|
| 1 | +--- |
| 2 | +title: Working with the Microsoft Sentinel solution for SAP® applications across multiple workspaces |
| 3 | +description: This article discusses working with Microsoft Sentinel solution for SAP® applications across multiple workspaces in different scenarios. |
| 4 | +author: limwainstein |
| 5 | +ms.author: lwainstein |
| 6 | +ms.topic: conceptual |
| 7 | +ms.date: 03/22/2023 |
| 8 | +--- |
| 9 | + |
| 10 | +# Working with the Microsoft Sentinel solution for SAP® applications across multiple workspaces |
| 11 | + |
| 12 | +When you set up your Microsoft Sentinel workspace, there are [multiple architecture options](../design-your-workspace-architecture.md#decision-tree) and considerations. Considering geography, regulation, access control, and other factors, you may choose to have multiple Sentinel workspaces in your organization. |
| 13 | + |
| 14 | +This article discusses working with the Microsoft Sentinel solution for SAP® applications across multiple workspaces in different scenarios. |
| 15 | + |
| 16 | +The Microsoft Sentinel solution for SAP® applications natively supports a cross-workspace architecture to allow improved flexibility for: |
| 17 | + |
| 18 | +- Managed security service providers (MSSPs) or a global or federated SOC |
| 19 | +- Data residency requirements |
| 20 | +- Organizational hierarchy/IT design |
| 21 | +- Insufficient role-based access control (RBAC) in a single workspace |
| 22 | + |
| 23 | +> [!IMPORTANT] |
| 24 | +> Working with multiple workspaces is currently in PREVIEW. This feature is provided without a service level agreement. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). |
| 25 | +
|
| 26 | +You can define multiple workspaces when you [deploy the SAP security content](deploy-sap-security-content.md#deploy-sap-security-content). |
| 27 | + |
| 28 | +## Collaboration between the SOC and SAP teams in your organization |
| 29 | + |
| 30 | +In this article, we focus on a specific and common use case, where collaboration between the security operations center (SOC) and SAP teams in your organization requires a multi-workspace setup. |
| 31 | + |
| 32 | +Your organization's SAP team has technical knowledge that's critical to successfully and effectively implement the Microsoft Sentinel solution for SAP® applications. Therefore, it's important for the SAP team see the relevant data and collaborate with the SOC on the required configuration and incident response procedures. |
| 33 | + |
| 34 | +As part of this collaboration, there are two possible scenarios, depending on your organization's needs: |
| 35 | + |
| 36 | +1. **The SAP data and the SOC data reside in separate workspaces**. Both teams can see the SAP data, using [cross-workspace queries](#scenario-1-sap-and-soc-data-reside-in-separate-workspaces). |
| 37 | +1. **The SAP data is kept in the SOC workspace**, and SAP team can query the data using [resource context queries](#scenario-2-sap-data-is-kept-in-the-soc-workspace). |
| 38 | + |
| 39 | +## Scenario 1: SAP and SOC data reside in separate workspaces |
| 40 | + |
| 41 | +In this scenario, the SAP and SOC teams have separate Microsoft Sentinel workspaces. |
| 42 | + |
| 43 | +:::image type="content" source="media/cross-workspace/sap-cross-workspace-separate.png" alt-text="Diagram of working with the Microsoft Sentinel solution for SAP® applications in separate workspaces for the SAP and SOC data." border="false"::: |
| 44 | + |
| 45 | +When your organization [deploys the Microsoft Sentinel solution for SAP® applications](deploy-sap-security-content.md#deploy-sap-security-content), each team specifies its SAP workspace. |
| 46 | + |
| 47 | +A common practice is to provide some or all of the SOC team members with the **Sentinel Reader** role on the SAP workspace. |
| 48 | + |
| 49 | +Creating separate workspaces for the SAP and SOC data has these benefits: |
| 50 | + |
| 51 | +- Microsoft Sentinel can trigger alerts that include both SOC and SAP data, and run those alerts on the SOC workspace. |
| 52 | + |
| 53 | + > [!NOTE] |
| 54 | + > For larger SAP landscapes, running queries made by the SOC on data from the SAP workspace can impact performance, because the SAP data must travel to the SOC workspace when being queried. For improved performance and cost optimizations, consider having both the SOC and SAP workspaces on the same [dedicated cluster](../../azure-monitor/logs/logs-dedicated-clusters.md?tabs=cli#cluster-pricing-model). |
| 55 | +
|
| 56 | +- The SAP team has its own Microsoft Sentinel workspace, including all features, except for detections that include both SOC and SAP data. |
| 57 | +- Flexibility: The SAP team can focus on the control and internal threats in its landscape, while the SOC can focus on external threats. |
| 58 | +- There is no additional charge for ingestion fees, because data is only ingested once into Microsoft Sentinel. However, note that each workspace has its own [pricing tier](../design-your-workspace-architecture.md#step-5-collecting-any-non-soc-data). |
| 59 | +- The SOC can see and investigate SAP incidents: If the SAP team faces an event they can't explain with the existing data, they can assign the incident to the SOC. |
| 60 | + |
| 61 | +This table maps out the access of data and features for the SAP and SOC teams in this scenario. |
| 62 | + |
| 63 | +|Function |SOC team |SAP team | |
| 64 | +|---------|---------|---------| |
| 65 | +|SOC workspace access | ✅ | ❌ | |
| 66 | +|SAP workspace data, analytics rules, functions, watchlists, and workbooks access | ✅ | ✅<sup>1</sup> | |
| 67 | +|SAP incident access and collaboration | ✅ | ✅<sup>1</sup> | |
| 68 | + |
| 69 | +<sup>1</sup>The SOC team can see these functions on both workspaces, while the SAP team can see these functions only on the SAP workspace. |
| 70 | + |
| 71 | +## Scenario 2: SAP data is kept in the SOC workspace |
| 72 | + |
| 73 | +In this scenario, you want to keep all of the data in one workspace and to apply access controls. You can do this using Log Analytics to [manage access to data by resource](../resource-context-rbac.md). You can also associate SAP resources with an Azure resource ID by specifying the required `azure_resource_id` field in the [connector configuration section](reference-systemconfig.md#connector-configuration-section) on the data collector used to ingest data from the SAP system into Microsoft Sentinel. |
| 74 | + |
| 75 | +:::image type="content" source="media/cross-workspace/sap-cross-workspace-combined.png" alt-text="Diagram of working with the Microsoft Sentinel solution for SAP® applications using the same workspace for the SAP and SOC data." border="false"::: |
| 76 | + |
| 77 | +Once the data collector agent is configured with the correct resource ID, the SAP team can access the specific SAP data in the SOC workspace using a resource-scoped query. The SAP team cannot read any of the other, non-SAP data types. |
| 78 | + |
| 79 | +There are no costs associated with this approach, as the data is only ingested once into Microsoft Sentinel. Using this mode of access, the SAP team only sees raw and unformatted data and cannot use any Microsoft Sentinel features. In addition to accessing the raw data via log analytics, the SAP team can also access the same data [via Power BI](../resource-context-rbac.md). |
| 80 | + |
| 81 | +## Next steps |
| 82 | + |
| 83 | +In this article, you learned about working with Microsoft Sentinel solution for SAP® applications across multiple workspaces in different scenarios. |
| 84 | + |
| 85 | +> [!div class="nextstepaction"] |
| 86 | +> [Deploy the Sentinel solution for SAP® applications](deployment-overview.md) |
0 commit comments