a means to showcase the SAP pilot use-case of the TOREADOR project.</p> <p>Each line corresponds to a user action.</p> <p>Extid, object and subobject were extracted from the BI system logs, along with the user name and event date.<br> Role was retrieved from the standard user actions</p> <p>Label indicates whether the event is benign or malign - Elevation_of_privileges is an event the user should not be able to perform within the boundaries of his role. Priv_abuse is about a privileged account performing an action breaching a confidentiality clause (e.g. an administrator reading sensitive data). Forgotten_user is about a user who stayed inactive for a long time before being used again (e.g. an employee who left the company where the account was not terminated). Records where no malign activity was detected were marked &#39;benign&#39;.</p> <p>Outbushours was computed from the time of the action, and mapped to &#39;inside&#39; or &#39;outside&#39; business hours.</p>