Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

SAP BTP

View on GitHub ↗Original file ↗

Description

SAP Business Technology Platform (SAP BTP) brings together data management, analytics, artificial intelligence, application development, automation, and integration in one, unified environment.
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

{{graphQueriesTableName}}

Declared permissions

Read and Write permissions are required.
Workspace
Workspace
Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)
Keys
Workspace
Client Id and Client Secret for Audit Retrieval API
Enable API access in BTP.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

**Step 1 - Configuration steps for the SAP BTP Audit Retrieval API** Follow the steps provided by SAP [see Audit Log Retrieval API for Global Accounts in the Cloud Foundry Environment](https://help.sap.com/docs/btp/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**. >**NOTE:** You can mass onboard BTP subaccounts by using [provided tools](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP%20BTP/Tools).
Connect using OAuth client credentials
Connect events from SAP BTP to Microsoft Sentinel
Add account
BTP connection
Account Details
Subaccount name (e.g. Contoso). This will be projected to the InstanceName column.
Subaccount ID (GUID)
SAP BTP Client ID
SAP BTP Client Secret
Authorization server URL (UAA server)
Audit Retrieval API URL
Advanced
Polling Frequency (minutes, 1-15)
Frequency to poll for new BTP audit logs.
Log Ingest Delay (minutes, 1-120)
Delay to account for SAP BTP audit logs published late.
Subaccounts
Each row represents a connected subaccount

Related content

Links established from declared identifiers and solution manifests.

Analytics rules16
SAP BTP - Audit log service unavailableHighSAP BTP - Build Work Zone unauthorized access and role tamperingHighSAP BTP - Cloud Identity Service application configuration monitorMediumSAP BTP - Cloud Integration access policy tamperingHighSAP BTP - Cloud Integration artifact deploymentHighSAP BTP - Cloud Integration JDBC data source changesHighSAP BTP - Cloud Integration package import or transportMediumSAP BTP - Cloud Integration tampering with security materialMediumSAP BTP - Failed access attempts across multiple BAS subaccountsMediumSAP BTP - Malware detected in BAS dev spaceMediumSAP BTP - Mass user deletion in a sub accountMediumSAP BTP - Mass user deletion in Cloud Identity ServiceMediumSAP BTP - Trust and authorization Identity Provider monitorMediumSAP BTP - Unaudited custom app with login-only activityMediumSAP BTP - User added to Cloud Identity Service privileged Administrators listHighSAP BTP - User added to sensitive privileged role collectionLow
Solutions1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
SAPBTPAuditEvents
Additional source files 2Solutions/SAP BTP/Data Connectors/SAPBTPPollerConnector/SAPBTP_DataConnectorDefinition.jsonsource ↗Solutions/SAP BTP/Data/Solution_SAPBTP.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.