Skip to content

Commit 41b5dce

Browse files
Merge pull request #206630 from tamirkopitz/kopitz/sentinel4sap/maintain_authorization_objects
Kopitz/sentinel4sap/maintain authorization objects
2 parents e2ad7a9 + c8e5878 commit 41b5dce

File tree

2 files changed

+107
-57
lines changed

2 files changed

+107
-57
lines changed

articles/sentinel/sap/preparing-sap.md

Lines changed: 100 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ Track your SAP solution deployment journey through this series of articles:
3939

4040
> [!IMPORTANT]
4141
> - This article presents a [**step-by-step guide**](#deploy-change-requests) to deploying the required CRs. It's recommended for SOC engineers or implementers who may not necessarily be SAP experts.
42-
> - Experienced SAP administrators that are familiar with CR deployment process may prefer to get the appropriate CRs directly from the [**SAP environment validation steps**](prerequisites-for-deploying-sap-continuous-threat-monitoring.md#sap-environment-validation-steps) section of the guide and deploy them. Note that the *NPLK900206* CR deploys a sample role, and the administrator may prefer to manually define the role according to the information in the [**Required ABAP authorizations**](#required-abap-authorizations) section below.
42+
> - Experienced SAP administrators that are familiar with CR deployment process may prefer to get the appropriate CRs directly from the [**SAP environment validation steps**](prerequisites-for-deploying-sap-continuous-threat-monitoring.md#sap-environment-validation-steps) section of the guide and deploy them. Note that the *NPLK900271* CR deploys a sample role, and the administrator may prefer to manually define the role according to the information in the [**Required ABAP authorizations**](#required-abap-authorizations) section below.
4343
4444
> [!NOTE]
4545
>
@@ -81,10 +81,10 @@ To deploy the CRs, follow the steps outlined below:
8181
wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/R900201.NPL
8282
```
8383

84-
- Download NLPK900206
84+
- Download NLPK900271
8585
```bash
86-
wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/K900206.NPL
87-
wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/R900206.NPL
86+
wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/K900271.NPL
87+
wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/R900271.NPL
8888
```
8989

9090
Note that each CR consists of two files, one beginning with K and one with R.
@@ -171,7 +171,7 @@ To deploy the CRs, follow the steps outlined below:
171171

172172
## Configure Sentinel role
173173

174-
After the *NPLK900206* change request is deployed, a **/MSFTSEN/SENTINEL_CONNECTOR** role is created in SAP. If the role is created manually, it may bear a different name.
174+
After the *NPLK900271* change request is deployed, a **/MSFTSEN/SENTINEL_CONNECTOR** role is created in SAP. If the role is created manually, it may bear a different name.
175175

176176
In the examples shown here, we will use the role name **/MSFTSEN/SENTINEL_CONNECTOR**.
177177

@@ -232,69 +232,115 @@ The following table lists the ABAP authorizations required to ensure that SAP lo
232232
The required authorizations are listed here by log type. Only the authorizations listed for the types of logs you plan to ingest into Microsoft Sentinel are required.
233233

234234
> [!TIP]
235-
> To create a role with all the required authorizations, deploy the SAP change request *NPLK900206* on the SAP system. This change request creates the **/MSFTSEN/SENTINEL_CONNECTOR** role that has all the necessary permissions for the data connector to operate.
235+
> To create a role with all the required authorizations, deploy the SAP change request *NPLK900271* on the SAP system, or load the role authorizations from the [MSFTSEN_SENTINEL_CONNECTOR_ROLE_V0.0.27.SAP](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Sample%20Authorizations%20Role%20File) file. This change request creates the **/MSFTSEN/SENTINEL_CONNECTOR** role that has all the necessary permissions for the data connector to operate.
236+
> Alternatively, you can create a role that has minimal permissions by deploying change request *NPLK900268*, or loading the role authorizations from the [MSFTSEN_SENTINEL_AGENT_BASIC_ROLE_V0.0.1.SAP](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Sample%20Authorizations%20Role%20File) file. This change request or authorizations file creates the **/MSFTSEN/SENTINEL_AGENT_BASIC** role. This role has the minimal required permissions for the data connector to operate. Note that if you choose to deploy this role, you might need to update it frequently.
236237

237238
| Authorization Object | Field | Value |
238239
| -------------------- | ----- | ----- |
239-
| **All RFC logs** | | |
240-
| S_RFC | FUGR | /OSP/SYSTEM_TIMEZONE |
241-
| S_RFC | FUGR | ARFC |
242-
| S_RFC | FUGR | STFC |
243-
| S_RFC | FUGR | RFC1 |
244-
| S_RFC | FUGR | SDIFRUNTIME |
245-
| S_RFC | FUGR | SMOI |
246-
| S_RFC | FUGR | SYST |
247-
| S_RFC | FUGR/FUNC | SRFC/RFC_SYSTEM_INFO |
248-
| S_RFC | FUGR/FUNC | THFB/TH_SERVER_LIST |
240+
| **All logs** | | |
241+
| S_RFC | RFC_TYPE | Function Module |
242+
| S_RFC | RFC_NAME | /OSP/SYSTEM_TIMEZONE |
243+
| S_RFC | RFC_NAME | DDIF_FIELDINFO_GET |
244+
| S_RFC | RFC_NAME | RFCPING |
245+
| S_RFC | RFC_NAME | RFC_GET_FUNCTION_INTERFACE |
246+
| S_RFC | RFC_NAME | RFC_READ_TABLE |
247+
| S_RFC | RFC_NAME | RFC_SYSTEM_INFO |
248+
| S_RFC | RFC_NAME | SUSR_USER_AUTH_FOR_OBJ_GET |
249+
| S_RFC | RFC_NAME | TH_SERVER_LIST |
250+
| S_RFC | ACTVT | Execute |
249251
| S_TCODE | TCD | SM51 |
250-
| **ABAP Application Log** | | |
251-
| S_APPL_LOG | ACTVT | Display |
252+
| S_TABU_NAM | ACTVT | Display |
253+
| S_TABU_NAM | TABLE | T000 |
254+
| **Optional - Only if Sentinel solution CR implemented** | | |
255+
| S_RFC | RFC_NAME | /MSFTSEN/* |
256+
| **ABAP Application Log** | | |
257+
| S_RFC | RFC_NAME | BAPI_XBP_APPL_LOG_CONTENT_GET |
258+
| S_RFC | RFC_NAME | BAPI_XMI_LOGOFF |
259+
| S_RFC | RFC_NAME | BAPI_XMI_LOGON |
260+
| S_RFC | RFC_NAME | BAPI_XMI_SET_AUDITLEVEL |
261+
| S_TABU_NAM | TABLE | BALHDR |
262+
| S_XMI_PROD | EXTCOMPANY | Microsoft |
263+
| S_XMI_PROD | EXTPRODUCT | Azure Sentinel |
264+
| S_XMI_PROD | INTERFACE | XBP |
252265
| S_APPL_LOG | ALG_OBJECT | * |
253266
| S_APPL_LOG | ALG_SUBOBJ | * |
254-
| S_RFC | FUGR | SXBP_EXT |
255-
| S_RFC | FUGR | /MSFTSEN/_APPLOG |
267+
| S_APPL_LOG | ACTVT | Display |
256268
| **ABAP Change Documents Log** | | |
257-
| S_RFC | FUGR | /MSFTSEN/_CHANGE_DOCS |
269+
| S_TABU_NAM | TABLE | CDHDR |
270+
| S_TABU_NAM | TABLE | CDPOS |
258271
| **ABAP CR Log** | | |
259-
| S_RFC | FUGR | CTS_API |
260-
| S_RFC | FUGR | /MSFTSEN/_CR |
261-
| S_TRANSPRT | ACTVT | Display |
272+
| S_RFC | RFC_NAME | CTS_API_READ_CHANGE_REQUEST |
273+
| S_TABU_NAM | TABLE | E070 |
262274
| S_TRANSPRT | TTYPE | * |
275+
| S_TRANSPRT | ACTVT | Display |
263276
| **ABAP DB Table Data Log** | | |
264-
| S_RFC | FUGR | /MSFTSEN/_TD |
265-
| S_TABU_DIS | ACTVT | Display |
266-
| S_TABU_DIS | DICBERCLS | &NC& |
267-
| S_TABU_DIS | DICBERCLS | + Any object required for logging |
268-
| S_TABU_NAM | ACTVT | Display |
269-
| S_TABU_NAM | TABLE | + Any object required for logging |
270277
| S_TABU_NAM | TABLE | DBTABLOG |
278+
| S_TABU_NAM | TABLE | SACF_ALERT |
279+
| S_TABU_NAM | TABLE | SOUD |
280+
| S_TABU_NAM | TABLE | USR41 |
281+
| S_TABU_NAM | TABLE | TMSQAFILTER |
271282
| **ABAP Job Log** | | |
272-
| S_RFC | FUGR | SXBP |
273-
| S_RFC | FUGR | /MSFTSEN/_JOBLOG |
274-
| **ABAP Job Log, ABAP Application Log** | | |
275-
| S_XMI_PRD | INTERFACE | XBP |
276-
| **ABAP Security Audit Log - XAL** | | |
277-
| All RFC | S_RFC | FUGR |
278-
| S_ADMI_FCD | S_ADMI_FCD | AUDD |
279-
| S_RFC | FUGR | SALX |
280-
| S_USER_GRP | ACTVT | Display |
281-
| S_USER_GRP | CLASS | * |
282-
| S_XMI_PRD | INTERFACE | XAL |
283-
| **ABAP Security Audit Log - XAL, ABAP Job Log, ABAP Application Log** | | |
284-
| S_RFC | FUGR | SXMI |
285-
| S_XMI_PRD | EXTCOMPANY | Microsoft |
286-
| S_XMI_PRD | EXTPRODUCT | Microsoft Sentinel |
287-
| **ABAP Security Audit Log - SAL** | | |
288-
| S_RFC | FUGR | RSAU_LOG |
289-
| S_RFC | FUGR | /MSFTSEN/_AUDITLOG |
290-
| **ABAP Spool Log, ABAP Spool Output Log** | | |
291-
| S_RFC | FUGR | /MSFTSEN/_SPOOL |
283+
| S_RFC | RFC_NAME | BAPI_XBP_JOB_JOBLOG_READ |
284+
| S_RFC | RFC_NAME | BAPI_XMI_LOGOFF |
285+
| S_RFC | RFC_NAME | BAPI_XMI_LOGON |
286+
| S_RFC | RFC_NAME | BAPI_XMI_SET_AUDITLEVEL |
287+
| S_TABU_NAM | TABLE | TBTCO |
288+
| S_XMI_PROD | EXTCOMPANY | Microsoft |
289+
| S_XMI_PROD | EXTPRODUCT | Azure Sentinel |
290+
| S_XMI_PROD | INTERFACE | XBP |
291+
| **ABAP Spool Logs** | | |
292+
| S_TABU_NAM | TABLE | TSP01 |
293+
| S_ADMI_FCD | S_ADMI_FCD | SPOS (Use of Transaction SP01 (all systems)) |
292294
| **ABAP Workflow Log** | | |
293-
| S_RFC | FUGR | SWRR |
294-
| S_RFC | FUGR | /MSFTSEN/_WF |
295+
| S_TABU_NAM | TABLE | SWWLOGHIST |
296+
| S_TABU_NAM | TABLE | SWWWIHEAD |
297+
| **ABAP Security Audit Log** | | |
298+
| S_RFC | RFC_NAME | BAPI_USER_GET_DETAIL |
299+
| S_RFC | RFC_NAME | BAPI_XMI_LOGOFF |
300+
| S_RFC | RFC_NAME | BAPI_XMI_LOGON |
301+
| S_RFC | RFC_NAME | BAPI_XMI_SET_AUDITLEVEL |
302+
| S_RFC | RFC_NAME | BAPI_SYSTEM_MTE_GETMLHIS |
303+
| S_RFC | RFC_NAME | BAPI_SYSTEM_MTE_GETTREE |
304+
| S_RFC | RFC_NAME | BAPI_SYSTEM_MTE_GETTIDBYNAME |
305+
| S_RFC | RFC_NAME | BAPI_SYSTEM_MS_GETLIST |
306+
| S_RFC | RFC_NAME | BAPI_SYSTEM_MON_GETLIST |
307+
| S_RFC | RFC_NAME | BAPI_SYSTEM_MON_GETTREE |
308+
| S_RFC | RFC_NAME | BAPI_SYSTEM_MTE_GETPERFCURVAL |
309+
| S_RFC | RFC_NAME | BAPI_SYSTEM_MT_GETALERTDATA |
310+
| S_RFC | RFC_NAME | BAPI_SYSTEM_ALERT_ACKNOWLEDGE |
311+
| S_ADMI_FCD | S_ADMI_FCD | AUDD (Basis audit display auth.) |
312+
| S_SAL | SAL_ACTVT | SHOW_LOG (Evaluate the file-based log) |
313+
| S_USER_GRP | CLASS | SUPER |
314+
| S_USER_GRP | ACTVT | Display |
315+
| S_USER_GRP | CLASS | SUPER |
316+
| S_USER_GRP | ACTVT | Lock |
317+
| S_XMI_PROD | EXTCOMPANY | Microsoft |
318+
| S_XMI_PROD | EXTPRODUCT | Azure Sentinel |
319+
| S_XMI_PROD | INTERFACE | XAL |
295320
| **User Data** | | |
296-
| S_RFC | FUNC | RFC_READ_TABLE |
297-
| | |
321+
| S_TABU_NAM | TABLE | ADCP |
322+
| S_TABU_NAM | TABLE | ADR6 |
323+
| S_TABU_NAM | TABLE | AGR_1251 |
324+
| S_TABU_NAM | TABLE | AGR_AGRS |
325+
| S_TABU_NAM | TABLE | AGR_DEFINE |
326+
| S_TABU_NAM | TABLE | AGR_FLAGS |
327+
| S_TABU_NAM | TABLE | AGR_PROF |
328+
| S_TABU_NAM | TABLE | AGR_TCODES |
329+
| S_TABU_NAM | TABLE | AGR_USERS |
330+
| S_TABU_NAM | TABLE | DEVACCESS |
331+
| S_TABU_NAM | TABLE | USER_ADDR |
332+
| S_TABU_NAM | TABLE | USGRP_USER |
333+
| S_TABU_NAM | TABLE | USR01 |
334+
| S_TABU_NAM | TABLE | USR02 |
335+
| S_TABU_NAM | TABLE | USR05 |
336+
| S_TABU_NAM | TABLE | USR21 |
337+
| S_TABU_NAM | TABLE | USRSTAMP |
338+
| S_TABU_NAM | TABLE | UST04 |
339+
| **Configuration History** | | |
340+
| S_TABU_NAM | TABLE | PAHI |
341+
| **SNC Data** | | |
342+
| S_TABU_NAM | TABLE | SNCSYSACL |
343+
| S_TABU_NAM | TABLE | USRACL |
298344

299345

300346
## Remove the user role and the optional CR installed on your ABAP system

articles/sentinel/sap/prerequisites-for-deploying-sap-continuous-threat-monitoring.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -97,13 +97,17 @@ To enable the SAP data connector to retrieve certain information from your SAP s
9797

9898
### Create and configure a role
9999

100-
To allow the SAP data connector to connect to your SAP system, you must create a role. Create the role by deploying CR **NPLK900206**.
100+
To allow the SAP data connector to connect to your SAP system, you must create a role. Create the role by deploying CR **NPLK900271** or by loading the role authorizations from the [MSFTSEN_SENTINEL_CONNECTOR_ROLE_V0.0.27.SAP](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Sample%20Authorizations%20Role%20File) file..
101101

102-
Experienced SAP administrators may choose to create the role manually and assign it the appropriate permissions. In such a case, it is not necessary to deploy the CR *NPLK900206*, but you must instead create a role using the recommendations outlined in [Expert: Deploy SAP CRs and deploy required ABAP authorizations](preparing-sap.md#required-abap-authorizations).
102+
> [!NOTE]
103+
> Alternatively, you can create a role that has minimal permissions by deploying change request *NPLK900268*, or loading the role authorizations from the [MSFTSEN_SENTINEL_AGENT_BASIC_ROLE_V0.0.1.SAP](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Sample%20Authorizations%20Role%20File) file.
104+
> This change request or authorizations file creates the **/MSFTSEN/SENTINEL_AGENT_BASIC** role. This role has the minimal required permissions for the data connector to operate. Note that if you choose to deploy this role, you might need to update it frequently.
105+
106+
Experienced SAP administrators may choose to create the role manually and assign it the appropriate permissions. In such a case, it is not necessary to deploy the CR *NPLK900271*, but you must instead create a role using the recommendations outlined in [Expert: Deploy SAP CRs and deploy required ABAP authorizations](preparing-sap.md#required-abap-authorizations).
103107

104108
| SAP BASIS versions | Sample CR |
105109
| --- | --- |
106-
| Any version | *NPLK900206*: [K900206.NPL](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/K900206.NPL), [R900206.NPL](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/R900206.NPL) |
110+
| Any version | *NPLK900271*: [K900271.NPL](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/K900271.NPL), [R900271.NPL](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/R900271.NPL) |
107111

108112
## Next steps
109113

0 commit comments

Comments
 (0)