SAP LogServ (RISE), S/4HANA Cloud private edition

SAP LogServ is an SAP Enterprise Cloud Services (ECS) service that collects, stores, and forwards logs from all SAP systems, applications, and ECS services used by a registered customer. This connector streams those logs to Microsoft Sentinel in near real time, complementing SAP application-layer detections with infrastructure logs such as HANA database, SAP Web Dispatcher, OS, DNS, and Azure network flows. Standard log formats are automatically routed by the data collection rule to the matching Microsoft Sentinel tables — **Syslog**, **WindowsEvent** / **SecurityEvent**, and the ASIM-normalized tables **ASimDnsActivityLogs**, **ASimWebSessionLogs** and **ASimNetworkSessionLogs** — while SAP-specific logs remain in the **SAPLogServ_CL** custom table. Because these logs land in normalized, source-agnostic tables, they are already covered by the out-of-the-box analytic rules and hunting queries that Microsoft ships for the corresponding ASIM schemas and standard tables. To avoid duplicate alerts, those detections are intentionally **not** repackaged in this solution; only the HANA DB analytic rules — which require LogServ-specific parsing of the Syslog payload — are shipped here. Learn how normalized data reuses this built-in content in [Advanced Security Information Model (ASIM) normalization content](https://learn.microsoft.com/en-us/azure/sentinel/normalization-content).