Skip to main content
SAP publishes Security Notes — bulletins describing vulnerabilities, misconfigurations, and recommended fixes across SAP products. The volume is high, and most notes are irrelevant to any given customer because they target products or component versions you don’t have installed. Luumen ingests every published note and uses your captured SAP component data to filter the list down to the ones that actually affect your fleet.

​
How it works

1

Luumen ingests notes from SAP

Notes are pulled in continuously as SAP publishes them. Each note carries its identifier, CVSS score, description, affected products, and recommended fix.
2

AI summarizes the note

Luumen generates a human-readable summary, classifies severity and impact, and extracts the SAP components and versions the note affects.
3

Luumen matches notes to hosts

Each note is compared against the SAP Components property reported for each host. Hosts that have an affected component (at an affected version) are flagged as exposed.
4

Irrelevant notes are auto-resolved

Notes with no matching hosts in your fleet are marked Resolved automatically — they don’t clutter the active list.
5

Unverifiable notes are flagged for manual review

Some notes can’t be matched programmatically (e.g., they reference configuration that isn’t visible from outside the SAP system). These are surfaced separately so a human can decide.
The net result: your team sees a focused list of notes that match your real exposure, not the full SAP feed.

​
Where to find them in the UI

Open System Alerts → SAP Security Notes to see the current list. Two tabs at the top:
  • Unresolved — notes that match at least one host in your fleet and need attention.
  • Resolved — notes auto-resolved because no hosts match, plus any you’ve manually resolved.
Columns include:
ColumnDescription
CVSSSeverity score and label (Critical, High, Medium, Low).
NameSAP note ID, CVE identifier when present, and a short title.
Days OpenDays since the note was published or first detected as relevant to you.
HostsCount of hosts in your fleet affected by this note.
Click any row to see the full note: the AI summary, affected components and versions, the list of affected hosts in your environment, and the recommended remediation.

​
Triage flow

When a new note appears as Unresolved:
  1. Open the note and read the AI summary to understand the impact.
  2. Click into the Affected hosts list to see which hosts in your fleet are exposed.
  3. Decide on a remediation path — typically applying the SAP-recommended fix (often itself an SAP Note / transport) on each affected host.
  4. After applying the fix and the next agent run, the note’s component versions should no longer match. The note moves to Resolved automatically.

​
Why a note might be missing

If you expect a specific note to appear and don’t see it, the most common cause is missing component data:
  • The matching engine uses the SAP Components property. If a host has no value for that property, no security note can match against it.
  • See SAP security notes troubleshooting for the diagnostic flow.
If components are reported but you still don’t see a specific note, check whether the note is filed under a product or version that isn’t actually present on your hosts. The AI mapping is conservative — it won’t match a note to a host unless the component and version overlap meaningfully.

​
A note about auto-resolution

Auto-resolving notes with no matching hosts is a deliberate design choice. SAP publishes hundreds of notes per month, the majority of which don’t apply to any given customer. Without filtering, the active list becomes unusable and security teams stop reading it. Auto-resolution keeps the signal-to-noise ratio high. If you want to audit what was auto-resolved (e.g., during a compliance review), the Resolved tab includes every auto-resolved note alongside the matching attempt that ruled it out.