You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -39,7 +39,7 @@ Track your SAP solution deployment journey through this series of articles:
39
39
40
40
> [!IMPORTANT]
41
41
> - This article presents a [**step-by-step guide**](#deploy-change-requests) to deploying the required CRs. It's recommended for SOC engineers or implementers who may not necessarily be SAP experts.
42
-
> - Experienced SAP administrators that are familiar with CR deployment process may prefer to get the appropriate CRs directly from the [**SAP environment validation steps**](prerequisites-for-deploying-sap-continuous-threat-monitoring.md#sap-environment-validation-steps) section of the guide and deploy them. Note that the *NPLK900206* CR deploys a sample role, and the administrator may prefer to manually define the role according to the information in the [**Required ABAP authorizations**](#required-abap-authorizations) section below.
42
+
> - Experienced SAP administrators that are familiar with CR deployment process may prefer to get the appropriate CRs directly from the [**SAP environment validation steps**](prerequisites-for-deploying-sap-continuous-threat-monitoring.md#sap-environment-validation-steps) section of the guide and deploy them. Note that the *NPLK900271* CR deploys a sample role, and the administrator may prefer to manually define the role according to the information in the [**Required ABAP authorizations**](#required-abap-authorizations) section below.
43
43
44
44
> [!NOTE]
45
45
>
@@ -81,10 +81,10 @@ To deploy the CRs, follow the steps outlined below:
Note that each CR consists of two files, one beginning with K and one with R.
@@ -171,7 +171,7 @@ To deploy the CRs, follow the steps outlined below:
171
171
172
172
## Configure Sentinel role
173
173
174
-
After the *NPLK900206* change request is deployed, a **/MSFTSEN/SENTINEL_CONNECTOR** role is created in SAP. If the role is created manually, it may bear a different name.
174
+
After the *NPLK900271* change request is deployed, a **/MSFTSEN/SENTINEL_CONNECTOR** role is created in SAP. If the role is created manually, it may bear a different name.
175
175
176
176
In the examples shown here, we will use the role name **/MSFTSEN/SENTINEL_CONNECTOR**.
177
177
@@ -232,69 +232,115 @@ The following table lists the ABAP authorizations required to ensure that SAP lo
232
232
The required authorizations are listed here by log type. Only the authorizations listed for the types of logs you plan to ingest into Microsoft Sentinel are required.
233
233
234
234
> [!TIP]
235
-
> To create a role with all the required authorizations, deploy the SAP change request *NPLK900206* on the SAP system. This change request creates the **/MSFTSEN/SENTINEL_CONNECTOR** role that has all the necessary permissions for the data connector to operate.
235
+
> To create a role with all the required authorizations, deploy the SAP change request *NPLK900271* on the SAP system, or load the role authorizations from the [MSFTSEN_SENTINEL_CONNECTOR_ROLE_V0.0.27.SAP](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Sample%20Authorizations%20Role%20File) file. This change request creates the **/MSFTSEN/SENTINEL_CONNECTOR** role that has all the necessary permissions for the data connector to operate.
236
+
> Alternatively, you can create a role that has minimal permissions by deploying change request *NPLK900268*, or loading the role authorizations from the [MSFTSEN_SENTINEL_AGENT_BASIC_ROLE_V0.0.1.SAP](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Sample%20Authorizations%20Role%20File) file. This change request or authorizations file creates the **/MSFTSEN/SENTINEL_AGENT_BASIC** role. This role has the minimal required permissions for the data connector to operate. Note that if you choose to deploy this role, you might need to update it frequently.
236
237
237
238
| Authorization Object | Field | Value |
238
239
| -------------------- | ----- | ----- |
239
-
|**All RFC logs**|||
240
-
| S_RFC | FUGR | /OSP/SYSTEM_TIMEZONE |
241
-
| S_RFC | FUGR | ARFC |
242
-
| S_RFC | FUGR | STFC |
243
-
| S_RFC | FUGR | RFC1 |
244
-
| S_RFC | FUGR | SDIFRUNTIME |
245
-
| S_RFC | FUGR | SMOI |
246
-
| S_RFC | FUGR | SYST |
247
-
| S_RFC | FUGR/FUNC | SRFC/RFC_SYSTEM_INFO |
248
-
| S_RFC | FUGR/FUNC | THFB/TH_SERVER_LIST |
240
+
|**All logs**|||
241
+
| S_RFC | RFC_TYPE | Function Module |
242
+
| S_RFC | RFC_NAME | /OSP/SYSTEM_TIMEZONE |
243
+
| S_RFC | RFC_NAME | DDIF_FIELDINFO_GET |
244
+
| S_RFC | RFC_NAME | RFCPING |
245
+
| S_RFC | RFC_NAME | RFC_GET_FUNCTION_INTERFACE |
246
+
| S_RFC | RFC_NAME | RFC_READ_TABLE |
247
+
| S_RFC | RFC_NAME | RFC_SYSTEM_INFO |
248
+
| S_RFC | RFC_NAME | SUSR_USER_AUTH_FOR_OBJ_GET |
249
+
| S_RFC | RFC_NAME | TH_SERVER_LIST |
250
+
| S_RFC | ACTVT | Execute |
249
251
| S_TCODE | TCD | SM51 |
250
-
|**ABAP Application Log**|||
251
-
| S_APPL_LOG | ACTVT | Display |
252
+
| S_TABU_NAM | ACTVT | Display |
253
+
| S_TABU_NAM | TABLE | T000 |
254
+
|**Optional - Only if Sentinel solution CR implemented**|||
Copy file name to clipboardExpand all lines: articles/sentinel/sap/prerequisites-for-deploying-sap-continuous-threat-monitoring.md
+7-3Lines changed: 7 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -97,13 +97,17 @@ To enable the SAP data connector to retrieve certain information from your SAP s
97
97
98
98
### Create and configure a role
99
99
100
-
To allow the SAP data connector to connect to your SAP system, you must create a role. Create the role by deploying CR **NPLK900206**.
100
+
To allow the SAP data connector to connect to your SAP system, you must create a role. Create the role by deploying CR **NPLK900271** or by loading the role authorizations from the [MSFTSEN_SENTINEL_CONNECTOR_ROLE_V0.0.27.SAP](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Sample%20Authorizations%20Role%20File) file..
101
101
102
-
Experienced SAP administrators may choose to create the role manually and assign it the appropriate permissions. In such a case, it is not necessary to deploy the CR *NPLK900206*, but you must instead create a role using the recommendations outlined in [Expert: Deploy SAP CRs and deploy required ABAP authorizations](preparing-sap.md#required-abap-authorizations).
102
+
> [!NOTE]
103
+
> Alternatively, you can create a role that has minimal permissions by deploying change request *NPLK900268*, or loading the role authorizations from the [MSFTSEN_SENTINEL_AGENT_BASIC_ROLE_V0.0.1.SAP](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Sample%20Authorizations%20Role%20File) file.
104
+
> This change request or authorizations file creates the **/MSFTSEN/SENTINEL_AGENT_BASIC** role. This role has the minimal required permissions for the data connector to operate. Note that if you choose to deploy this role, you might need to update it frequently.
105
+
106
+
Experienced SAP administrators may choose to create the role manually and assign it the appropriate permissions. In such a case, it is not necessary to deploy the CR *NPLK900271*, but you must instead create a role using the recommendations outlined in [Expert: Deploy SAP CRs and deploy required ABAP authorizations](preparing-sap.md#required-abap-authorizations).
103
107
104
108
| SAP BASIS versions | Sample CR |
105
109
| --- | --- |
106
-
| Any version |*NPLK900206*: [K900206.NPL](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/K900206.NPL), [R900206.NPL](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/R900206.NPL)|
110
+
| Any version |*NPLK900271*: [K900271.NPL](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/K900271.NPL), [R900271.NPL](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/CR/R900271.NPL)|
0 commit comments