Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

SAP BTP

Voir sur GitHub ↗Fichier original ↗

Description

SAP Business Technology Platform (SAP BTP) brings together data management, analytics, artificial intelligence, application development, automation, and integration in one, unified environment.
Auteur / éditeur déclaré
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

{{graphQueriesTableName}}

Permissions déclarées

Read and Write permissions are required.
Workspace
Workspace
Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)
Keys
Workspace
Client Id and Client Secret for Audit Retrieval API
Enable API access in BTP.

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

**Step 1 - Configuration steps for the SAP BTP Audit Retrieval API** Follow the steps provided by SAP [see Audit Log Retrieval API for Global Accounts in the Cloud Foundry Environment](https://help.sap.com/docs/btp/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**. >**NOTE:** You can mass onboard BTP subaccounts by using [provided tools](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP%20BTP/Tools).
Connect using OAuth client credentials
Connect events from SAP BTP to Microsoft Sentinel
Add account
BTP connection
Account Details
Subaccount name (e.g. Contoso). This will be projected to the InstanceName column.
Subaccount ID (GUID)
SAP BTP Client ID
SAP BTP Client Secret
Authorization server URL (UAA server)
Audit Retrieval API URL
Advanced
Polling Frequency (minutes, 1-15)
Frequency to poll for new BTP audit logs.
Log Ingest Delay (minutes, 1-120)
Delay to account for SAP BTP audit logs published late.
Subaccounts
Each row represents a connected subaccount

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques16
SAP BTP - Audit log service unavailableHighSAP BTP - Build Work Zone unauthorized access and role tamperingHighSAP BTP - Cloud Identity Service application configuration monitorMediumSAP BTP - Cloud Integration access policy tamperingHighSAP BTP - Cloud Integration artifact deploymentHighSAP BTP - Cloud Integration JDBC data source changesHighSAP BTP - Cloud Integration package import or transportMediumSAP BTP - Cloud Integration tampering with security materialMediumSAP BTP - Failed access attempts across multiple BAS subaccountsMediumSAP BTP - Malware detected in BAS dev spaceMediumSAP BTP - Mass user deletion in a sub accountMediumSAP BTP - Mass user deletion in Cloud Identity ServiceMediumSAP BTP - Trust and authorization Identity Provider monitorMediumSAP BTP - Unaudited custom app with login-only activityMediumSAP BTP - User added to Cloud Identity Service privileged Administrators listHighSAP BTP - User added to sensitive privileged role collectionLow
Solutions1

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
SAPBTPAuditEvents
Autres fichiers source 2Solutions/SAP BTP/Data Connectors/SAPBTPPollerConnector/SAPBTP_DataConnectorDefinition.jsonsource ↗Solutions/SAP BTP/Data/Solution_SAPBTP.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.