Skip to content

Commit 2f629dc

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #206137 from oferInbar/Ofers-pre-GA1
Added Functions to the SAP solution Docs
2 parents 08298ae + 248aa68 commit 2f629dc

File tree

2 files changed

+267
-19
lines changed

2 files changed

+267
-19
lines changed

‎articles/sentinel/sap/sap-solution-log-reference.md

Lines changed: 265 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@ ms.custom: mvc, ignite-fall-2021
88
ms.date: 02/22/2022
99
---
1010

11-
# Microsoft Sentinel Threat Monitoring for SAP solution data reference (public preview)
11+
# Microsoft Sentinel Threat Monitoring for SAP solution data reference
1212

1313
[!INCLUDE [Banner for top of topics](../includes/banner.md)]
1414

1515
> [!IMPORTANT]
16-
> The Microsoft Sentinel Threat Monitoring for SAP solution is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
16+
> Some components of the Microsoft Sentinel Threat Monitoring for SAP solution are currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
1717
>
1818
> Some logs, noted below, are not sent to Microsoft Sentinel by default, but you can manually add them as needed. For more information, see [Define the SAP logs that are sent to Microsoft Sentinel](sap-solution-deploy-alternate.md#define-the-sap-logs-that-are-sent-to-microsoft-sentinel).
1919
>
@@ -31,6 +31,13 @@ Users are *strongly encouraged* to use the functions as the subjects of their an
3131
- [SAPUsersAuthorizations](#sapusersauthorizations)
3232
- [SAPConnectorHealth](#sapconnectorhealth)
3333
- [SAPConnectorOverview](#sapconnectoroverview)
34+
- [SAPUsersEmail](#sapusersemail)
35+
- [SAPAuditLogConfiguration](#sapauditlogconfiguration)
36+
- [SAPAuditLogAnomalies](#sapauditloganomalies)
37+
- [SAPSystems](#sapsystems)
38+
- [SAPUsersGetVIP](#sapusersgetvip)
39+
- [SAPUsersHeader](#sapusersheader)
40+
3441

3542
### SAPUsersAssignments
3643

@@ -65,7 +72,7 @@ Users are considered privileged when they are listed in the *SAP - Privileged Us
6572
**Parameters:**
6673
- TimeAgo
6774
- Optional
68-
- Default value: 7 days
75+
- Default value: Seven days
6976
- Determines that the function seeks User master data from the time defined by the `TimeAgo` value until the time defined by the `now()` value.
7077

7178
The **SAPUsersGetPrivileged** function returns the following data:
@@ -84,7 +91,7 @@ The **SAPUsersAuthorizations** function brings together data from several tables
8491
**Parameters:**
8592
- TimeAgo
8693
- Optional
87-
- Default value: 7 days
94+
- Default value: Seven days
8895
- Determines that the function seeks User master data from the time defined by the `TimeAgo` value until the time defined by the `now()` value.
8996

9097
The **SAPUsersAuthorizations** function returns the following data:
@@ -112,17 +119,16 @@ The **SAPConnectorHealth** function reflects the status of the agent's and the u
112119
| LastSeen | Timestamp of latest activity |
113120
| StatusCode | Code reflecting the system's status |
114121

115-
116122
### SAPConnectorOverview
117123

118124
The **SAPConnectorOverview** function shows row counts of each SAP table per System ID. It returns a list of data records per system ID, and their time generated.
119125

120126
**Parameters:**
121-
- TimeAgo
122-
- Optional
123-
- Default value: 7 days
124-
- Determines that the function seeks User master data from the time defined by the `TimeAgo` value until the time defined by the `now()` value.
125127

128+
- TimeAgo
129+
- Optional
130+
- Default value: Seven days
131+
- Determines that the function seeks User master data from the time defined by the `TimeAgo` value until the time defined by the `now()` value.
126132

127133
| Field | Description |
128134
| --------------- | ----------- |
@@ -136,6 +142,249 @@ SAPConnectorOverview(7d)
136142
| summarize count() by bin(TimeGenerated, 1d), SystemID_s
137143
```
138144

145+
### SAPUsersEmail
146+
147+
The **SAPUsersEmail** function allows for a performance oriented lookup of an SAP user's email address per SAP system and client, normally used to associate it with an active directory account.
148+
Using data extracted from SAP tables USR21 (User Name/Address Key Assignment) and ADR6 (E-Mail Addresses), the SAPUsersEmail function looks for an Email address. In case one is not found, the user ID is returned instead of an Email address. This behavior ensures that SAP service accounts (such as DDIC), that often are not associated with an email addresses, will be logged as pseudo AD accounts, enabling some UEBA features, aiding in the investigation of incidents and hunting activities.
149+
150+
| Field | Description |
151+
| --------------- | ----------- |
152+
| ClientID | The SAP Client ID |
153+
| SystemID | The SAP System ID |
154+
| User | The SAP User ID |
155+
| Email | The Email address of the SAP User |
156+
157+
### SAPSystems
158+
159+
The **SAPSystems** function is used to centrally present the per-system configuration made using the 'SAP - Systems' watchlist.
160+
161+
**Parameters:**
162+
163+
- SelectedSystems
164+
- Optional
165+
- Default value: "All Systems"
166+
- Used to filter specific SAP systems
167+
- SelectedSystemRoles
168+
- Optional
169+
- Default value: "All System Roles"
170+
- Determines the roles of the SAP Systems to be looked at (as defined in the "SAP - Systems" watchlist)
171+
172+
| Field | Description | Data Source/Notes
173+
| ------------- | ------------- | -------------
174+
| SearchKey | Search Key | Indexed field for SAP System ID
175+
| SystemRole | The SAP System's Role | Production, UAT
176+
| SystemUsage | The main usage of the SAP system | ERP, CRM
177+
| SystemID | The SAP System ID |
178+
179+
180+
### SAPAuditLogConfiguration
181+
182+
The **SAPAuditLogConfiguration** function returns the local configuration of the SAP audit log alerting of the Sentinel workspace, to be used for the different SAP audit log related alerts.
183+
It joins the data in the 'SAP Dynamic Audit Log Monitor Configuration' and 'SAP - Systems' watchlists to provide a per-system configuration at a per-system-role effort.
184+
185+
**Parameters:**
186+
187+
- SelectedSystems
188+
- Optional
189+
- Default value: "All Systems"
190+
- Used to filter specific SAP systems to look at.
191+
- SelectedSystemRoles
192+
- Optional
193+
- Default value: "All System Roles"
194+
- Determines the roles of the SAP Systems to be looked at (as defined in the "SAP - Systems" watchlist).
195+
- SelectedSeverities
196+
- Optional
197+
- Default value: ["High", "Medium"]
198+
- Used to determine events to be looked at in terms of their severities. Severities per SAP audit log message ID and system role are defined in the "SAP_Dynamic_Audit_Log_Monitor_Configuration" watchlist.
199+
- SelectedRuleTypes
200+
- Optional
201+
- Default value: "All RuleTypes"
202+
- Determines what events are relevant for detecting the anomalies on. Rule types per SAP audit log message ID and system role are defined in the "SAP_Dynamic_Audit_Log_Monitor_Configuration" watchlist.
203+
204+
| Field | Description | Data Source/Notes
205+
| ------------- | ------------- | -------------
206+
| CategoryName | SAP given event category | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
207+
| DestinationEmail | Email address of the Assigned Team | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
208+
| DetailedDescription | A markdown formatted text to be displayed on alerts | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
209+
| MessageID | The SAP audit log message ID | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
210+
| MessageText | A sample message text | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
211+
| RolesTagsToExclude | an ABAP Role, Profile or free text tag | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
212+
| RuleType | Anomaly or deterministic | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
213+
| Tactics | The MITRE ATTA&CK tactic | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
214+
| TeamsChannelID | Teams Channel | 'SAP Dynamic Audit Log Monitor Configuration' watchlist
215+
| SystemID | The SAP System ID | 'SAP - Systems' watchlist
216+
| SystemRole | The SAP System's Role | 'SAP - Systems' watchlist
217+
| SystemUsage | The main usage of the SAP system | 'SAP - Systems' watchlist
218+
| IsProd | Production system flag | 'SAP - Systems' watchlist
219+
| Severity | The derived severity | Severity per system usage
220+
| Threshold | The derived threshold | Event count per system Usage
221+
| BagOfDetails | Bag of Details | A dictionary detailing the event definition
222+
223+
224+
### SAPAuditLogAnomalies
225+
226+
The **SAPAuditLogAnomalies** uses Sentinel's underlying Kusto database's built-in machine learning capabilities to help detect anomalous events observed on the SAP audit log.
227+
Developed for the “SAP - (Experimental) Dynamic Anomaly based Audit Log Monitor Alerts” alert rule, this function was initially designed to alert on recent anomalies but it can also help to highlight historical anomalies (see examples below).
228+
229+
**Parameters:**
230+
231+
- LearningTime
232+
- Optional
233+
- Default Value: 14 days
234+
- Determines the timespan used for the model learning
235+
- DetectingTime
236+
- Optional
237+
- Default value: One hour
238+
- Determines the timespan to be looked at for detecting anomalies. Calling this function with DetectingTime = 0h will highlight anomalies across the entire LearningTime timespan
239+
- SelectedSystems
240+
- Optional
241+
- Default value: "All Systems"
242+
- Used to filter specific SAP systems to look at.
243+
- SelectedSystemRoles
244+
- Optional
245+
- Default value: "All System Roles"
246+
- Determines the roles of the SAP Systems to be looked at (as defined in the "SAP - Systems" watchlist).
247+
- SelectedSeverities
248+
- Optional
249+
- Default value: ["High", "Medium"]
250+
- Used to determine events to be looked at in terms of their severities. Severities per SAP audit log message ID and system role are defined in the "SAP_Dynamic_Audit_Log_Monitor_Configuration" watchlist.
251+
- SelectedPrefixMask
252+
- Optional
253+
- Default value: 24
254+
- Used to determine the subnet mask level used for learning and detecting.
255+
- SelectedRuleTypes
256+
- Optional
257+
- Default value: "AnomaliesOnly"
258+
- Determines what events are relevant for detecting the anomalies on. Rule types per SAP audit log message ID and system role are defined in the "SAP_Dynamic_Audit_Log_Monitor_Configuration" watchlist.
259+
260+
#### Logic
261+
262+
The function learns the slice of the history defined by the different input parameters, at the user, network attributes, system, seasonality, and activity levels. It then judges events occurring within the last DetectingTime timespan according to what it has learned, applying thresholds and other configurable exclusion criteria obtained from the SAP audit log configuration watchlist. Once a sliding window of user activity was deemed anomalous, a second query returns the entire user activity as evidence supporting the decision.
263+
264+
#### Additional notes
265+
266+
As with any machine learning solution, this function performs better with time. Further adjustments can be made using local configuration.
267+
It is advisable to restrict the size of the learned database to be under 100 million records using the many available input parameters.
268+
269+
Example: looking for anomalies for events of high severity that occurred within the past hour on production systems for event types which are marked as "AnomaliesOnly" in the "SAP_Dynamic_Audit_Log_Monitor_Configuration"
270+
271+
```kusto
272+
SAPAuditLogAnomalies(LearningTime = 14d, DetectingTime=1h, SelectedSystemRoles= dynamic(["Production"]),
273+
SelectedSeverities= dynamic(["High"]), SelectedRuleTypes= dynamic(["AnomaliesOnly"]))
274+
```
275+
276+
Example: Looking for all anomalies in the last 14 days in system "BIP"
277+
278+
```kusto
279+
SAPAuditLogAnomalies(LearningTime = 14d, DetectingTime=0h, SelectedSystems= dynamic(["BIP"]))
280+
```
281+
282+
| Field | Description |
283+
| --------------- | ----------- |
284+
| **Multiple fields from SAPAuditLog** | Key fields from the SAP Audit log |
285+
| **Multiple fields from SAPAuditLogConfiguration** | Key fields from the Sentinel for SAP audit log configuration |
286+
| DiscoveredOn | The rounded hour on which the anomaly was observed on |
287+
| EventCount | Number of events counted per row returned|
288+
| AnomalCount | Number of events observed within relevant sliding window|
289+
| MinTime | Time of first event observed |
290+
| MaxTime | Time of last event observed|
291+
| Score | the anomaly scores as produced by the anomaly model|
292+
293+
### SAPUsersGetVIP
294+
295+
The Sentinel for SAP solution uses a concept of central user tagging, designed to allow for lower false positive rate with minimal effort on the customer end:
296+
297+
- Users can be tagged using the "SAP User Config" watchlist (for example DDIC is assigned with “RunObsoleteProgOK”). Multiple users can have multiple tags.
298+
- An alert rule sends the relevant tags to the **SAPUsersGetVIP** function asking for a list of users to be excluded. The alert rule “SAP - Execution of an Obsolete or an Insecure Program” can ask for users bearing the tag “RunObsoleteProgOK”.
299+
300+
Here is a KQL query demonstrating the use case described below:
301+
302+
```kusto
303+
// Execution of Obsolete/Insecure Program
304+
let ObsoletePrograms = _GetWatchlist("SAP - Obsolete Programs");
305+
// here you can exclude system users which are OK to run obsolete/ sensitive programs
306+
// by adding those users in the SAP_User_Config watchlist with a tag of 'RunObsoleteProgOK'
307+
let excludeUsersTags= dynamic(['RunObsoleteProgOK']);
308+
let excludedUsers= SAPUsersGetVIP(SearchForTags= dynamic(["RunObsoleteProgOK"]))| summarize by User2Exclude=SAPUser;
309+
// Query logic
310+
SAPAuditLog
311+
| where MessageID == 'AUW'
312+
| where ABAPProgramName in (ObsoletePrograms) // The program is obsolete
313+
| join kind=leftantisemi excludedUsers on $left.User == $right.User2Exclude
314+
```
315+
316+
This functionality is heavily used in the Deterministic and Anomalous Audit Log Monitor Alerts, 'where tags can be associated with SAP audit log message ID, and can also be easily extended to custom alert rules.
317+
**Parameters:**
318+
319+
- SearchForTags
320+
- Optional
321+
- Default value: dynamic('All Tags')
322+
- When SearchForTags equals 'All Tags', all users are returned along with their tags, else, only users bearing the tags specified in SearchForTags are returned. TagsIntersect will show which tags were found, and IntersectionSize will hold the count of those.
323+
- SpecialFocusTags
324+
- Optional
325+
- Default value: "Do not return any in-focus users"
326+
- The function returns all users bearing the tags specified in SpecialFocusTags, and marked those with specialFocusTagged = true.
327+
328+
| Source | Field | Description | Notes
329+
| ------------- | ------------- | ------------- | -------------
330+
| The "SAP User Config" watchlist | SearchKey | Search Key |
331+
| The "SAP User Config" watchlist | SAPUser | The SAP User | OSS, DDIC
332+
| The "SAP User Config" watchlist | Tags | string of tags assigned to user | RunObsoleteProgOK
333+
| The "SAP User Config" watchlist | User AAD Object ID | Azure AD Object ID |
334+
| The "SAP User Config" watchlist | User Identifier | AD User Identifier |
335+
| The "SAP User Config" watchlist | User On-Premises Sid | |
336+
| The "SAP User Config" watchlist | User Principal Name | |
337+
| The "SAP User Config" watchlist | TagsList | A list of tags assigned to user | ChangeUserMasterDataOK;RunObsoleteProgOK
338+
| Logic | TagsIntersect | A set of tags that matched SearchForTags | ["ChangeUserMasterDataOK","RunObsoleteProgOK"]
339+
| Logic | SpecialFocusTagged | Special focus indication | True, False
340+
| Logic | IntersectionSize | The number of intersected Tags |
341+
342+
### SAPUsersHeader
343+
344+
The **SAPUsersHeader** function is designed to provide a high-level view of the SAP user. It uses data extracted from both the SAP user master data tables and recent activity on the SAP audit log to gather Email and IP addresses. It then returns last known email and IP addresses along with primary email and IP addresses.
345+
**Parameters:**
346+
SelectedSystemRoles:dynamic = dynamic(["All System Roles"]) SelectedSystems:dynamic = dynamic(["All Systems"]) SelectedUsers:dynamic = dynamic(["All Users"]) SelectedUser:string = "All Users"
347+
348+
- SelectedSystems
349+
- Optional
350+
- Default value: "All Systems"
351+
- Used to filter specific SAP systems to look at.
352+
- SelectedSystemRoles
353+
- Optional
354+
- Default value: "All System Roles"
355+
- Determines the roles of the SAP Systems to be looked at (as defined in the "SAP - Systems" watchlist).
356+
- SelectedUsers
357+
- Optional
358+
- Default value: "All Users"
359+
- Can input lists of users.
360+
- SelectedUser
361+
- Optional
362+
- Default value: "All Users"
363+
- Accepts a single user only
364+
365+
#### Additional notes
366+
For performance considerations, only a few days of audit activity are considered.
367+
For a full history of user activity, run a custom KQL query against the SAPAuditLog function.
368+
369+
| Source | Field | Description | Notes
370+
| ------------- | ------------- | ------------- | -------------
371+
| | User | The SAP user |
372+
| SAP tables ADR6 and USR21 | Email | Taken from user's master data | OSS, DDIC
373+
| SAP table USR02 | UserType | string of tags assigned to user | RunObsoleteProgOK
374+
| SAP table USR02 | Timezone | Azure AD Object ID |
375+
| SAP table USR02 | LockedStatus | AD User Identifier |
376+
| SAP audit log | LastSeen | A timestamp | last audit event observed for the user
377+
| SAP audit log | LastSeenDaysAgo | days passed since LastSeen |
378+
| SAP audit log | PrimaryIP | Most frequently used IP address | ChangeUserMasterDataOK;RunObsoleteProgOK
379+
| SAP audit log | LastKnownIP | Most recently used IP address | ["ChangeUserMasterDataOK","RunObsoleteProgOK"]
380+
| SAP audit log | PrimaryEmail | Most frequently used Email address | True, False
381+
| SAP audit log | KnownIPs | List of known IP addresses | sorted by most frequent first
382+
| SAP audit log | KnownEmails | List of known Email addresses | sorted by most frequent first
383+
| | Client | The SAP Client ID |
384+
| | SystemID | The SAP system ID |
385+
| | SystemRole | The SAP System's Role | Production, UAT
386+
| | SystemUsage | The main usage of the SAP system | ERP, CRM
387+
139388

140389
## Logs produced by the data connector agent
141390

@@ -146,9 +395,9 @@ For best results, use the Microsoft Sentinel functions listed below to visualize
146395
- [ABAP Application log](#abap-application-log)
147396
- [ABAP Change Documents log](#abap-change-documents-log)
148397
- [ABAP CR log](#abap-cr-log)
149-
- [ABAP DB table data log](#abap-db-table-data-log)
150-
- [ABAP Gateway log](#abap-gateway-log)
151-
- [ABAP ICM log](#abap-icm-log)
398+
- [ABAP DB table data log](#abap-db-table-data-log-preview) (PREVIEW)
399+
- [ABAP Gateway log](#abap-gateway-log-preview) (PREVIEW)
400+
- [ABAP ICM log](#abap-icm-log-preview) (PREVIEW)
152401
- [ABAP Job log](#abap-job-log)
153402
- [ABAP Security Audit log](#abap-security-audit-log)
154403
- [ABAP Spool log](#abap-spool-log)
@@ -291,7 +540,7 @@ For best results, use the Microsoft Sentinel functions listed below to visualize
291540
| ViewName | View name |
292541

293542

294-
### ABAP DB table data log
543+
### ABAP DB table data log (PREVIEW)
295544

296545
To have this log sent to Microsoft Sentinel, you must [add it manually to the **systemconfig.ini** file](sap-solution-deploy-alternate.md#define-the-sap-logs-that-are-sent-to-microsoft-sentinel).
297546

@@ -325,7 +574,7 @@ To have this log sent to Microsoft Sentinel, you must [add it manually to the **
325574
| VersionNumber | Version number |
326575

327576

328-
### ABAP Gateway log
577+
### ABAP Gateway log (PREVIEW)
329578

330579
To have this log sent to Microsoft Sentinel, you must [add it manually to the **systemconfig.ini** file](sap-solution-deploy-alternate.md#define-the-sap-logs-that-are-sent-to-microsoft-sentinel).
331580

@@ -335,7 +584,7 @@ To have this log sent to Microsoft Sentinel, you must [add it manually to the **
335584

336585
- **Log purpose**: Monitors Gateway activities. Available by the SAP Control Web Service. This log is generated with data across all clients.
337586

338-
#### ABAPOS_GW_CL log schema
587+
#### ABAPOS_GW_CL log schema
339588

340589
| Field | Description |
341590
| ------------ | ---------------- |
@@ -347,8 +596,7 @@ To have this log sent to Microsoft Sentinel, you must [add it manually to the **
347596
| SystemNumber | System number |
348597

349598

350-
### ABAP ICM log
351-
599+
### ABAP ICM log (PREVIEW)
352600
To have this log sent to Microsoft Sentinel, you must [add it manually to the **systemconfig.ini** file](sap-solution-deploy-alternate.md#define-the-sap-logs-that-are-sent-to-microsoft-sentinel).
353601

354602
- **Microsoft Sentinel function for querying this log**: SAPOS_ICM

0 commit comments

Comments
 (0)