Building a landscape map in the RedRays Security Platform requires one thing from each SAP system: an authenticated read of that system's outbound RFC destination configuration, the same configuration a Basis administrator maintains in transaction SM59.
Nothing else is read. No business data, no user master record, no role, no table content beyond the destination configuration itself, and no code. If a system cannot be logged on to, it contributes nothing, and that absence matters more than it sounds, which is why it is stated again at the end of this page.
An account on each SAP system in scope that can log on remotely and read the RFC destination configuration. Two properties of that account are worth deciding deliberately.
| Decision | Why it matters |
|---|---|
| Read-only | Nothing in this analysis writes to an SAP system. The account does not need change authorisation and should not have it. |
| Per client | Destination configuration is read per client, so the clients you want covered are the clients the account must exist in. |
| Scoped to the read | The narrower the authorisation, the less the account is worth to somebody who takes the platform. Grant the remote read and the table read the analysis needs, and nothing beyond it. |
| Auditable | Give the scan its own account rather than reusing an administrator's. A landscape map is easier to defend when the logon record shows who produced it. |
Because the configuration is not exposed to anonymous callers, and it should not be. This is the point where the analysis differs from a port scan: a port scan asks what answers on the network and needs no credential, while this asks what is configured inside the system and needs one. SAP port and service scan is the other half of the exposure question, and it runs without any of this.
For each destination: its name, its type, and the parameters that decide whether it would let a caller reach the far system without a second password. Destinations that would not are discarded on the spot. The result is one entry per qualifying destination, which becomes one part of one line on the map.
Treat this material as sensitive. Destination configuration names the far systems in your landscape, the technical users that reach them, and the fact that a credential is stored. That is a description of the landscape's soft spots, and it is exactly what an attacker would want. The console does not display the stored credential field back to a user, and the platform runs on your own infrastructure so the extract does not leave your network. See deployment and where data goes.
As often as destinations change, which in most landscapes means after every project go-live and every interface change, and on a schedule between them. A destination is created by an ordinary configuration task that reaches no security team by default, so a map is a statement about the moment it was made.
Re-running replaces the previous map with the result of the new read rather than merging into it. That has one consequence worth planning around: a re-run in which some systems could not be logged on to produces a map covering fewer systems than the one before it, without the picture itself announcing the difference. Check which systems were read before you compare two maps.
The analysis reads. It does not create, change or delete SAP configuration, and the account it uses does not need authorisation to do so.
You can, and separate accounts are easier to reason about. Each capability needs a different read, so a shared account ends up holding the union of them, which is more than any one of them needs.
That system contributes nothing to the map. Its outbound destinations are unknown, not absent, and the drawing cannot distinguish the two. This is the single most important thing to check before treating a map as complete, and what the landscape map does not claim explains why.
No. A network scan finds systems and services. The map needs an authenticated read of destination configuration, which is a separate action against each SAP system. SAP threat modelling and attack paths describes what is built from it.