Skip to content

Commit 96db85f

Browse files
ttorblettorble
authored
Merge pull request #289560 from batamig/patch-570676
moving pahi table recs and json file samples
2 parents f21dbbb + 8a6ebae commit 96db85f

File tree

3 files changed

+161
-149
lines changed

3 files changed

+161
-149
lines changed

‎articles/sentinel/sap/deploy-command-line.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: batamig
55
ms.author: bagol
66
ms.topic: how-to
77
ms.custom: devx-track-azurecli
8-
ms.date: 09/15/2024
8+
ms.date: 10/31/2024
99
ms.collection: usx-security
1010

1111
#Customer intent: As a security, infrastructure, or SAP BASIS team member, I want to deploy and configure a containerized SAP data connector agent from the command line so that I can ingest SAP data into Microsoft Sentinel for enhanced monitoring and threat detection.
@@ -264,6 +264,12 @@ This procedure describes how to prepare the deployment script to configure setti
264264
265265
For more information, see [Kickstart deployment script reference for the Microsoft Sentinel for SAP applications data connector agent](reference-kickstart.md).
266266
267+
## Optimize SAP PAHI table monitoring (recommended)
268+
269+
For optimal results in monitoring the SAP PAHI table, open the **systemconfig.json** file for editing and under the `[ABAP Table Selector](reference-systemconfig-json.md#abap-table-selector)` section, enable both the `PAHI_FULL` and the `PAHI_INCREMENTAL` parameters.
270+
271+
For more information, see [Systemconfig.json file reference](reference-systemconfig-json.md#abap-table-selector) and [Verify that the PAHI table is updated at regular intervals](preparing-sap.md#verify-that-the-pahi-table-is-updated-at-regular-intervals).
272+
267273
## Check connectivity and health
268274
269275
After you deploy the SAP data connector agent, check your agent's health and connectivity. For more information, see [Monitor the health and role of your SAP systems](../monitor-sap-system-health.md).

‎articles/sentinel/sap/preparing-sap.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -91,10 +91,12 @@ The SAP PAHI table includes data on the history of the SAP system, the database,
9191
- [SAP note 12103](https://launchpad.support.sap.com/#/notes/12103)
9292
- [Monitoring the configuration of static SAP security parameters (Preview)](sap-solution-security-content.md#monitor-the-configuration-of-static-sap-security-parameters-preview)
9393

94-
> [!TIP]
95-
> For optimal results, in the *systemconfig.json* file on your data connector agent machine, under the `[ABAP Table Selector](reference-systemconfig-json.md#abap-table-selector)` section, enable both the `PAHI_FULL` and the `PAHI_INCREMENTAL` parameters. For more information, see [Systemconfig.json file reference](reference-systemconfig-json.md#abap-table-selector).
94+
If the PAHI table is updated regularly, the `SAP_COLLECTOR_FOR_PERFMONITOR` job is scheduled and runs hourly. If the `SAP_COLLECTOR_FOR_PERFMONITOR` job doesn't exist, make sure to configure it as needed.
9695

97-
If the PAHI table is updated regularly, the `SAP_COLLECTOR_FOR_PERFMONITOR` job is scheduled and runs hourly. If the `SAP_COLLECTOR_FOR_PERFMONITOR` job doesn't exist, make sure to configure it as needed. For more information, see the SAP documentation: [Database Collector in Background Processing](https://help.sap.com/doc/saphelp_nw75/7.5.5/en-US/c4/3a735b505211d189550000e829fbbd/frameset.htm) and [Configuring the Data Collector](https://help.sap.com/docs/SAP_NETWEAVER_AS_ABAP_752/3364beced9d145a5ad185c89a1e04658/c43a818c505211d189550000e829fbbd.html)
96+
For more information, see:
97+
98+
- SAP documentation: [Database Collector in Background Processing](https://help.sap.com/doc/saphelp_nw75/7.5.5/c4/3a735b505211d189550000e829fbbd/frameset.htm) and [Configuring the Data Collector](https://help.sap.com/docs/SAP_NETWEAVER_AS_ABAP_752/3364beced9d145a5ad185c89a1e04658/c43a818c505211d189550000e829fbbd.html)
99+
- [Optimize SAP PAHI table monitoring (recommended)](deploy-command-line.md#optimize-sap-pahi-table-monitoring-recommended)
98100

99101
## Configure your system to use SNC for secure connections
100102

‎articles/sentinel/sap/sap-solution-deploy-alternate.md

Lines changed: 149 additions & 145 deletions
Original file line numberDiff line numberDiff line change
@@ -185,9 +185,9 @@ For more information, see [Systemconfig.json file reference](reference-systemcon
185185
186186
### Define the SAP logs that are sent to Microsoft Sentinel
187187
188-
The default **systemconfig** file is configured to cover built-in analytics, the SAP user authorization master data tables, with users and privilege information, and the ability to track changes and activities on the SAP landscape. The default configuration provides more logging information to allow for post-breach investigations and extended hunting abilities.
188+
The default **systemconfig.json** file is configured to cover built-in analytics, the SAP user authorization master data tables, with users and privilege information, and the ability to track changes and activities on the SAP landscape.
189189
190-
However you might want to customize your configuration over time, especially as business processes tend to be seasonal.
190+
The default configuration provides more logging information to allow for post-breach investigations and extended hunting abilities. However you might want to customize your configuration over time, especially as business processes tend to be seasonal.
191191
192192
Use the following sets of code to configure the **systemconfig.json** file to define the logs that are sent to Microsoft Sentinel.
193193
@@ -197,133 +197,127 @@ For more information, see [Microsoft Sentinel solution for SAP applications solu
197197
198198
The following code configures a default configuration:
199199
200-
```python
201-
##############################################################
202-
# Enter True OR False for each log to send those logs to Microsoft Sentinel
203-
[Logs Activation Status]
204-
ABAPAuditLog = True
205-
ABAPJobLog = True
206-
ABAPSpoolLog = True
207-
ABAPSpoolOutputLog = True
208-
ABAPChangeDocsLog = True
209-
ABAPAppLog = True
210-
ABAPWorkflowLog = True
211-
ABAPCRLog = True
212-
ABAPTableDataLog = False
213-
# ABAP SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
214-
ABAPFilesLogs = False
215-
SysLog = False
216-
ICM = False
217-
WP = False
218-
GW = False
219-
# Java SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
220-
JAVAFilesLogs = False
221-
##############################################################
200+
```json
201+
"logs_activation_status": {
202+
"abapauditlog": "True",
203+
"abapjoblog": "True",
204+
"abapspoollog": "True",
205+
"abapspooloutputlog": "True",
206+
"abapchangedocslog": "True",
207+
"abapapplog": "True",
208+
"abapworkflowlog": "True",
209+
"abapcrlog": "True",
210+
"abaptabledatalog": "False",
211+
"abapfileslogs": "False",
212+
"syslog": "False",
213+
"icm": "False",
214+
"wp": "False",
215+
"gw": "False",
216+
"javafileslogs": "False"
222217
```
223218
224219
#### Configure a detection-focused profile
225220
226221
Use the following code to configure a detection-focused profile, which includes the core security logs of the SAP landscape required for the most of the analytics rules to perform well. Post-breach investigations and hunting capabilities are limited.
227222
228-
```python
229-
##############################################################
230-
[Logs Activation Status]
231-
# ABAP RFC Logs - Retrieved by using RFC interface
232-
ABAPAuditLog = True
233-
ABAPJobLog = False
234-
ABAPSpoolLog = False
235-
ABAPSpoolOutputLog = False
236-
ABAPChangeDocsLog = True
237-
ABAPAppLog = False
238-
ABAPWorkflowLog = False
239-
ABAPCRLog = True
240-
ABAPTableDataLog = False
241-
# ABAP SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
242-
ABAPFilesLogs = False
243-
SysLog = False
244-
ICM = False
245-
WP = False
246-
GW = False
247-
# Java SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
248-
JAVAFilesLogs = False
249-
[ABAP Table Selector]
250-
AGR_TCODES_FULL = True
251-
USR01_FULL = True
252-
USR02_FULL = True
253-
USR02_INCREMENTAL = True
254-
AGR_1251_FULL = True
255-
AGR_USERS_FULL = True
256-
AGR_USERS_INCREMENTAL = True
257-
AGR_PROF_FULL = True
258-
UST04_FULL = True
259-
USR21_FULL = True
260-
ADR6_FULL = True
261-
ADCP_FULL = True
262-
USR05_FULL = True
263-
USGRP_USER_FULL = True
264-
USER_ADDR_FULL = True
265-
DEVACCESS_FULL = True
266-
AGR_DEFINE_FULL = True
267-
AGR_DEFINE_INCREMENTAL = True
268-
PAHI_FULL = False
269-
AGR_AGRS_FULL = True
270-
USRSTAMP_FULL = True
271-
USRSTAMP_INCREMENTAL = True
272-
AGR_FLAGS_FULL = True
273-
AGR_FLAGS_INCREMENTAL = True
274-
SNCSYSACL_FULL = False
275-
USRACL_FULL = False
223+
```json
224+
"logs_activation_status": {
225+
"abapauditlog": "True",
226+
"abapjoblog": "False",
227+
"abapspoollog": "False",
228+
"abapspooloutputlog": "False",
229+
"abapchangedocslog": "True",
230+
"abapapplog": "False",
231+
"abapworkflowlog": "False",
232+
"abapcrlog": "True",
233+
"abaptabledatalog": "False",
234+
"abapfileslogs": "False",
235+
"syslog": "False",
236+
"icm": "False",
237+
"wp": "False",
238+
"gw": "False",
239+
"javafileslogs": "False"
240+
},
241+
....
242+
"abap_table_selector": {
243+
"agr_tcodes_full": "True",
244+
"usr01_full": "True",
245+
"usr02_full": "True",
246+
"usr02_incremental": "True",
247+
"agr_1251_full": "True",
248+
"agr_users_full": "True",
249+
"agr_users_incremental": "True",
250+
"agr_prof_full": "True",
251+
"ust04_full": "True",
252+
"usr21_full": "True",
253+
"adr6_full": "True",
254+
"adcp_full": "True",
255+
"usr05_full": "True",
256+
"usgrp_user_full": "True",
257+
"user_addr_full": "True",
258+
"devaccess_full": "True",
259+
"agr_define_full": "True",
260+
"agr_define_incremental": "True",
261+
"pahi_full": "True",
262+
"pahi_incremental": "True",
263+
"agr_agrs_full": "True",
264+
"usrstamp_full": "True",
265+
"usrstamp_incremental": "True",
266+
"agr_flags_full": "True",
267+
"agr_flags_incremental": "True",
268+
"sncsysacl_full": "False",
269+
"usracl_full": "False",
276270
```
277271
278272
Use the following code to configure a minimal profile, which includes the SAP Security Audit Log, which is the most important source of data that the Microsoft Sentinel solution for SAP applications uses to analyze activities on the SAP landscape. Enabling this log is the minimal requirement to provide any security coverage.
279273
280-
```python
281-
[Logs Activation Status]
282-
# ABAP RFC Logs - Retrieved by using RFC interface
283-
ABAPAuditLog = True
284-
ABAPJobLog = False
285-
ABAPSpoolLog = False
286-
ABAPSpoolOutputLog = False
287-
ABAPChangeDocsLog = False
288-
ABAPAppLog = False
289-
ABAPWorkflowLog = False
290-
ABAPCRLog = False
291-
ABAPTableDataLog = False
292-
# ABAP SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
293-
ABAPFilesLogs = False
294-
SysLog = False
295-
ICM = False
296-
WP = False
297-
GW = False
298-
# Java SAP Control Logs - Retrieved by using SAP Conntrol interface and OS Login
299-
JAVAFilesLogs = False
300-
[ABAP Table Selector]
301-
AGR_TCODES_FULL = False
302-
USR01_FULL = False
303-
USR02_FULL = False
304-
USR02_INCREMENTAL = False
305-
AGR_1251_FULL = False
306-
AGR_USERS_FULL = False
307-
AGR_USERS_INCREMENTAL = False
308-
AGR_PROF_FULL = False
309-
UST04_FULL = False
310-
USR21_FULL = False
311-
ADR6_FULL = False
312-
ADCP_FULL = False
313-
USR05_FULL = False
314-
USGRP_USER_FULL = False
315-
USER_ADDR_FULL = False
316-
DEVACCESS_FULL = False
317-
AGR_DEFINE_FULL = False
318-
AGR_DEFINE_INCREMENTAL = False
319-
PAHI_FULL = False
320-
AGR_AGRS_FULL = False
321-
USRSTAMP_FULL = False
322-
USRSTAMP_INCREMENTAL = False
323-
AGR_FLAGS_FULL = False
324-
AGR_FLAGS_INCREMENTAL = False
325-
SNCSYSACL_FULL = False
326-
USRACL_FULL = False
274+
```json
275+
"logs_activation_status": {
276+
"abapauditlog": "True",
277+
"abapjoblog": "False",
278+
"abapspoollog": "False",
279+
"abapspooloutputlog": "False",
280+
"abapchangedocslog": "True",
281+
"abapapplog": "False",
282+
"abapworkflowlog": "False",
283+
"abapcrlog": "True",
284+
"abaptabledatalog": "False",
285+
"abapfileslogs": "False",
286+
"syslog": "False",
287+
"icm": "False",
288+
"wp": "False",
289+
"gw": "False",
290+
"javafileslogs": "False"
291+
},
292+
....
293+
"abap_table_selector": {
294+
"agr_tcodes_full": "False",
295+
"usr01_full": "False",
296+
"usr02_full": "False",
297+
"usr02_incremental": "False",
298+
"agr_1251_full": "False",
299+
"agr_users_full": "False",
300+
"agr_users_incremental": "False",
301+
"agr_prof_full": "False",
302+
"ust04_full": "False",
303+
"usr21_full": "False",
304+
"adr6_full": "False",
305+
"adcp_full": "False",
306+
"usr05_full": "False",
307+
"usgrp_user_full": "False",
308+
"user_addr_full": "False",
309+
"devaccess_full": "False",
310+
"agr_define_full": "False",
311+
"agr_define_incremental": "False",
312+
"pahi_full": "False",
313+
"pahi_incremental": "False",
314+
"agr_agrs_full": "False",
315+
"usrstamp_full": "False",
316+
"usrstamp_incremental": "False",
317+
"agr_flags_full": "False",
318+
"agr_flags_incremental": "False",
319+
"sncsysacl_full": "False",
320+
"usracl_full": "False",
327321
```
328322
329323
### SAL logs connector settings
@@ -332,15 +326,13 @@ Add the following code to the Microsoft Sentinel for SAP data connector **system
332326
333327
For more information, see [Perform an expert / custom SAP data connector installation](#perform-an-expert--custom-installation).
334328
335-
```python
336-
##############################################################
337-
[Connector Configuration]
338-
extractuseremail = True
339-
apiretry = True
340-
auditlogforcexal = False
341-
auditlogforcelegacyfiles = False
342-
timechunk = 60
343-
##############################################################
329+
```json
330+
"connector_configuration": {
331+
"extractuseremail": "True",
332+
"apiretry": "True",
333+
"auditlogforcexal": "False",
334+
"auditlogforcelegacyfiles": "False",
335+
"timechunk": "60"
344336
```
345337
346338
This section enables you to configure the following parameters:
@@ -381,23 +373,35 @@ To ingest tables directly from your SAP system with details about your users and
381373
382374
For example:
383375
384-
```python
385-
[ABAP Table Selector]
386-
USR01_FULL = True
387-
USR02_FULL = True
388-
USR02_INCREMENTAL = True
389-
UST04_FULL = True
390-
AGR_USERS_FULL = True
391-
AGR_USERS_INCREMENTAL = True
392-
USR21_FULL = True
393-
AGR_1251_FULL = True
394-
ADR6_FULL = True
395-
AGR_TCODES_FULL = True
396-
DEVACCESS_FULL = True
397-
AGR_DEFINE_FULL = True
398-
AGR_DEFINE_INCREMENTAL = True
399-
AGR_PROF_FULL = True
400-
PAHI_FULL = True
376+
```json
377+
"abap_table_selector": {
378+
"agr_tcodes_full": "True",
379+
"usr01_full": "True",
380+
"usr02_full": "True",
381+
"usr02_incremental": "True",
382+
"agr_1251_full": "True",
383+
"agr_users_full": "True",
384+
"agr_users_incremental": "True",
385+
"agr_prof_full": "True",
386+
"ust04_full": "True",
387+
"usr21_full": "True",
388+
"adr6_full": "True",
389+
"adcp_full": "True",
390+
"usr05_full": "True",
391+
"usgrp_user_full": "True",
392+
"user_addr_full": "True",
393+
"devaccess_full": "True",
394+
"agr_define_full": "True",
395+
"agr_define_incremental": "True",
396+
"pahi_full": "True",
397+
"pahi_incremental": "True",
398+
"agr_agrs_full": "True",
399+
"usrstamp_full": "True",
400+
"usrstamp_incremental": "True",
401+
"agr_flags_full": "True",
402+
"agr_flags_incremental": "True",
403+
"sncsysacl_full": "False",
404+
"usracl_full": "False",
401405
```
402406
403407
For more information, see [Reference of tables retrieved directly from SAP systems](sap-solution-log-reference.md#reference-of-tables-retrieved-directly-from-sap-systems).

0 commit comments

Comments
 (0)