You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/sap/cross-workspace.md
+30-23Lines changed: 30 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,64 +13,71 @@ When you set up your Microsoft Sentinel workspace, there are [multiple architect
13
13
14
14
This article discusses working with Microsoft Sentinel solution for SAP® applications across multiple workspaces in different scenarios.
15
15
16
-
The Microsoft Sentinel solution for SAP® applications natively supports a cross-workspace ar architecture to allow improved flexibility for:
16
+
The Microsoft Sentinel solution for SAP® applications natively supports a cross-workspace architecture to allow improved flexibility for:
17
17
18
18
- Managed security service providers (MSSPs) or a global or federated SOC
19
19
- Data residency requirements
20
20
- Organizational hierarchy/IT design
21
-
- Insufficient role-based access control (RBAC) in a single workspace.
21
+
- Insufficient role-based access control (RBAC) in a single workspace
22
22
23
-
In this article, we focus on a specific and common use case, where collaboration between the security operations center (SOC) and SAP teams in your organization requires a multi-workspace setup.
23
+
> [!IMPORTANT]
24
+
> The cross-workspace architecture and querying is currently in PREVIEW. This feature is provided without a service level agreement. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
25
+
26
+
You can define multiple workspaces when you [deploy the SAP security content](deploy-sap-security-content.md#multi-workspace).
24
27
25
-
## Collaboration between the SAP and SOC teams and multi-workspace architecture
28
+
## Collaboration between the SOC and SAP teams in your organization
26
29
27
-
Your organization's SAP team has technical knowledge that's critical to a successfully and effectively implement the Microsoft Sentinel solution for SAP® applications. Therefore, it's important for the SAP team see the relevant data and collaborate with the SOC on the required configuration and incident response procedures.
30
+
In this article, we focus on a specific and common use case, where collaboration between the security operations center (SOC) and SAP teams in your organization requires a multi-workspace setup.
31
+
32
+
Your organization's SAP team has technical knowledge that's critical to successfully and effectively implement the Microsoft Sentinel solution for SAP® applications. Therefore, it's important for the SAP team see the relevant data and collaborate with the SOC on the required configuration and incident response procedures.
28
33
29
34
As part of this collaboration, there are two possible scenarios, depending on your organization's needs:
30
35
31
-
1.**The SAP data and the SOC data reside in separate workspaces**. Both teams can see the SAP data, [using cross-workspace queries](#scenario-1-sap-and-soc-data-reside-in-separate-workspaces)
32
-
1.**The SAP data is kept in the SOC workspace**, and SAP team can query the data using [resource context queries]
36
+
1.**The SAP data and the SOC data reside in separate workspaces**. Both teams can see the SAP data, using [cross-workspace queries](#scenario-1-sap-and-soc-data-reside-in-separate-workspaces)
37
+
1.**The SAP data is kept in the SOC workspace**, and SAP team can query the data using [resource context queries](#scenario-2-sap-data-is-kept-in-the-soc-workspace).
33
38
34
-
###Scenario 1: SAP and SOC data reside in separate workspaces
39
+
## Scenario 1: SAP and SOC data reside in separate workspaces
35
40
36
41
In this scenario, the SAP and SOC teams have separate Microsoft Sentinel workspaces. When your organization deploys the Microsoft Sentinel solution for SAP® applications, each team specifies its SAP workspace under **Instance details** > **Configure the workspace where the SAP data resides**.
37
42
43
+
You define multiple workspaces when you [deploy the SAP security content](deploy-sap-security-content.md#multi-workspace).
44
+
38
45
:::image type="content" source="media/cross-workspace/sap-cross-workspace-separate.png" alt-text="Diagram of working with the Microsoft Sentinel solution for SAP® applications in separate workspaces for the SAP and SOC data." border="false":::
39
46
40
-
A common practice is to provide some or all of the SOC team members with read permissions to the SAP workspace.
47
+
A common practice is to provide some or all of the SOC team members with the **Sentinel Reader** role on the SAP workspace.
41
48
42
49
Creating separate workspaces for the SAP and SOC data has these benefits:
43
50
44
51
- Microsoft Sentinel can create alerts that include both SOC and SAP data, and to run those alerts on the SOC workspace.
45
-
- The SAP has its own Microsoft Sentinel workspace, including all features, except for detections that include both SOC and SAP data.
52
+
53
+
> [!NOTE]
54
+
> For larger SAP landscapes, running queries made by the SOC on data from the SAP workspace can impact performance, because the SAP data must travel to the SOC workspace when being queried. For improved performance and cost optimizations, consider having both the SOC and SAP workspaces on the same [dedicated cluster](../../azure-monitor/logs/logs-dedicated-clusters.md?tabs=cli#cluster-pricing-model).
55
+
56
+
- The SAP team has its own Microsoft Sentinel workspace, including all features, except for detections that include both SOC and SAP data.
46
57
- Flexibility: The SAP team can focus on the control and internal threats in its landscape, while the SOC can focus on external threats.
47
58
- There is no additional charge for ingestion fees, because data is only ingested once into Microsoft Sentinel. However, note that each workspace has its own [pricing tier](../design-your-workspace-architecture.md#step-5-collecting-any-non-soc-data).
48
-
- The SOC can see and investigate SAP incidents: If the SAP team faces an event they can't explain with the existing data, they can assign the incident to the SOC.
49
-
50
-
For larger SAP landscapes, working in this scenario can impact the performance of queries made by the SOC on data from the SAP workspace. This is because the SAP data must travel to the SOC workspace when being queried. For improved performance and cost optimizations, consider having both SOC and SAP workspaces to be on the same [dedicated cluster](./../azure-monitor/logs/logs-dedicated-clusters?tabs=cli#cluster-pricing-model).
59
+
- The SOC can see and investigate SAP incidents: If the SAP team faces an event they can't explain with the existing data, they can assign the incident to the SOC.
51
60
52
-
This table shows the best practice for managing the SAP and SOC data and permissions in this scenario.
61
+
This table maps out the access of data and features for the SAP and SOC teams in this scenario.
|SAP incident access and collaboration |✅|✅|
59
68
60
-
TBD - how this is done - separate page? + screenshot
61
-
62
-
### Scenario 2: SAP data is kept in the SOC workspace
69
+
## Scenario 2: SAP data is kept in the SOC workspace
63
70
64
71
In this scenario, you want to keep all of the data in one workspace. You can do this using Log Analytics to [manage access to data by resource](../resource-context-rbac.md). You can also associate SAP resources with an Azure resource ID by specifying the required `azure_resource_id` field in the connector configuration section on the data collector used to ingest data from the SAP system into Microsoft Sentinel.
65
72
73
+
You can define multiple workspaces when you [deploy the SAP security content](deploy-sap-security-content.md#multi-workspace).
74
+
66
75
:::image type="content" source="media/cross-workspace/sap-cross-workspace-combined.png" alt-text="Diagram of working with the Microsoft Sentinel solution for SAP® applications using the same workspace for the SAP and SOC data." border="false":::
67
76
68
77
Once the data collector agent is configured with the correct resource ID, the SAP team can access the specific SAP data in the SOC workspace using a resource-scoped query. The SAP team cannot read any of the other, non-SAP data types.
69
78
70
79
There are no costs associated with this approach, as the data is only ingested once into Microsoft Sentinel. Using this mode of access, the SAP team only sees raw and unformatted data and cannot use any Microsoft Sentinel features. In addition to accessing the raw data via log analytics, the SAP team can also access the same data [via Power BI](../resource-context-rbac.md).
71
80
72
-
TBD - how this is done - separate page? + screenshot
73
-
74
81
## Next steps
75
82
76
83
In this article, you learned about working with Microsoft Sentinel solution for SAP® applications across multiple workspaces in different scenarios.
Copy file name to clipboardExpand all lines: articles/sentinel/sap/deploy-sap-security-content.md
+32-6Lines changed: 32 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,18 @@
1
1
---
2
2
title: Deploy SAP security content in Microsoft Sentinel
3
3
description: This article shows you how to deploy Microsoft Sentinel security content into your Microsoft Sentinel workspace. This content makes up the remaining parts of the Microsoft Sentinel solution for SAP® applications.
4
-
author: MSFTandrelom
5
-
ms.author: andrelom
4
+
author: limwainstein
5
+
ms.author: lwainstein
6
6
ms.topic: how-to
7
-
ms.date: 04/27/2022
7
+
ms.date: 03/23/2023
8
8
---
9
9
10
10
# Deploy SAP security content in Microsoft Sentinel
11
11
12
12
This article shows you how to deploy Microsoft Sentinel security content into your Microsoft Sentinel workspace. This content makes up the remaining parts of the Microsoft Sentinel solution for SAP® applications.
13
13
14
+
Learn about [working with the solution across multiple workspaces](cross-workspace.md) (PREVIEW), or [define multiple workspaces](#multi-workspace).
15
+
14
16
## Deployment milestones
15
17
16
18
Track your SAP solution deployment journey through this series of articles:
@@ -19,6 +21,8 @@ Track your SAP solution deployment journey through this series of articles:
1.[Work with the solution across multiple workspaces](cross-workspace.md) (PREVIEW)
25
+
22
26
1.[Prepare SAP environment](preparing-sap.md)
23
27
24
28
1.[Deploy data connector agent](deploy-data-connector-agent-container.md)
@@ -48,7 +52,29 @@ To deploy SAP solution security content, do the following:
48
52
49
53
:::image type="content" source="./media/deploy-sap-security-content/sap-solution.png" alt-text="Screenshot of the 'Microsoft Sentinel solution for SAP® applications' solution pane." lightbox="media/deploy-sap-security-content/sap-solution.png":::
50
54
51
-
1. To launch the solution deployment wizard, select **Create**, and then enter the details of the Azure subscription, resource group, and Log Analytics workspace (the one used by Microsoft Sentinel) where you want to deploy the solution.
55
+
1. To launch the solution deployment wizard, select **Create**, and then enter the details of the Azure subscription and resource group.
56
+
57
+
1. For the **Deployment target workspace**, select the Log Analytics workspace (the one used by Microsoft Sentinel) where you want to deploy the solution.
58
+
59
+
<aid="multi-workspace"></a>
60
+
61
+
1. If you want to [work with the Microsoft Sentinel solution for SAP® applications across multiple workspaces](cross-workspace.md) (PREVIEW), do one of the following:
62
+
63
+
-[If you want the SOC and SAP data to reside in separate workspaces](cross-workspace.md#scenario-1-sap-and-soc-data-reside-in-separate-workspaces):
64
+
1. Select **Some of the data is on a different workspace**.
65
+
1. Under **Configure the workspace where the SOC data resides in**, select the SOC subscription and workspace.
66
+
1. Under **Configure the workspace where the SAP data resides in**, select the SAP subscription and workspace.
67
+
68
+
For example:
69
+
70
+
:::image type="content" source="./media/deploy-sap-security-content/sap-multi-workspace.png" alt-text="Screenshot of how to configure the Microsoft Sentinel solution for SAP® applications to work across multiple workspaces." lightbox="media/deploy-sap-security-content/sap-multi-workspace.png":::
71
+
72
+
-[If you want the SOC and SAP data to be kept on the same workspace](cross-workspace.md#scenario-2-sap-data-is-kept-in-the-soc-workspace):
73
+
- If the SAP team doesn't have permissions to the SAP workspace, under **Subscription** and **Resource group**, select the SAP workspace. Do not select **Some of the data is on a different workspace**.
74
+
- If the SAP team has permissions to the SAP workspace:
75
+
1. Select **Some of the data is on a different workspace**.
76
+
1. Under **Configure the workspace where the SOC data resides in**, select the SOC subscription and workspace.
77
+
1. Under **Configure the workspace where the SAP data resides in**, select the SAP subscription and workspace.
52
78
53
79
1. Select **Next** to cycle through the **Data Connectors**, **Analytics**, and **Workbooks** tabs, where you can learn about the components that will be deployed with this solution.
54
80
@@ -68,11 +94,11 @@ To deploy SAP solution security content, do the following:
68
94
69
95
1. In Microsoft Sentinel, go to the **Microsoft Sentinel for SAP** data connector to confirm the connection:
70
96
71
-
[](./media/deploy-sap-security-content/sap-data-connector.png#lightbox)
97
+
:::image type="content" source="./media/deploy-sap-security-content/sap-data-connector.png" alt-text="Screenshot of the Microsoft Sentinel for SAP data connector page." lightbox="media/deploy-sap-security-content/sap-data-connector.png":::
72
98
73
99
SAP ABAP logs are displayed on the Microsoft Sentinel **Logs** page, under **Custom logs**:
74
100
75
-
[](./media/deploy-sap-security-content/sap-logs-in-sentinel.png#lightbox)
101
+
:::image type="content" source="./media/deploy-sap-security-content/sap-logs-in-sentinel.png" alt-text="Screenshot of the SAP ABAP logs in the 'Custom Logs' area in Microsoft Sentinel." lightbox="media/deploy-sap-security-content/sap-logs-in-sentinel.png":::
76
102
77
103
For more information, see [Microsoft Sentinel solution for SAP® applications solution logs reference](sap-solution-log-reference.md).
Copy file name to clipboardExpand all lines: articles/sentinel/sap/deployment-overview.md
+7-6Lines changed: 7 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,12 +42,13 @@ Follow your deployment journey through this series of articles, in which you'll
42
42
| Milestone | Article |
43
43
| --------- | ------- |
44
44
|**1. Deployment overview**|**YOU ARE HERE**|
45
-
|**2. Deployment prerequisites**|[Prerequisites for deploying the Microsoft Sentinel solution for SAP® applications](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)|
46
-
|**3. Prepare SAP environment**|[Deploying SAP CRs and configuring authorization](preparing-sap.md)|
47
-
|**4. Deploy data connector agent**|[Deploy and configure the container hosting the data connector agent](deploy-data-connector-agent-container.md)|
48
-
| **5. Deploy SAP security content** | [Deploy SAP security content](deploy-sap-security-content.md)
49
-
|**6. Microsoft Sentinel solution for SAP® applications**|[Configure Microsoft Sentinel solution for SAP® applications](deployment-solution-configuration.md)|
50
-
|**7. Optional steps**| - [Configure auditing](configure-audit.md)<br>- [Configure Microsoft Sentinel for SAP data connector to use SNC](configure-snc.md)<br>- [Configure audit log monitoring rules](configure-audit-log-rules.md)<br>- [Select SAP ingestion profiles](select-ingestion-profiles.md)|
45
+
|**2. Plan architecture**| Learn about [working with the solution across multiple workspaces](cross-workspace.md) (PREVIEW) |
46
+
|**3. Deployment prerequisites**|[Prerequisites for deploying the Microsoft Sentinel solution for SAP® applications](prerequisites-for-deploying-sap-continuous-threat-monitoring.md)|
47
+
|**4. Prepare SAP environment**|[Deploying SAP CRs and configuring authorization](preparing-sap.md)|
48
+
|**5. Deploy data connector agent**|[Deploy and configure the container hosting the data connector agent](deploy-data-connector-agent-container.md)|
49
+
| **6. Deploy SAP security content** | [Deploy SAP security content](deploy-sap-security-content.md)
50
+
|**7. Microsoft Sentinel solution for SAP® applications**|[Configure Microsoft Sentinel solution for SAP® applications](deployment-solution-configuration.md)|
51
+
|**8. Optional steps**| - [Configure auditing](configure-audit.md)<br>- [Configure Microsoft Sentinel for SAP data connector to use SNC](configure-snc.md)<br>- [Configure audit log monitoring rules](configure-audit-log-rules.md)<br>- [Select SAP ingestion profiles](select-ingestion-profiles.md)|
0 commit comments