What happens to data within SAP Enterprise Threat Detection during the aggregation process?

During the aggregation process in SAP Enterprise Threat Detection, data undergoes several transformations to enhance security analysis. It is pseudonymized, replacing sensitive identifiers (e.g., user IDs) with pseudonyms to protect privacy while maintaining data utility for threat detection. Data is normalized, converting heterogeneous data formats from various sources into a standardized structure, ensuring consistency for analysis across systems. Additionally, data is enriched by adding contextual information, such as system metadata or threat intelligence, to improve the accuracy of threat identification. These processes enable SAP Enterprise Threat Detection to efficiently analyze large volumes of data while safeguarding sensitive information. Prioritization is not part of aggregation, as it relates to post-analysis actions, and categorization occurs during analysis, not aggregation. By pseudonymizing, normalizing, and enriching data, SAP Enterprise Threat Detection ensures robust threat detection capabilities, supporting real-time monitoring and compliance with data protection regulations in SAP environments.