You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/sap/collect-sap-hana-audit-logs.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ ms.date: 03/02/2022
14
14
This article explains how to collect audit logs from your SAP HANA database.
15
15
16
16
> [!IMPORTANT]
17
-
> The Microsoft Sentinel Threat Monitoring for SAP solution is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
17
+
> The Microsoft Sentinel Solution for SAP is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
18
18
19
19
If you have SAP HANA database audit logs configured with Syslog, you'll also need to configure your Log Analytics agent to collect the Syslog files.
20
20
@@ -51,25 +51,25 @@ If you have SAP HANA database audit logs configured with Syslog, you'll also nee
51
51
52
52
## Next steps
53
53
54
-
Learn more about the Microsoft Sentinel Threat Monitoring for SAP solutions:
54
+
Learn more about the Microsoft Sentinel Solution for SAP:
55
55
56
-
-[Deploy Threat Monitoring for SAP](deployment-overview.md)
57
-
-[Prerequisites for deploying Threat Monitoring for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
56
+
-[Deploy Microsoft Sentinel Solution for SAP](deployment-overview.md)
57
+
-[Prerequisites for deploying Microsoft Sentinel Solution for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
58
58
-[Deploy SAP Change Requests (CRs) and configure authorization](preparing-sap.md)
59
59
-[Deploy and configure the SAP data connector agent container](deploy-data-connector-agent-container.md)
60
60
-[Deploy SAP security content](deploy-sap-security-content.md)
61
-
-[Deploy the Microsoft Sentinel Threat Monitoring for SAP data connector with SNC](configure-snc.md)
61
+
-[Deploy the Microsoft Sentinel Solution for SAP data connector with SNC](configure-snc.md)
62
62
-[Enable and configure SAP auditing](configure-audit.md)
63
63
64
64
Troubleshooting:
65
65
66
-
-[Troubleshoot your Microsoft Sentinel Threat Monitoring for SAP solution deployment](sap-deploy-troubleshoot.md)
66
+
-[Troubleshoot your Microsoft Sentinel Solution for SAP deployment](sap-deploy-troubleshoot.md)
67
67
-[Configure SAP Transport Management System](configure-transport.md)
68
68
69
69
Reference files:
70
70
71
-
-[Microsoft Sentinel Threat Monitoring for SAP solution data reference](sap-solution-log-reference.md)
72
-
-[Microsoft Sentinel Threat Monitoring for SAP solution: security content reference](sap-solution-security-content.md)
71
+
-[Microsoft Sentinel Solution for SAP data reference](sap-solution-log-reference.md)
72
+
-[Microsoft Sentinel Solution for SAP: security content reference](sap-solution-security-content.md)
Copy file name to clipboardExpand all lines: articles/sentinel/sap/configure-audit.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Enable and configure SAP auditing for Microsoft Sentinel | Microsoft Docs
3
-
description: This article shows you how to enable and configure auditing for the Microsoft Sentinel Threat Monitoring solution for SAP, so that you can have complete visibility into your SAP solution.
3
+
description: This article shows you how to enable and configure auditing for the Microsoft Sentinel Solution for SAP, so that you can have complete visibility into your SAP solution.
4
4
author: MSFTandrelom
5
5
ms.author: andrelom
6
6
ms.topic: how-to
@@ -9,14 +9,14 @@ ms.date: 04/27/2022
9
9
10
10
# Enable and configure SAP auditing for Microsoft Sentinel
11
11
12
-
This article shows you how to enable and configure auditing for the Microsoft Sentinel Threat Monitoring solution for SAP, so that you can have complete visibility into your SAP solution.
12
+
This article shows you how to enable and configure auditing for the Microsoft Sentinel Solution for SAP, so that you can have complete visibility into your SAP solution.
13
13
14
14
> [!IMPORTANT]
15
15
> We strongly recommend that any management of your SAP system is carried out by an experienced SAP system administrator.
16
16
>
17
17
> The steps in this article may vary, depending on your SAP sytem's version, and should be considered as a sample only.
18
18
19
-
Some installations of SAP systems may not have audit log enabled by default. For best results in evaluating the performance and efficacy of the Microsoft Sentinel Threat Monitoring solution for SAP, enable auditing of your SAP system and configure the audit parameters.
19
+
Some installations of SAP systems may not have audit log enabled by default. For best results in evaluating the performance and efficacy of the Microsoft Sentinel Solution for SAP, enable auditing of your SAP system and configure the audit parameters.
20
20
21
21
## Check if auditing is enabled
22
22
@@ -69,7 +69,7 @@ Some installations of SAP systems may not have audit log enabled by default. For
69
69
70
70
### Recommended audit categories
71
71
72
-
The following table lists Message IDs used by the Threat Monitoring for SAP solution. In order for analytics rules to detect events properly, we strongly recommend configuring an audit policy that includes the message IDs listed below as a minimum.
72
+
The following table lists Message IDs used by the Microsoft Sentinel Solution for SAP. In order for analytics rules to detect events properly, we strongly recommend configuring an audit policy that includes the message IDs listed below as a minimum.
73
73
74
74
| Message ID | Message text | Category name | Event Weighting | Class Used in Rules |
75
75
| - | - | - | - | - |
@@ -125,25 +125,25 @@ The following table lists Message IDs used by the Threat Monitoring for SAP solu
125
125
126
126
## Next steps
127
127
128
-
Learn more about the Microsoft Sentinel Threat Monitoring for SAP solutions:
128
+
Learn more about the Microsoft Sentinel Solution for SAP:
129
129
130
-
-[Deploy Threat Monitoring for SAP](deployment-overview.md)
131
-
-[Prerequisites for deploying Threat Monitoring for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
130
+
-[Deploy Microsoft Sentinel Solution for SAP](deployment-overview.md)
131
+
-[Prerequisites for deploying Microsoft Sentinel Solution for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
132
132
-[Deploy SAP Change Requests (CRs) and configure authorization](preparing-sap.md)
133
133
-[Deploy and configure the SAP data connector agent container](deploy-data-connector-agent-container.md)
134
134
-[Deploy SAP security content](deploy-sap-security-content.md)
135
-
-[Deploy the Microsoft Sentinel Threat Monitoring for SAP data connector with SNC](configure-snc.md)
135
+
-[Deploy the Microsoft Sentinel Solution for SAP data connector with SNC](configure-snc.md)
136
136
-[Collect SAP HANA audit logs](collect-sap-hana-audit-logs.md)
137
137
138
138
Troubleshooting:
139
139
140
-
-[Troubleshoot your Microsoft Sentinel Threat Monitoring for SAP solution deployment](sap-deploy-troubleshoot.md)
140
+
-[Troubleshoot your Microsoft Sentinel Solution for SAP deployment](sap-deploy-troubleshoot.md)
141
141
-[Configure SAP Transport Management System](configure-transport.md)
142
142
143
143
Reference files:
144
144
145
-
-[Microsoft Sentinel Threat Monitoring for SAP solution data reference](sap-solution-log-reference.md)
146
-
-[Microsoft Sentinel Threat Monitoring for SAP solution: security content reference](sap-solution-security-content.md)
145
+
-[Microsoft Sentinel Solution for SAP data reference](sap-solution-log-reference.md)
146
+
-[Microsoft Sentinel Solution for SAP: security content reference](sap-solution-security-content.md)
Copy file name to clipboardExpand all lines: articles/sentinel/sap/configure-snc.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Deploy the Microsoft Sentinel Threat Monitoring for SAP data connector with Secure Network Communications (SNC) | Microsoft Docs
2
+
title: Deploy the Microsoft Sentinel Solution for SAP data connector with Secure Network Communications (SNC) | Microsoft Docs
3
3
description: This article shows you how to deploy the **Microsoft Sentinel data connector for SAP** to ingest NetWeaver/ABAP logs over a secure connection using Secure Network Communications.
# Deploy the Microsoft Sentinel Threat Monitoring for SAP data connector with SNC
11
+
# Deploy the Microsoft Sentinel Solution for SAP data connector with SNC
12
12
13
13
[!INCLUDE [Banner for top of topics](../includes/banner.md)]
14
14
15
15
This article shows you how to deploy the **Microsoft Sentinel data connector for SAP** to ingest NetWeaver/ABAP logs over a secure connection using Secure Network Communications (SNC).
16
16
17
17
> [!IMPORTANT]
18
-
> The Microsoft Sentinel Threat Monitoring for SAP solution is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
18
+
> The Microsoft Sentinel Solution for SAP is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
19
19
20
-
The Threat Monitoring for SAP data connector agent typically connects to an SAP ABAP server using an RFC connection, and a user's username and password for authentication.
20
+
The Microsoft Sentinel Solution for SAP data connector agent typically connects to an SAP ABAP server using an RFC connection, and a user's username and password for authentication.
21
21
22
22
However, some environments may require the connection be over an encrypted channel, and client certificates be used for authentication. In these cases you can use SAP Secure Network Communication for this purpose, and you'll have to take the appropriate steps as outlined in this article.
23
23
@@ -182,26 +182,26 @@ For additional information on options available in the kickstart script, review
182
182
183
183
## Next steps
184
184
185
-
Learn more about the Microsoft Sentinel Threat Monitoring for SAP solutions:
185
+
Learn more about the Microsoft Sentinel Solution for SAP:
186
186
187
-
- [Deploy Threat Monitoring for SAP](deployment-overview.md)
188
-
- [Prerequisites for deploying Threat Monitoring for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
187
+
- [Deploy Microsoft Sentinel Solution for SAP](deployment-overview.md)
188
+
- [Prerequisites for deploying Microsoft Sentinel Solution for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
189
189
- [Deploy SAP Change Requests (CRs) and configure authorization](preparing-sap.md)
190
190
- [Deploy and configure the SAP data connector agent container](deploy-data-connector-agent-container.md)
191
191
- [Deploy SAP security content](deploy-sap-security-content.md)
192
-
- [Deploy the Microsoft Sentinel Threat Monitoring for SAP data connector with SNC](configure-snc.md)
192
+
- [Deploy the Microsoft Sentinel Solution for SAP](configure-snc.md)
193
193
- [Enable and configure SAP auditing](configure-audit.md)
194
194
- [Collect SAP HANA audit logs](collect-sap-hana-audit-logs.md)
195
195
196
196
Troubleshooting:
197
197
198
-
- [Troubleshoot your Microsoft Sentinel Threat Monitoring for SAP solution deployment](sap-deploy-troubleshoot.md)
198
+
- [Troubleshoot your Microsoft Sentinel Solution for SAP deployment](sap-deploy-troubleshoot.md)
199
199
- [Configure SAP Transport Management System](configure-transport.md)
200
200
201
201
Reference files:
202
202
203
-
- [Microsoft Sentinel Threat Monitoring for SAP solution data reference](sap-solution-log-reference.md)
204
-
- [Microsoft Sentinel Threat Monitoring for SAP solution: security content reference](sap-solution-security-content.md)
203
+
- [Microsoft Sentinel Solution for SAP data reference](sap-solution-log-reference.md)
204
+
- [Microsoft Sentinel Solution for SAP: security content reference](sap-solution-security-content.md)
Copy file name to clipboardExpand all lines: articles/sentinel/sap/configure-transport.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,14 @@
1
1
---
2
2
title: Configure SAP Transport Management System to connect from Microsoft Sentinel | Microsoft Docs
3
-
description: This article shows you how to configure the SAP Transport Management System in the event of an error or in a lab environment where it hasn't already been configured, in order to successfully deploy the Threat Monitoring solution for SAP in Microsoft Sentinel.
3
+
description: This article shows you how to configure the SAP Transport Management System in the event of an error or in a lab environment where it hasn't already been configured, in order to successfully deploy the Microsoft Sentinel Solution for SAP.
4
4
author: MSFTandrelom
5
5
ms.author: andrelom
6
6
ms.topic: how-to
7
7
ms.date: 04/07/2022
8
8
---
9
9
# Configure SAP Transport Management System to connect from Microsoft Sentinel
10
10
11
-
This article shows you how to configure the SAP Transport Management System in order to successfully deploy the Threat Monitoring solution for SAP in Microsoft Sentinel.
11
+
This article shows you how to configure the SAP Transport Management System in order to successfully deploy the Microsoft Sentinel Solution for SAP.
12
12
13
13
SAP's Transport Management System is normally already configured on production systems. However, in a lab environment, where CRs often haven't been previously installed, configuration may be required.
14
14
@@ -67,30 +67,30 @@ The following steps show the process for configuring the Transport Management Sy
67
67
68
68
## Next steps
69
69
70
-
Now that you've configured the Transport Management System, you'll be able to successfully complete the `STMS_IMPORT` transaction and you can continue [preparing your SAP environment](preparing-sap.md) for deploying the Threat Monitoring solution for SAP in Microsoft Sentinel.
70
+
Now that you've configured the Transport Management System, you'll be able to successfully complete the `STMS_IMPORT` transaction and you can continue [preparing your SAP environment](preparing-sap.md) for deploying the Microsoft Sentinel Solution for SAP in Microsoft Sentinel.
71
71
72
72
> [!div class="nextstepaction"]
73
73
> [Deploy SAP Change Requests and configure authorization](preparing-sap.md#import-the-crs)
74
74
75
-
Learn more about the Microsoft Sentinel Threat Monitoring for SAP solutions:
75
+
Learn more about the Microsoft Sentinel Solution for SAP:
76
76
77
-
-[Deploy Threat Monitoring for SAP](deployment-overview.md)
78
-
-[Prerequisites for deploying Threat Monitoring for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
77
+
-[Deploy Microsoft Sentinel Solution for SAP](deployment-overview.md)
78
+
-[Prerequisites for deploying Microsoft Sentinel Solution for SAP](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)
79
79
-[Deploy SAP Change Requests (CRs) and configure authorization](preparing-sap.md)
80
80
-[Deploy and configure the SAP data connector agent container](deploy-data-connector-agent-container.md)
81
81
-[Deploy SAP security content](deploy-sap-security-content.md)
82
-
-[Deploy the Microsoft Sentinel Threat Monitoring for SAP data connector with SNC](configure-snc.md)
82
+
-[Deploy the Microsoft Sentinel Solution for SAP data connector with SNC](configure-snc.md)
83
83
-[Enable and configure SAP auditing](configure-audit.md)
84
84
-[Collect SAP HANA audit logs](collect-sap-hana-audit-logs.md)
85
85
86
86
Troubleshooting:
87
87
88
-
-[Troubleshoot your Microsoft Sentinel Threat Monitoring for SAP solution deployment](sap-deploy-troubleshoot.md)
88
+
-[Troubleshoot your Microsoft Sentinel Solution for SAP deployment](sap-deploy-troubleshoot.md)
89
89
90
90
Reference files:
91
91
92
-
-[Microsoft Sentinel Threat Monitoring for SAP solution data reference](sap-solution-log-reference.md)
93
-
-[Microsoft Sentinel Threat Monitoring for SAP solution: security content reference](sap-solution-security-content.md)
92
+
-[Microsoft Sentinel Solution for SAP data reference](sap-solution-log-reference.md)
93
+
-[Microsoft Sentinel Solution for SAP: security content reference](sap-solution-security-content.md)
Copy file name to clipboardExpand all lines: articles/sentinel/sap/deploy-data-connector-agent-container.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,19 +1,19 @@
1
1
---
2
-
title: Deploy and configure the Microsoft Sentinel Threat Monitoring for SAP data connector agent container | Microsoft Docs
3
-
description: This article shows you how to deploy the SAP data connector agent container in order to ingest SAP data into Microsoft Sentinel, as part of Microsoft Sentinel's Threat Monitoring solution for SAP.
2
+
title: Deploy and configure the Microsoft Sentinel Solution for SAP data connector agent container | Microsoft Docs
3
+
description: This article shows you how to deploy the SAP data connector agent container in order to ingest SAP data into Microsoft Sentinel, as part of the Microsoft Sentinel Solution for SAP.
4
4
author: MSFTandrelom
5
5
ms.author: andrelom
6
6
ms.topic: how-to
7
7
ms.date: 04/12/2022
8
8
---
9
9
10
-
# Deploy and configure the Microsoft Sentinel Threat Monitoring for SAP data connector agent container
10
+
# Deploy and configure the Microsoft Sentinel Solution for SAP data connector agent container
11
11
12
-
This article shows you how to deploy the SAP data connector agent container in order to ingest SAP data into Microsoft Sentinel, as part of Microsoft Sentinel's Threat Monitoring solution for SAP.
12
+
This article shows you how to deploy the SAP data connector agent container in order to ingest SAP data into Microsoft Sentinel, as part of the Microsoft Sentinel Solution for SAP.
13
13
14
14
## Deployment milestones
15
15
16
-
Deployment of the Threat Monitoring for SAP solution is divided into the following sections
16
+
Deployment of the Microsoft Sentinel Solution for SAP is divided into the following sections
17
17
18
18
1.[Deployment overview](deployment-overview.md)
19
19
@@ -25,7 +25,7 @@ Deployment of the Threat Monitoring for SAP solution is divided into the followi
25
25
26
26
1.[Deploy SAP security content](deploy-sap-security-content.md)
27
27
28
-
1.[Configure Threat Monitoring for SAP solution](deployment-solution-configuration.md)
28
+
1.[Configure Microsoft Sentinel Solution for SAP](deployment-solution-configuration.md)
29
29
30
30
1. Optional deployment steps
31
31
-[Configure auditing](configure-audit.md)
@@ -34,7 +34,7 @@ Deployment of the Threat Monitoring for SAP solution is divided into the followi
34
34
35
35
## Data connector agent deployment overview
36
36
37
-
For the Threat Monitoring solution for SAP to operate correctly, you must first get your SAP data into Microsoft Sentinel. To accomplish this, you need to deploy the solution's SAP data connector agent.
37
+
For the Microsoft Sentinel Solution for SAP to operate correctly, you must first get your SAP data into Microsoft Sentinel. To accomplish this, you need to deploy the solution's SAP data connector agent.
38
38
39
39
The data connector agent runs as a container on a Linux virtual machine (VM). This VM can be hosted either in Azure, in a third-party cloud, or on-premises. We recommend that you install and configure this container using a *kickstart* script; however, you can choose to [deploy the container manually](?tabs=deploy-manually#deploy-the-data-connector-agent-container).
40
40
@@ -303,6 +303,6 @@ If you're not using SNC, then your SAP configuration and authentication secrets
303
303
304
304
## Next steps
305
305
306
-
Once connector is deployed, proceed to deploy Threat Monitoring for SAP solution content
306
+
Once the connector is deployed, proceed to deploy Microsoft Sentinel Solution for SAP content:
307
307
> [!div class="nextstepaction"]
308
308
> [Deploy SAP security content](deploy-sap-security-content.md)
0 commit comments