Monitoring and tracking user activities in Sage X3

Monitoring and tracking user activities in Sage X3 allows companies to understand which operations (new, update, delete, read or export) a specific user has accessed in a specific time period, or in a specific function. It is difficult to address this request if Sage X3 has not been set up properly. Some companies choose to activate the audit feature on tables to acquire this information. This approach might not be effective and efficient in all cases given that:

• The combination of the number of fields audited and the number of audit records created by a given business process has performance implications that may be unacceptable.
• Audit log provides objective evidence for fraud but does not prevent or mitigate it in the first place.

In order to address company needs and minimize the above mentioned weaknesses, our recommended approach consists of a combination of four methods:

1) Define role-based access to Sage X3

(Specifics to be outlined in a future blog)

2) Activate Audit trail only for some select tables and fields depending on sensitivity.

The benefits of activating table Audit includes:

• Audit log chronologically documents the sequence of activities affecting an operation, event, function or report.
• It is used to track the date, time and activity of each user on a specific table
• It may be very useful in some situations such as fraud, investigation…

You might choose to discuss with the process owner what information the tracking is needed for to limit the impact on Sage X3 performance.

3) Set up Workflow Notification for some selected activities

Workflow Notifications in Sage X3 allow emails to be sent based on certain criteria that are met in the system (alerts). The benefits of Workflow Notification are substantial:

• Problems are detected and solved in a timely manner (not in hours or days)
• Workflow Notification simplifies communication between stakeholders and the company while improving quality, traceability, accuracy of communication
• Preserve data integrity
• It a powerful security tool when set up effectively
• It does not consume much space as audit is on the table

You might choose to discuss with the process owner what information the tracking is needed for to limit the impact on Sage X3 performance .

4) Signature management is also a powerful security tool

(specifics to be outlined in a future)

Procedure to set up Audit on table and workflow notification

1. Activate Audit on a table.

To set up:

From Development>Data and Parameters>Tables select Tables

From the list on the select the table to be Audited (the supplier table is BPSUPPLIER and the Authorized credit field is OSTAUZAMT)

To view the result:

From Usage>Audit select Tables, on the screen below, you can use the Criteria on the bottom of your screen to filter you selection.

2. Set up Workflow Notification for some selected activities

You can create Notifications (alerts) by sending e-mail messages to recipients.

To set up workflow notification:

From Setup >Workflow select Notification

Click Create to create a new notification

3. Set up notification email

To be operational, the recipients’ workflow emails need to be set up (Users and business partner).

To set up user workflow emails, from Setup>Users select Users. From the list on the left, select the user you want and enter his/ her email address on the field Workflow e-mail address as below

4. Set up the BP (customer, supplier) in the field email on Contacts tab.

After following the entire step above, your alert will be done as configured.

Some steps have been skipped in this document. Its purpose was to show you how your security concern can be supported effectively in Sage X3.

Talk to us today at Mantralogix and we would be pleased to help you optimize your Sage ERP software security.