SAP Enterprise Threat Detection, cloud edition

**Step 1 - Configuration steps for the SAP ETD Audit Retrieval API** Follow the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**. >**NOTE:** You can onboard one or more ETD subaccounts by following the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment/). Add a connection for each subaccount. >**TIP:** Use the [shared blog series](https://community.sap.com/t5/enterprise-resource-planning-blog-posts-by-sap/sap-enterprise-threat-detection-cloud-edition-joins-forces-with-microsoft/ba-p/13942075) for additional info.

Connect using OAuth client credentials

Connect events from SAP ETD to Microsoft Sentinel

Add account

ETD connection

Account Details

SAP ETD Client ID

SAP ETD Client Secret

Authorization server URL (UAA server)

SAP ETD data retrieval API URL

ETD accounts

Each row represents a connected ETD account