↳ GitHub sourceConnector

SAP Enterprise Threat Detection, cloud edition

Description

The SAP Enterprise Threat Detection, cloud edition (ETD) data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.

Declared author / publisher: SAP

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

SAPETDAlerts_CL SAPETDInvestigations_CL

Declared permissions

Read and Write permissions are required.

Workspace

Workspace

Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)

Keys

Workspace

Client Id and Client Secret for ETD Retrieval API

Enable API access in ETD.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

**Step 1 - Configuration steps for the SAP ETD Audit Retrieval API** Follow the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**. >**NOTE:** You can onboard one or more ETD subaccounts by following the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment/). Add a connection for each subaccount. >**TIP:** Use the [shared blog series](https://community.sap.com/t5/enterprise-resource-planning-blog-posts-by-sap/sap-enterprise-threat-detection-cloud-edition-joins-forces-with-microsoft/ba-p/13942075) for additional info.

Connect using OAuth client credentials

Connect events from SAP ETD to Microsoft Sentinel

Add account

ETD connection

Account Details

SAP ETD Client ID

SAP ETD Client Secret

Authorization server URL (UAA server)

SAP ETD data retrieval API URL

ETD accounts

Each row represents a connected ETD account

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/SAP ETD Cloud/Data Connectors/SAPETD_PUSH_CCP/SAPETD_connectorDefinition.json ↗
Commit: 629d1d3 ↗
Source identifier: SAPETDAlerts

Additional source files 2

Solutions/SAP ETD Cloud/Data Connectors/SAPETD_PUSH_CCP/SAPETD_connectorDefinition.jsonsource ↗Solutions/SAP ETD Cloud/Data/Solution_SAPETD.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.