You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/sap/deployment-solution-configuration.md
+36-13Lines changed: 36 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,8 +9,14 @@ ms.date: 04/27/2022
9
9
10
10
# Configure Microsoft Sentinel Solution for SAP
11
11
12
+
[!INCLUDE [Banner for top of topics](../includes/banner.md)]
13
+
12
14
This article provides best practices for configuring the Microsoft Sentinel Solution for SAP. The full deployment process is detailed in a whole set of articles linked under [Deployment milestones](deployment-overview.md#deployment-milestones).
13
15
16
+
> [!IMPORTANT]
17
+
> Some components of the Microsoft Sentinel Solution for SAP are currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
18
+
>
19
+
14
20
Deployment of the data collector agent and solution in Microsoft Sentinel provides you with the ability to monitor SAP systems for suspicious activities and identify threats. However, for best results, best practices for operating the solution strongly recommend carrying out several additional configuration steps that are very dependent on the SAP deployment.
15
21
16
22
## Deployment milestones
@@ -43,11 +49,11 @@ Microsoft Sentinel Solution for SAP configuration is accomplished by providing c
43
49
> If you edit a watchlist and find it is empty, please wait a few minutes and retry opening the watchlist for editing.
44
50
45
51
### SAP - Systems watchlist
46
-
SAP - Systems watchlist defines which SAP Systems are present in the monitored environment. For every system, specify its SID, whether it is a production system or a dev/test environment, as well as a description.
52
+
SAP - Systems watchlist defines which SAP Systems are present in the monitored environment. For every system, specify its SID, whether it's a production system or a dev/test environment, as well as a description.
47
53
This information is used by some analytics rules, which may react differently if relevant events appear in a Development or a Production system.
48
54
49
55
### SAP - Networks watchlist
50
-
SAP - Networks watchlist outlines all networks used by the organization. It is primarily used to identify whether or not user logons are originating from within known segments of the network, also if user logon origin changes unexpectedly.
56
+
SAP - Networks watchlist outlines all networks used by the organization. It's primarily used to identify whether or not user logons are originating from within known segments of the network, also if user logon origin changes unexpectedly.
51
57
52
58
There are a number of approaches for documenting network topology. You could define a broad range of addresses, like 172.16.0.0/16, and name it "Corporate Network", which will be good enough for tracking logons from outside that range. A more segmented approach, however, allows you better visibility into potentially atypical activity.
53
59
@@ -76,19 +82,36 @@ All of these watchlists identify sensitive actions or data that can be carried o
76
82
- SAP - Sensitive Roles
77
83
- SAP - Privileged Users
78
84
79
-
Microsoft Sentinel Solution for SAP uses User Master data gathered from SAP systems to identify which users, profiles, and roles should be considered sensitive. Some sample data is included in the watchlists, though we recommend you consult with the SAP BASIS team to identify sensitive users, roles and profiles and populate the watchlists accordingly.
85
+
The Microsoft Sentinel Solution for SAP uses User Master data gathered from SAP systems to identify which users, profiles, and roles should be considered sensitive. Some sample data is included in the watchlists, though we recommend you consult with the SAP BASIS team to identify sensitive users, roles and profiles and populate the watchlists accordingly.
80
86
81
87
## Start enabling analytics rules
82
-
By default, all analytics rules provided in the Microsoft Sentinel Solution for SAP are disabled. When you install the solution, it's best if you don't enable all the rules at once so you don't end up with a lot of noise. Instead, use a staged approach, enabling rules over time, ensuring you are not receiving noise or false positives. Ensure alerts are operationalized, that is, have a response plan for each of the alerts. We consider the following rules to be easiest to implement, so best to start with them:
88
+
By default, all analytics rules provided in the Microsoft Sentinel Solution for SAP are provided as [alert rule templates](../manage-analytics-rule-templates.md#manage-template-versions-for-your-scheduled-analytics-rules-in-microsoft-sentinel). We recommend a staged approach, where a few rules are created from templates at a time, allowing time for fine tuning each scenario.
89
+
We consider the following rules to be easiest to implement, so best to start with those:
83
90
84
-
1. Deactivation of Security Audit Log
85
-
1. Client Configuration Change
86
91
1. Change in Sensitive Privileged User
87
-
1. Client configuration change
88
-
1. Sensitive privileged user logon
89
-
1. Sensitive privileged user makes a change in other
90
-
1. Sensitive privilege user password change and login
91
-
1. System configuration change
92
-
1. Brute force (RFC)
93
-
1. Function module tested
92
+
2. Client configuration change
93
+
3. Sensitive privileged user logon
94
+
4. Sensitive privileged user makes a change in other
95
+
5. Sensitive privilege user password change and login
96
+
6. Brute force (RFC)
97
+
7. Function module tested
98
+
8. The SAP audit log monitoring analytics rules
99
+
100
+
#### Configuring the SAP audit log monitoring analytics rules
101
+
The two [SAP Audit log monitor rules](sap-solution-security-content.md#built-in-sap-analytics-rules-for-monitoring-the-sap-audit-log) are delivered as ready to run out of the box, and allow for further fine tuning using watchlists:
102
+
-**SAP_Dynamic_Audit_Log_Monitor_Configuration**
103
+
The **SAP_Dynamic_Audit_Log_Monitor_Configuration** is a watchlist detailing all available SAP standard audit log message IDs and can be extended to contain additional message IDs you might create on your own using ABAP enhancements on your SAP NetWeaver systems.This watchlist allows for customizing an SAP message ID (=event type), at different levels:
104
+
- Severities per production/ non-production systems -for example, debugging activity gets “High” for production systems, and “Disabled” for other systems
105
+
- Assigning different thresholds for production/ non-production systems- which are considered as “speed limits”. Setting a threshold of 60 events an hour, will trigger an incident if more than 30 events were observed within 30 minutes
106
+
- Assigning Rule Types- either “Deterministic” or “AnomaliesOnly” determines by which manner this event is considered
107
+
- Roles and Tags to Exclude- specific users can be excluded from specific event types. This field can either accept SAP roles, SAP profiles or Tags:
108
+
- Listing SAP roles or SAP profiles ([see User Master data collection](sap-solution-deploy-alternate.md#configuring-user-master-data-collection)) would exclude any user bearing those roles/ profiles from these event types for the same SAP system. For example, specifying the “BASIC_BO_USERS” ABAP role for the RFC related event types will ensure Business Objects users won't trigger incidents when making massive RFC calls.
109
+
- Listing tags to be used as identifiers. Tagging an event type works just like specifying SAP roles or profiles, except that tags can be created within the Sentinel workspace, allowing the SOC personnel freedom in excluding users per activity without the dependency on the SAP team. For example, the audit message IDs AUB (authorization changes) and AUD (User master record changes) are assigned with the tag “MassiveAuthChanges”. Users assigned with this tag are excluded from the checks for these activities. Running the workspace function **SAPAuditLogConfigRecommend** will produce a list of recommended tags to be assigned to users, such as 'Add the tags ["GenericTablebyRFCOK"] to user SENTINEL_SRV using the SAP_User_Config watchlist'
110
+
-**SAP_User_Config**
111
+
This configuration-based watchlist is there to allow for specifying user related tags and other active directory identifiers for the SAP user. Tags are then used for identifying the user in specific contexts. For example, assigning the user GRC_ADMIN with the tag “MassiveAuthChanges” will prevent incidents from being created on user master record and authorization events made by GRC_ADMIN.
112
+
113
+
More information is available [in this blog](https://aka.ms/Sentinel4sapDynamicDeterministicAuditRuleBlog)
| Score | the anomaly scores as produced by the anomaly model|
289
290
291
+
See [Built-in SAP analytics rules for monitoring the SAP audit log](sap-solution-security-content.md#built-in-sap-analytics-rules-for-monitoring-the-sap-audit-log) for more information.
292
+
293
+
### SAPAuditLogConfigRecommend
294
+
The **SAPAuditLogConfigRecommend** is a helper function designed to offer recommendations for the configuration of the [SAP - Dynamic Anomaly based Audit Log Monitor Alerts (PREVIEW)](sap-solution-security-content.md#sap---dynamic-anomaly-based-audit-log-monitor-alerts-preview) analytics rule. See detailed explanation in the [Configuring the SAP audit log monitoring analytics rules](deployment-solution-configuration.md#configuring-the-sap-audit-log-monitoring-analytics-rules) guide.
295
+
290
296
### SAPUsersGetVIP
291
297
292
298
The Sentinel for SAP solution uses a concept of central user tagging, designed to allow for lower false positive rate with minimal effort on the customer end:
0 commit comments