Skip to content

Commit c27a348

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#12917 from MartinPankraz/add-sap-public-cloud
Add-sap-public-cloud
2 parents 1b133dc + c688113 commit c27a348

File tree

10 files changed

+1231
-0
lines changed

10 files changed

+1231
-0
lines changed

‎Solutions/SAP S4 Cloud Public Edition/Data Connectors/SAPS4PublicPollerConnector/SAPS4Public_DCR.json‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
{
2+
"name": "SAPS4PublicDCR",
3+
"apiVersion": "2022-06-01",
4+
"type": "Microsoft.Insights/dataCollectionRules",
5+
"location": "{{location}}",
6+
"properties": {
7+
"dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
8+
"streamDeclarations": {
9+
"Custom-S4PublicCloudAuditLog_CL": {
10+
"columns": [
11+
{
12+
"name": "eventID",
13+
"type": "string"
14+
},
15+
{
16+
"name": "log_tstmp",
17+
"type": "datetime"
18+
},
19+
{
20+
"name": "slgmand",
21+
"type": "string"
22+
},
23+
{
24+
"name": "sid",
25+
"type": "string"
26+
},
27+
{
28+
"name": "counter",
29+
"type": "int"
30+
},
31+
{
32+
"name": "terminal_name",
33+
"type": "string"
34+
},
35+
{
36+
"name": "user_fullname",
37+
"type": "string"
38+
},
39+
{
40+
"name": "param_a",
41+
"type": "string"
42+
},
43+
{
44+
"name": "param_b",
45+
"type": "string"
46+
},
47+
{
48+
"name": "param_c",
49+
"type": "string"
50+
},
51+
{
52+
"name": "param_d",
53+
"type": "string"
54+
},
55+
{
56+
"name": "slgtc",
57+
"type": "string"
58+
},
59+
{
60+
"name": "slgrepna",
61+
"type": "string"
62+
},
63+
{
64+
"name": "rsau_text",
65+
"type": "string"
66+
},
67+
{
68+
"name": "UserID",
69+
"type": "string"
70+
},
71+
{
72+
"name": "useralias",
73+
"type": "string"
74+
},
75+
{
76+
"name": "email_adress",
77+
"type": "string"
78+
},
79+
{
80+
"name": "UserDescription",
81+
"type": "string"
82+
}
83+
]
84+
}
85+
},
86+
"destinations": {
87+
"logAnalytics": [
88+
{
89+
"workspaceResourceId": "{{workspaceResourceId}}",
90+
"name": "clv2ws1"
91+
}
92+
]
93+
},
94+
"dataFlows": [
95+
{
96+
"streams": [
97+
"Custom-S4PublicCloudAuditLog_CL"
98+
],
99+
"destinations": [
100+
"clv2ws1"
101+
],
102+
"transformKql": "source\n| extend TimeGenerated = now(), AgentId = \"S4-Public-Cloud\", ClientID = slgmand, Computer = terminal_name, Email = email_adress, MessageClass = eventID, MessageText = rsau_text, SystemID = sid, UpdatedOn = todatetime(log_tstmp), TransactionCode = slgtc, User = UserID, Variable1 = param_a, Variable2 = param_b, Variable3 = param_c, Variable4 = param_d\n| project TimeGenerated, AgentId, ClientID, Computer, Email, MessageClass, MessageText, SAL_DATE, SAL_TIME, SystemID, UpdatedOn, TransactionCode, User, Variable1, Variable2, Variable3, Variable4",
103+
"outputStream": "Microsoft-ABAPAuditLog"
104+
}
105+
]
106+
}
107+
}

‎Solutions/SAP S4 Cloud Public Edition/Data Connectors/SAPS4PublicPollerConnector/SAPS4Public_PollingConfig.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"name": "SAPS4PublicAlertsPolling",
3+
"apiVersion": "2023-02-01-preview",
4+
"type": "Microsoft.SecurityInsights/dataConnectors",
5+
"location": "{{location}}",
6+
"kind": "RestApiPoller",
7+
"properties": {
8+
"connectorDefinitionName": "SAPS4PublicAlerts",
9+
"dataType": "S4PublicCloudAuditLog_CL",
10+
"dcrConfig": {
11+
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
12+
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}",
13+
"streamName": "Custom-S4PublicCloudAuditLog_CL"
14+
},
15+
"addOnAttributes": {
16+
"S4HANACloudHost": "[[parameters('s4hanaHost')]"
17+
},
18+
"auth": {
19+
"type": "Basic",
20+
"userName": "{{username}}",
21+
"password": "{{password}}"
22+
},
23+
"request": {
24+
"apiEndpoint": "[[concat(parameters('s4hanaHost'), '/sap/opu/odata4/sap/rsau_log_api/srvd_a2x/sap/rsau_log_api/0001/SecurityAuditLog')]",
25+
"queryWindowInMin": 1,
26+
"httpMethod": "Get",
27+
"retryCount": 3,
28+
"timeoutInSeconds": 60,
29+
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
30+
"queryParameters": {
31+
"$filter": "log_tstmp gt {_QueryWindowStartTime} and log_tstmp le {_QueryWindowEndTime}"
32+
},
33+
"headers": {
34+
"Accept": "application/json;odata.metadata=minimal;charset=utf-8",
35+
"User-Agent": "Scuba"
36+
}
37+
},
38+
"response": {
39+
"eventsJsonPaths": [
40+
"$.value"
41+
],
42+
"format": "json"
43+
},
44+
"paging": {
45+
"pagingType": "LinkHeader",
46+
"linkHeaderTokenJsonPath": "$.['@odata.nextLink']"
47+
}
48+
}
49+
}

‎Solutions/SAP S4 Cloud Public Edition/Data Connectors/SAPS4PublicPollerConnector/SAPS4Public_connectorDefinition.json‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
{
2+
"name": "SAPS4PublicAlerts",
3+
"apiVersion": "2025-06-01",
4+
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
5+
"location": "{{location}}",
6+
"kind": "Customizable",
7+
"properties": {
8+
"connectorUiConfig": {
9+
"id": "SAPS4PublicAlerts",
10+
"title": "SAP S/4HANA Cloud Public Edition",
11+
"logo": "SapLogo.svg",
12+
"publisher": "SAP",
13+
"descriptionMarkdown": "The SAP S/4HANA Cloud Public Edition data connector enables ingestion of SAP's security audit log into the Microsoft Sentinel Solution for SAP, supporting cross-correlation, alerting, and threat hunting. Looking for alternative authentication mechanisms? See [here](https://github.com/Azure-Samples/Sentinel-For-SAP-Community/tree/main/integration-artifacts).",
14+
"graphQueriesTableName": "ABAPAuditLog",
15+
"graphQueries": [
16+
{
17+
"metricName": "Total events received",
18+
"legend": "SAP SAL Events",
19+
"baseQuery": "{{graphQueriesTableName}}"
20+
}
21+
],
22+
"sampleQueries": [
23+
{
24+
"description": "Get Sample of SAP SAL Events",
25+
"query": "{{graphQueriesTableName}}\n | take 10"
26+
}
27+
],
28+
"dataTypes": [
29+
{
30+
"name": "{{graphQueriesTableName}}",
31+
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
32+
}
33+
],
34+
"connectivityCriteria": [
35+
{
36+
"type": "HasDataConnectors"
37+
}
38+
],
39+
"availability": {
40+
"isPreview": true
41+
},
42+
"permissions": {
43+
"resourceProvider": [
44+
{
45+
"provider": "Microsoft.OperationalInsights/workspaces",
46+
"permissionsDisplayText": "Read and Write permissions are required.",
47+
"providerDisplayName": "Workspace",
48+
"scope": "Workspace",
49+
"requiredPermissions": {
50+
"write": true,
51+
"read": true,
52+
"delete": true
53+
}
54+
},
55+
{
56+
"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
57+
"permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
58+
"providerDisplayName": "Keys",
59+
"scope": "Workspace",
60+
"requiredPermissions": {
61+
"action": true
62+
}
63+
}
64+
],
65+
"customs": [
66+
{
67+
"name": "Client Id and Client Secret for Audit Retrieval API",
68+
"description": "Enable API access in BTP."
69+
}
70+
]
71+
},
72+
"instructionSteps": [
73+
{
74+
"description": "**Step 1 - Configuration steps for SAP S/4HANA Cloud Public Edition**\n\nTo connect to SAP S/4HANA Cloud Public Edition, you will need:\n\n1. **SAP S/4HANA Cloud Public Edition tenant API URL**\n2. **Valid username and password** for your SAP S/4HANA Cloud system\n3. **Appropriate authorizations** to access audit log data via OData services\n\nEnsure that your SAP S/4HANA Cloud Public Edition system has the necessary OData services enabled for audit log retrieval and that your user account has the required permissions to access security audit logs.\n\n>**NOTE:** Basic authentication must be enabled in your SAP S/4HANA Cloud Public Edition system for this data connector to work properly."
75+
},
76+
{
77+
"description": "Connect using Basic authentication",
78+
"title": "Connect events from SAP S/4HANA Cloud Public Edition to Microsoft Sentinel Solution for SAP",
79+
"instructions": [
80+
{
81+
"type": "ContextPane",
82+
"parameters": {
83+
"contextPaneType": "DataConnectorsContextPane",
84+
"label": "Add account",
85+
"isPrimary": true,
86+
"title": "S/4HANA Cloud Public Edition connection",
87+
"instructionSteps": [
88+
{
89+
"title": "Account Details",
90+
"instructions": [
91+
{
92+
"type": "Textbox",
93+
"parameters": {
94+
"label": "Username",
95+
"placeholder": "Enter your SAP S/4HANA Cloud username",
96+
"type": "text",
97+
"name": "username"
98+
}
99+
},
100+
{
101+
"type": "Textbox",
102+
"parameters": {
103+
"label": "Password",
104+
"placeholder": "Enter your SAP S/4HANA Cloud password",
105+
"type": "password",
106+
"name": "password"
107+
}
108+
},
109+
{
110+
"type": "Textbox",
111+
"parameters": {
112+
"label": "SAP S/4HANA Cloud API URL",
113+
"placeholder": "https://my123456-api.s4hana.cloud.sap",
114+
"type": "text",
115+
"name": "s4hanaHost"
116+
}
117+
}
118+
]
119+
}
120+
]
121+
}
122+
}
123+
]
124+
},
125+
{
126+
"title": "S/4HANA Cloud Public Edition connections",
127+
"description": "Each row represents a connected S/4HANA Cloud Public Edition system",
128+
"instructions": [
129+
{
130+
"type": "DataConnectorsGrid",
131+
"parameters": {
132+
"mapping": [
133+
{
134+
"columnName": "S/4HANA Cloud API endpoint",
135+
"columnValue": "properties.request.apiEndpoint"
136+
}
137+
],
138+
"menuItems": [
139+
"DeleteConnector"
140+
]
141+
}
142+
}
143+
]
144+
}
145+
]
146+
}
147+
}
148+
}

‎Solutions/SAP S4 Cloud Public Edition/Data/Solution_SAPS4Public.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"Name": "SAP S4 Cloud Public Edition",
3+
"Author": "SAP",
4+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/SAPBTP.svg\" width=\"75px\" height=\"75px\">",
5+
"Description": "SAP S/4HANA Cloud is a next-generation enterprise resource planning (ERP) suite designed to help businesses run more efficiently and effectively.\n\nThe SAP S/4HANA Cloud Public Edition add-on for the Microsoft Sentinel Solution for SAP will collect logs from the SAP S/4HANA Cloud security audit log, detect threats, suspicious activities, illegitimate activities, and more. Find additional details here: https://learn.microsoft.com/azure/sentinel/sap/solution-partner-overview.\n\nLooking for alternative authentication mechanisms? See [here](https://github.com/Azure-Samples/Sentinel-For-SAP-Community/tree/main/integration-artifacts). ",
6+
"WorkbookDescription": [],
7+
"Workbooks": [],
8+
"Analytic Rules": [],
9+
"Playbooks": [],
10+
"PlaybookDescription": [],
11+
"Parsers": [],
12+
"SavedSearches": [],
13+
"Hunting Queries": [],
14+
"Data Connectors": [
15+
"/Data Connectors/SAPS4PublicPollerConnector/SAPS4Public_connectorDefinition.json"
16+
],
17+
"Watchlists": [],
18+
"WatchlistDescription": [],
19+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\SAP S4 Cloud Public Edition",
20+
"Version": "3.0.0",
21+
"Metadata": "SolutionMetadata.json",
22+
"TemplateSpec": true,
23+
"Is1PConnector": false
24+
}

‎Solutions/SAP S4 Cloud Public Edition/Package/3.0.0.zip‎

7.33 KB
Binary file not shown.

0 commit comments

Comments
 (0)