You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Microsoft Sentinel solution for SAP® applications - deploy and configure the SAP data connector agent container
3
-
description: This article shows you how to manually deploy the container that hosts the SAP data connector agent. You do this to ingest SAP data into Microsoft Sentinel, as part of the Microsoft Sentinel Solution for SAP.
4
-
author: limwainstein
5
-
ms.author: lwainstein
2
+
title: Microsoft Sentinel solution for SAP® applications - manually deploy and configure the SAP data connector agent container using the command line
3
+
description: This article shows you how to manually deploy the container that hosts the SAP data connector agent, using the Azure command line interface, in order to ingest SAP data into Microsoft Sentinel, as part of the Microsoft Sentinel Solution for SAP.
4
+
author: yelevin
5
+
ms.author: yelevin
6
6
ms.topic: how-to
7
7
ms.custom: devx-track-azurecli
8
-
ms.date: 01/18/2023
8
+
ms.date: 01/03/2024
9
9
---
10
10
11
-
# Deploy and configure the container hosting the SAP data connector agent via the command line
11
+
# Manually deploy and configure the container hosting the SAP data connector agent
12
12
13
-
This article shows you how to use various methods to deploy the container that hosts the SAP data connector agent, and create new SAP systems under the agent. You do this to ingest SAP data into Microsoft Sentinel, as part of the Microsoft Sentinel Solution for SAP.
13
+
This article shows you how to use the Azure command line interface to deploy the container that hosts the SAP data connector agent, and create new SAP systems under the agent. You use this connector agent to ingest SAP data into Microsoft Sentinel, as part of the Microsoft Sentinel Solution for SAP.
14
14
15
-
This article shows you how to deploy the container and create SAP systems via managed identity, a registered application, a configuration file, or directly on the VM. Alternatively, you can [deploy the data connector agent via the UI](deploy-data-connector-agent-container.md) (Preview).
15
+
Other ways to deploy the container and create SAP systems using the Azure portal or a *kickstart* script are described in [Deploy and configure the container hosting the SAP data connector agent](deploy-data-connector-agent-container.md). These other methods make use of an Azure Key Vault to store SAP credentials, and are highly preferred over the method described here. You should use the manual deployment method only if none of the other options are available to you.
16
16
17
17
## Deployment milestones
18
18
@@ -38,225 +38,29 @@ Deployment of the Microsoft Sentinel Solution for SAP is divided into the follow
38
38
39
39
Read about the [deployment process](deploy-data-connector-agent-container.md#data-connector-agent-deployment-overview).
40
40
41
-
## Deploy the data connector agent container
41
+
## Prerequisites
42
42
43
-
# [Managed identity](#tab/managed-identity)
43
+
Read about the [prerequisites for deploying the agent container](deploy-data-connector-agent-container.md#prerequisites).
44
44
45
-
1. Run the following command to **Create a VM** in Azure (substitute actual names for the `<placeholders>`):
46
-
47
-
```azurecli
48
-
az vm create --resource-group <resource group name> --name <VM Name> --image Canonical:0001-com-ubuntu-server-focal:20_04-lts-gen2:latest --admin-username <azureuser> --public-ip-address "" --size Standard_D2as_v5 --generate-ssh-keys --assign-identity --role <role name> --scope <subscription Id>
49
-
50
-
```
51
-
52
-
For more information, see [Quickstart: Create a Linux virtual machine with the Azure CLI](../../virtual-machines/linux/quick-create-cli.md).
53
-
54
-
> [!IMPORTANT]
55
-
> After the VM is created, be sure to apply any security requirements and hardening procedures applicable in your organization.
56
-
>
57
-
58
-
The command above will create the VM resource, producing output that looks like this:
1. Copy the **systemAssignedIdentity** GUID, as it will be used in the coming steps.
79
-
80
-
1. Run the following commands to **create a key vault** (substitute actual names for the `<placeholders>`). If you'll be using an existing key vault, ignore this step:
81
-
82
-
```azurecli
83
-
az keyvault create \
84
-
--name <KeyVaultName> \
85
-
--resource-group <KeyVaultResourceGroupName>
86
-
```
87
-
88
-
1. Copy the name of the (newly created or existing) key vault and the name of its resource group. You'll need these when you run the deployment script in the coming steps.
89
-
90
-
1. Run the following command to **assign a key vault access policy** to the VM's system-assigned identity that you copied above (substitute actual names for the `<placeholders>`):
91
-
92
-
```azurecli
93
-
az keyvault set-policy -n <KeyVaultName> -g <KeyVaultResourceGroupName> --object-id <VM system-assigned identity> --secret-permissions get list set
94
-
```
95
-
96
-
This policy will allow the VM to list, read, and write secrets from/to the key vault.
97
-
98
-
1. **Sign in to the newly created machine** with a user with sudo privileges.
99
-
100
-
1. **Transfer the [SAP NetWeaver SDK](https://aka.ms/sap-sdk-download)** to the machine on which you want to install the agent.
101
-
102
-
1. **Download and run the deployment Kickstart script**:
The script updates the OS components, installs the Azure CLI and Docker software and other required utilities (jq, netcat, curl), and prompts you for configuration parameter values. You can supply additional parameters to the script to minimize the number of prompts or to customize the container deployment. For more information on available command line options, see [Kickstart script reference](reference-kickstart.md).
116
-
117
-
2. **Follow the on-screen instructions** to enter your SAP and key vault details and complete the deployment. When the deployment is complete, a confirmation message is displayed:
118
-
119
-
```bash
120
-
The process has been successfully completed, thank you!
121
-
```
122
-
123
-
Note the Docker container name in the script output. You'll use it in the next step.
124
-
125
-
3. Run the following command to **configure the Docker container to start automatically**.
1. Transfer the [SAP NetWeaver SDK](https://aka.ms/sap-sdk-download) to the machine on which you want to install the agent.
136
-
137
-
1. Run the following command to **create and register an application**:
138
-
139
-
```azurecli
140
-
az ad sp create-for-rbac
141
-
```
142
-
143
-
The command above will create the application, producing output that looks like this:
144
-
145
-
```json
146
-
{
147
-
"appId": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
148
-
"displayName": "azure-cli-2022-01-28-17-59-06",
149
-
"password": "ssssssssssssssssssssssssssssssssss",
150
-
"tenant": "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
151
-
}
152
-
```
153
-
154
-
1. Copy the **appId**, **tenant**, and **password** from the output. You'll need these for assigning the key vault access policy and running the deployment script in the coming steps.
155
-
156
-
1. Run the following commands to **create a key vault** (substitute actual names for the `<placeholders>`). If you'll be using an existing key vault, ignore this step :
157
-
158
-
```azurecli
159
-
az keyvault create \
160
-
--name <KeyVaultName> \
161
-
--resource-group <KeyVaultResourceGroupName>
162
-
```
163
-
164
-
1. Copy the name of the (newly created or existing) key vault and the name of its resource group. You'll need these for assigning the key vault access policy and running the deployment script in the coming steps.
165
-
166
-
1. Run the following command to **assign a key vault access policy** to the registered application ID that you copied above (substitute actual names or values for the `<placeholders>`):
167
-
168
-
```azurecli
169
-
az keyvault set-policy -n <KeyVaultName> -g <KeyVaultResourceGroupName> --spn <appId> --secret-permissions get list set
170
-
```
171
-
172
-
For example:
173
-
174
-
```azurecli
175
-
az keyvault set-policy -n sentinelkeyvault -g sentinelresourcegroup --application-id aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa --secret-permissions get list set
176
-
```
177
-
178
-
This policy will allow the VM to list, read, and write secrets from/to the key vault.
179
-
180
-
1. Run the following commands to **download the deployment Kickstart script** from the Microsoft Sentinel GitHub repository and **mark it executable**:
The script updates the OS components, installs the Azure CLI and Docker software and other required utilities (jq, netcat, curl), and prompts you for configuration parameter values. You can supply additional parameters to the script to minimize the amount of prompts or to customize the container deployment. For more information on available command line options, see [Kickstart script reference](reference-kickstart.md).
194
-
195
-
1. **Follow the on-screen instructions** to enter the requested details and complete the deployment. When the deployment is complete, a confirmation message is displayed:
196
-
197
-
```bash
198
-
The process has been successfully completed, thank you!
199
-
```
200
-
201
-
Note the Docker container name in the script output. You'll use it in the next step.
202
-
203
-
1. Run the following command to **configure the Docker container to start automatically**.
To view a list of the available containers use the command: `docker ps -a`.
210
-
211
-
# [Configuration file](#tab/config-file)
212
-
213
-
1. Transfer the [SAP NetWeaver SDK](https://aka.ms/sap-sdk-download) to the machine on which you want to install the agent.
214
-
215
-
1. Run the following commands to **download the deployment Kickstart script** from the Microsoft Sentinel GitHub repository and **mark it executable**:
The script updates the OS components, installs the Azure CLI and Docker software and other required utilities (jq, netcat, curl), and prompts you for configuration parameter values. You can supply additional parameters to the script to minimize the amount of prompts or to customize the container deployment. For more information on available command line options, see [Kickstart script reference](reference-kickstart.md).
229
-
230
-
1. **Follow the on-screen instructions** to enter the requested details and complete the deployment. When the deployment is complete, a confirmation message is displayed:
231
-
232
-
```bash
233
-
The process has been successfully completed, thank you!
234
-
```
235
-
236
-
Note the Docker container name in the script output. You'll use it in the next step.
237
-
238
-
1. Run the following command to **configure the Docker container to start automatically**.
To view a list of the available containers use the command: `docker ps -a`.
245
-
246
-
# [Manual deployment](#tab/deploy-manually)
45
+
## Deploy the data connector agent container manually
247
46
248
47
1. Transfer the [SAP NetWeaver SDK](https://aka.ms/sap-sdk-download) to the machine on which you want to install the agent.
249
48
250
49
1. Install [Docker](https://www.docker.com/) on the VM, following the [recommended deployment steps](https://docs.docker.com/engine/install/) for the chosen operating system.
251
50
252
-
1. Use the following commands (replacing `<SID>` with the name of the SAP instance) to create a folder to store the container configuration and metadata, and to download a sample systemconfig.ini file into that folder.
51
+
1. Use the following commands (replacing `<SID>` with the name of the SAP instance) to create a folder to store the container configuration and metadata, and to download a sample systemconfig.json file (for older versions use the systemconfig.ini file) into that folder.
For agent versions released before June 22, 2023, use systemconfig.ini instead of systemconfig.json. Substitute the following line for the last line in the previous code block.
0 commit comments