Data Extraction Guide
for Sage X3
Step-by-step instructions for your IT team to extract the required data files from Sage X3 via the Syracuse REST API for the V/ergent security and controls assessment. Includes Release 5 programme packs: 25 AML / Wolfsberg controls + 50 cross-system SoD rules + (SAP-only) 30 SAP-GRC-parity fraud patterns.
Recommended extraction path
Use the V/ergent extractor first. It writes CSVs to a timestamped folder under C:\Vergent\Export, then you upload that folder into the audit project.
Manual path if automated extraction is blocked
Use the required-file list below as the manual checklist. Keep filenames unchanged, leave unavailable files empty with only headers, and record any missing source in the upload notes before running the audit.
Extract-VergentSageX3.ps1 uses the Sage X3 Syracuse REST API to extract all 18 files. No additional PowerShell modules required.| Requirement | Details | Notes |
|---|---|---|
| Sage X3 User | ADMIN profile or full-access equivalent | Required for AUTILIS, ADXTRACE, ADXLOG tables |
| Syracuse Server URL | https://[host]:[port] (default HTTPS port: 8124) | REST base: /api1/x3/erp/[solution]/ |
| Solution/Folder Name | e.g. ACME, X3DEMO, PROD | Administration → Folders → Solution name |
| Audit Table (ADXTRACE) | Must be enabled in Parameters → Traceability | Required for audit_table.csv and change-tracking checks |
User Accounts (AUTILIS)
All X3 users from AUTILIS table: user code, profile, status, last login, admin flag, auth type
User Profiles / Function Sets
Profile definitions: access type (ALL/RESTRICTED/READ), description, created date
Function Authorizations
Per-profile function access: function code (GACCENTRY, PAYMENTH, PTEMPH), access level, module
Connection Log (ADXLOG)
Login events from ADXLOG: user code, date, IP address, status, session duration, logout type
Audit Table (ADXTRACE)
Record change history from ADXTRACE: table, field, user, modification date, old/new value, action type
Workflow Definitions
X3 workflow config: object code, enabled flag, approval required, approver profile, dual approval
Fiscal Periods
All fiscal periods: period code, start/end dates, status (OPEN/CLOSED), fiscal year
Journal Entries (GACCENTRY)
Manual journals (last 90 days): journal ID, date, amount, created by, approved by, period status
Purchase Orders (PORDER)
PO records (last 90 days): PO ID, amount, supplier, created by, approved by, status
Vendor Master (BPSUPPLIER)
All suppliers: vendor ID, name, tax ID, bank account (masked), modified by, approved by
Payment Transactions (PAYMENTH)
Payment records (last 90 days): payment ID, amount, vendor, created by, approved by, method
Approval / Signature History
Workflow signature events: object code, submitted by, approved by, date, status, notes
Web Services Endpoints
Syracuse web service endpoints: URL, auth type (Basic/None/OAuth), status, last used
Batch Server Configuration
X3 batch task server settings: server name, host, status, run-as user, batch type
Data Access Rules
GESAME data restriction rules: table, profile, access type, filter condition
Report & Inquiry Permissions
Report access: report code, profiles with access, access level, data filter
Site / Folder Settings
System parameters (ADPPAR): session timeout, default admin changed, patch level, HTTPS, debug mode
Password & Security Settings
Password policy: min length, complexity requirements, expiry, lockout threshold, history
Native coverage: 16 SoD rules (SX3-SOD-001..016).
Plus the three Release 5 programme packs that run alongside this platform's audit:
- AML / Wolfsberg Programme Controls — 25 controls spanning sanctions-list cadence, PEP / KYC review, CTR / SAR filing, structuring detection, transaction-monitoring tuning. Wired into all 7 ERP connectors (skips on cloud-only audits). Guide.
- Cross-System SoD — 50 multi-ERP conflict patterns spanning SAP × Oracle × D365 × NetSuite × Sage × AWS × Azure. Detects fraud paths a single-system review will never see. Guide.
- SAP Fraud Patterns — 30 SAP-GRC-parity patterns (STAD audit-log delete, debugger replace in PROD, Z* shadow SAP_ALL, dormant SAP_ALL, posting-period unlock + GL post, etc.). Guide.
Every finding carries citations across 13 frameworks (COSO 2013, COBIT 2019, NIST CSF 2.0, ISO 27001:2022, CIS v8, SOX ITGC, SOC 2 TSC, PCI DSS v4, HIPAA, DORA, NIS2, GDPR, Kenya DPA) — 11 of 13 at ≥75% mapped coverage. See the Check Packs page for per-pack framework coverage badges.