Skip to content

Commit 1b73e22

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #222741 from limwainstein/sap-profiles-page
Adding new page on SAP ingestion profiles
2 parents 991a0ec + 41b0afe commit 1b73e22

7 files changed

+219
-4
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -486,7 +486,9 @@
486486
- name: Deploy SAP connector manually
487487
href: sap/sap-solution-deploy-alternate.md
488488
- name: Configure SAP audit log monitoring rules
489-
href: sap/configure-audit-log-rules.md
489+
href: sap/configure-audit-log-rules.md
490+
- name: Select SAP ingestion profile
491+
href: sap/select-ingestion-profiles.md
490492
- name: Troubleshoot
491493
items:
492494
- name: Troubleshoot CEF/Syslog data collection

‎articles/sentinel/sap/deploy-sap-security-content.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Track your SAP solution deployment journey through this series of articles:
3030
1. Optional deployment steps
3131
- [Configure auditing](configure-audit.md)
3232
- [Configure data connector to use SNC](configure-snc.md)
33-
33+
- [Select SAP ingestion profiles](select-ingestion-profiles.md)
3434

3535
## Deploy SAP security content
3636

‎articles/sentinel/sap/deployment-overview.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ Follow your deployment journey through this series of articles, in which you'll
4646
| **4. Deploy data connector agent** | [Deploy and configure the container hosting the data connector agent](deploy-data-connector-agent-container.md) |
4747
| **5. Deploy SAP security content** | [Deploy SAP security content](deploy-sap-security-content.md)
4848
| **6. Microsoft Sentinel Solution for SAP** | [Configure Microsoft Sentinel Solution for SAP](deployment-solution-configuration.md) |
49-
| **7. Optional steps** | - [Configure auditing](configure-audit.md)<br>- [Configure Microsoft Sentinel for SAP data connector to use SNC](configure-snc.md)<br>- [Configure audit log monitoring rules](configure-audit-log-rules.md)
49+
| **7. Optional steps** | - [Configure auditing](configure-audit.md)<br>- [Configure Microsoft Sentinel for SAP data connector to use SNC](configure-snc.md)<br>- [Configure audit log monitoring rules](configure-audit-log-rules.md)<br>- [Select SAP ingestion profiles](select-ingestion-profiles.md) |
5050

5151
## Next steps
5252

‎articles/sentinel/sap/deployment-solution-configuration.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ Track your SAP solution deployment journey through this series of articles:
3838
1. Optional deployment steps
3939
- [Configure auditing](configure-audit.md)
4040
- [Configure data connector to use SNC](configure-snc.md)
41+
- [Select SAP ingestion profiles](select-ingestion-profiles.md)
4142

4243
## Configure watchlists
4344

‎articles/sentinel/sap/preparing-sap.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ This article discusses the installation of the following CRs:
2121

2222
|CR |Required/optional |Description |
2323
|---------|---------|---------|
24-
|NPLK900271 |Required |This CR creates and configures a role. Alternatively, you can can load the authorizations directly from a file. [Review how to create and configure a role](prerequisites-for-deploying-sap-continuous-threat-monitoring.md#create-and-configure-a-role-required). |
24+
|NPLK900271 |Required |This CR creates and configures a role. Alternatively, you can load the authorizations directly from a file. [Review how to create and configure a role](prerequisites-for-deploying-sap-continuous-threat-monitoring.md#create-and-configure-a-role-required). |
2525
|NPLK900201 or NPLK900202 |Optional |[Retrieves additional information from SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md#retrieve-additional-information-from-sap-optional). You select one of these CRs according to your SAP version. |
2626

2727
## Prerequisites
@@ -56,6 +56,7 @@ Track your SAP solution deployment journey through this series of articles:
5656
1. Optional deployment steps
5757
- [Configure auditing](configure-audit.md)
5858
- [Configure data connector to use SNC](configure-snc.md)
59+
- [Select SAP ingestion profiles](select-ingestion-profiles.md)
5960

6061
To deploy the CRs, follow the steps outlined below. The steps below may differ according to the version of the SAP system and should be considered for demonstration purposes only.
6162

‎articles/sentinel/sap/prerequisites-for-deploying-sap-continuous-threat-monitoring.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ Track your SAP solution deployment journey through this series of articles:
2929
1. Optional deployment steps
3030
- [Configure auditing](configure-audit.md)
3131
- [Configure data connector to use SNC](configure-snc.md)
32+
- [Select SAP ingestion profiles](select-ingestion-profiles.md)
3233

3334
## Table of prerequisites
3435

‎articles/sentinel/sap/select-ingestion-profiles.md

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
---
2+
title: Select the SAP ingestion profile for your Microsoft Sentinel for SAP solution
3+
description: This article shows you how to select the profile for your Microsoft Sentinel for SAP solution.
4+
author: kobymon
5+
ms.author: kobymin
6+
ms.topic: how-to
7+
ms.date: 01/03/2023
8+
---
9+
10+
# Select SAP ingestion profile
11+
12+
This article explains how to select the profile for your SAP solution. We recommend that you select an ingestion profile that maximizes your security coverage while meeting your budget requirements.
13+
14+
Because SAP is a business application, and business processes tend to be seasonal, it may be difficult to predict the overall volume of logs over time. To address this issue, we recommend that you keep all logs on for two weeks, and learn from the observed activity. This learning can later be revised during business activity peaks, or major landscape transformations.
15+
16+
The following sections show typical customer configuration profiles for SAP log ingestion.
17+
18+
### Default profile (recommended)
19+
20+
This profile includes complete coverage for:
21+
22+
- Built-in analytics
23+
- The SAP user authorization master data tables, with users and privilege information
24+
- The ability to track changes and activities on the SAP landscape. This profile provides more logging information to allow for post-breach investigations and extended hunting abilities.
25+
26+
### systemconfig.ini file
27+
28+
```
29+
[Logs Activation Status]
30+
# ABAP RFC Logs - Retrieved by using RFC interface
31+
ABAPAuditLog = True
32+
ABAPJobLog = True
33+
ABAPSpoolLog = True
34+
ABAPSpoolOutputLog = True
35+
ABAPChangeDocsLog = True
36+
ABAPAppLog = True
37+
ABAPWorkflowLog = True
38+
ABAPCRLog = True
39+
ABAPTableDataLog = False
40+
# ABAP SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
41+
ABAPFilesLogs = False
42+
SysLog = False
43+
ICM = False
44+
WP = False
45+
GW = False
46+
# Java SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
47+
JAVAFilesLogs = False
48+
[ABAP Table Selector]
49+
AGR_TCODES_FULL = True
50+
USR01_FULL = True
51+
USR02_FULL = True
52+
USR02_INCREMENTAL = True
53+
AGR_1251_FULL = True
54+
AGR_USERS_FULL = True
55+
AGR_USERS_INCREMENTAL = True
56+
AGR_PROF_FULL = True
57+
UST04_FULL = True
58+
USR21_FULL = True
59+
ADR6_FULL = True
60+
ADCP_FULL = True
61+
USR05_FULL = True
62+
USGRP_USER_FULL = True
63+
USER_ADDR_FULL = True
64+
DEVACCESS_FULL = True
65+
AGR_DEFINE_FULL = True
66+
AGR_DEFINE_INCREMENTAL = True
67+
PAHI_FULL = True
68+
AGR_AGRS_FULL = True
69+
USRSTAMP_FULL = True
70+
USRSTAMP_INCREMENTAL = True
71+
AGR_FLAGS_FULL = True
72+
AGR_FLAGS_INCREMENTAL = True
73+
SNCSYSACL_FULL = False
74+
USRACL_FULL = False
75+
```
76+
77+
## Detection focused profile
78+
79+
This profile includes the core security logs of the SAP landscape required for the most of the analytics rules to perform well. Post-breach investigations and hunting capabilities are limited.
80+
81+
### systemconfig.ini file
82+
83+
```
84+
[Logs Activation Status]
85+
# ABAP RFC Logs - Retrieved by using RFC interface
86+
ABAPAuditLog = True
87+
ABAPJobLog = False
88+
ABAPSpoolLog = False
89+
ABAPSpoolOutputLog = False
90+
ABAPChangeDocsLog = True
91+
ABAPAppLog = False
92+
ABAPWorkflowLog = False
93+
ABAPCRLog = True
94+
ABAPTableDataLog = False
95+
# ABAP SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
96+
ABAPFilesLogs = False
97+
SysLog = False
98+
ICM = False
99+
WP = False
100+
GW = False
101+
# Java SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
102+
JAVAFilesLogs = False
103+
[ABAP Table Selector]
104+
AGR_TCODES_FULL = True
105+
USR01_FULL = True
106+
USR02_FULL = True
107+
USR02_INCREMENTAL = True
108+
AGR_1251_FULL = True
109+
AGR_USERS_FULL = True
110+
AGR_USERS_INCREMENTAL = True
111+
AGR_PROF_FULL = True
112+
UST04_FULL = True
113+
USR21_FULL = True
114+
ADR6_FULL = True
115+
ADCP_FULL = True
116+
USR05_FULL = True
117+
USGRP_USER_FULL = True
118+
USER_ADDR_FULL = True
119+
DEVACCESS_FULL = True
120+
AGR_DEFINE_FULL = True
121+
AGR_DEFINE_INCREMENTAL = True
122+
PAHI_FULL = False
123+
AGR_AGRS_FULL = True
124+
USRSTAMP_FULL = True
125+
USRSTAMP_INCREMENTAL = True
126+
AGR_FLAGS_FULL = True
127+
AGR_FLAGS_INCREMENTAL = True
128+
SNCSYSACL_FULL = False
129+
USRACL_FULL = False
130+
```
131+
## Minimal profile
132+
133+
The SAP Security Audit Log is the most important source of data the Microsoft Sentinel Solution for SAP uses to analyze activities on the SAP landscape. Enabling this log is the minimal requirement to provide any security coverage.
134+
135+
### systemconfig.ini file
136+
137+
```
138+
[Logs Activation Status]
139+
# ABAP RFC Logs - Retrieved by using RFC interface
140+
ABAPAuditLog = True
141+
ABAPJobLog = False
142+
ABAPSpoolLog = False
143+
ABAPSpoolOutputLog = False
144+
ABAPChangeDocsLog = False
145+
ABAPAppLog = False
146+
ABAPWorkflowLog = False
147+
ABAPCRLog = False
148+
ABAPTableDataLog = False
149+
# ABAP SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
150+
ABAPFilesLogs = False
151+
SysLog = False
152+
ICM = False
153+
WP = False
154+
GW = False
155+
# Java SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
156+
JAVAFilesLogs = False
157+
[ABAP Table Selector]
158+
AGR_TCODES_FULL = False
159+
USR01_FULL = False
160+
USR02_FULL = False
161+
USR02_INCREMENTAL = False
162+
AGR_1251_FULL = False
163+
AGR_USERS_FULL = False
164+
AGR_USERS_INCREMENTAL = False
165+
AGR_PROF_FULL = False
166+
UST04_FULL = False
167+
USR21_FULL = False
168+
ADR6_FULL = False
169+
ADCP_FULL = False
170+
USR05_FULL = False
171+
USGRP_USER_FULL = False
172+
USER_ADDR_FULL = False
173+
DEVACCESS_FULL = False
174+
AGR_DEFINE_FULL = False
175+
AGR_DEFINE_INCREMENTAL = False
176+
PAHI_FULL = False
177+
AGR_AGRS_FULL = False
178+
USRSTAMP_FULL = False
179+
USRSTAMP_INCREMENTAL = False
180+
AGR_FLAGS_FULL = False
181+
AGR_FLAGS_INCREMENTAL = False
182+
SNCSYSACL_FULL = False
183+
USRACL_FULL = False
184+
```
185+
## Next steps
186+
187+
Learn more about the Microsoft Sentinel Solution for SAP:
188+
189+
- [Deploy Microsoft Sentinel Solution for SAP](deployment-overview.md)
190+
- [Prerequisites for deploying Microsoft Sentinel Solution for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
191+
- [Deploy SAP Change Requests (CRs) and configure authorization](preparing-sap.md)
192+
- [Deploy and configure the container hosting the SAP data connector agent](deploy-data-connector-agent-container.md)
193+
- [Deploy SAP security content](deploy-sap-security-content.md)
194+
- [Deploy the Microsoft Sentinel for SAP data connector with SNC](configure-snc.md)
195+
- [Enable and configure SAP auditing](configure-audit.md)
196+
- [Collect SAP HANA audit logs](collect-sap-hana-audit-logs.md)
197+
198+
Troubleshooting:
199+
200+
- [Troubleshoot your Microsoft Sentinel Solution for SAP solution deployment](sap-deploy-troubleshoot.md)
201+
- [Configure SAP Transport Management System](configure-transport.md)
202+
203+
Reference files:
204+
205+
- [Microsoft Sentinel Solution for SAP data reference](sap-solution-log-reference.md)
206+
- [Microsoft Sentinel Solution for SAP: security content reference](sap-solution-security-content.md)
207+
- [Update script reference](reference-update.md)
208+
- [Systemconfig.ini file reference](reference-systemconfig.md)
209+
210+
For more information, see [Microsoft Sentinel solutions](../sentinel-solutions.md).

0 commit comments

Comments
 (0)