{ "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", "apiVersion": "2025-06-01", "name": "SAPLogServ", "location": "{{location}}", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "SAPLogServ", "title": "SAP LogServ (RISE), S/4HANA Cloud private edition", "publisher": "SAP SE", "logo": "SapLogo.svg", "descriptionMarkdown": "SAP LogServ is an SAP Enterprise Cloud Services (ECS) service that collects, stores, and forwards logs from all SAP systems, applications, and ECS services used by a registered customer. This connector streams those logs to Microsoft Sentinel in near real time, complementing SAP application-layer detections with infrastructure logs such as HANA database, SAP Web Dispatcher, OS, DNS, and Azure network flows.\n\nStandard log formats are automatically routed by the data collection rule to the matching Microsoft Sentinel tables — **Syslog**, **WindowsEvent** / **SecurityEvent**, and the ASIM-normalized tables **ASimDnsActivityLogs**, **ASimWebSessionLogs** and **ASimNetworkSessionLogs** — while SAP-specific logs remain in the **SAPLogServ_CL** custom table. Because these logs land in normalized, source-agnostic tables, they are already covered by the out-of-the-box analytic rules and hunting queries that Microsoft ships for the corresponding ASIM schemas and standard tables. To avoid duplicate alerts, those detections are intentionally **not** repackaged in this solution; only the HANA DB analytic rules — which require LogServ-specific parsing of the Syslog payload — are shipped here. Learn how normalized data reuses this built-in content in [Advanced Security Information Model (ASIM) normalization content](https://learn.microsoft.com/en-us/azure/sentinel/normalization-content).", "graphQueriesTableName": "SAPLogServ_CL", "graphQueries": [ { "metricName": "Total SAP events received", "legend": "SAPLogServ_CL", "baseQuery": "{{graphQueriesTableName}} | project TimeGenerated" }, { "metricName": "SAP Linux syslog events", "legend": "Syslog (Linux)", "baseQuery": "Syslog | where SourceSystem == \"Linux\" and CollectorHostName == \"SAPLogServ\" | project TimeGenerated" }, { "metricName": "SAP HANA audit events", "legend": "Syslog (HANADB)", "baseQuery": "Syslog | where SourceSystem == \"HANADB\" and CollectorHostName == \"SAPLogServ\" | project TimeGenerated" }, { "metricName": "SAP Windows events", "legend": "WindowsEvent", "baseQuery": "WindowsEvent | where Provider startswith \"Microsoft\" and Computer has \".\" | project TimeGenerated" }, { "metricName": "SAP DNS query events", "legend": "ASimDnsActivityLogs", "baseQuery": "ASimDnsActivityLogs | where EventProduct == \"BIND\" and EventOwner == \"SAPLogServ\" | project TimeGenerated" }, { "metricName": "SAP Web Dispatcher access events", "legend": "ASimWebSessionLogs", "baseQuery": "ASimWebSessionLogs | where EventProduct == \"SAP Web Dispatcher\" and EventOwner == \"SAPLogServ\" | project TimeGenerated" }, { "metricName": "Azure VNet flow log events", "legend": "ASimNetworkSessionLogs", "baseQuery": "ASimNetworkSessionLogs | where EventProduct == \"AzureVNet\" and EventOwner == \"SAPLogServ\" | project TimeGenerated" } ], "sampleQueries": [ { "description": "Get Sample Events from custom table", "query": "{{graphQueriesTableName}}\n | take 10" }, { "description": "SAP Linux syslog events", "query": "Syslog\n | where SourceSystem == \"Linux\" and CollectorHostName == \"SAPLogServ\"\n | take 10" }, { "description": "SAP HANA audit events", "query": "Syslog\n | where SourceSystem == \"HANADB\" and CollectorHostName == \"SAPLogServ\"\n | take 10" }, { "description": "SAP Windows events by Provider", "query": "WindowsEvent\n | where Provider startswith \"Microsoft\"\n | summarize count() by Provider, Channel\n | sort by count_ desc" }, { "description": "SAP DNS queries", "query": "ASimDnsActivityLogs\n | where EventProduct == \"BIND\" and EventOwner == \"SAPLogServ\"\n | summarize count() by DnsQueryTypeName, bin(TimeGenerated, 1h)" }, { "description": "SAP Web Dispatcher access log", "query": "ASimWebSessionLogs\n | where EventProduct == \"SAP Web Dispatcher\" and EventOwner == \"SAPLogServ\"\n | summarize count() by EventResult, EventResultDetails, bin(TimeGenerated, 1h)" }, { "description": "Azure VNet flow logs", "query": "ASimNetworkSessionLogs\n | where EventProduct == \"AzureVNet\" and EventOwner == \"SAPLogServ\"\n | summarize count() by NetworkDirection, NetworkProtocol, bin(TimeGenerated, 1h)" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } }, { "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)", "providerDisplayName": "Keys", "scope": "Workspace", "requiredPermissions": { "action": true } } ], "customs": [ { "name": "Microsoft Entra", "description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher." }, { "name": "Microsoft Azure", "description": "Permission to assign Monitoring Metrics Publisher role on data collection rules. Typically requires Azure RBAC Owner or User Access Administrator role." }, { "name": "Microsoft Sentinel for SAP agentless data connector and content package (60+ analytic rules, workbooks, parsers, and more)", "description": "Deploy from Microsoft Sentinel content hub. See details [here](https://aka.ms/sentinel-sap-agentless-docs)" } ] }, "instructionSteps": [ { "title": "1. Deploy Microsoft Sentinel agentless data connector and content for SAP", "description": "LogServ adds infrastructure logs to Microsoft Sentinel. Deploying the Microsoft Sentinel agentless data connector and content for SAP will provide you with **60+ out-of-box detections and visualizations** for your whole SAP environment. Get started from [here](https://aka.ms/sentinel-sap-agentless-docs). \n\nLearn more from [this article](https://aka.ms/sentinel-sap-logserv)." }, { "title": "2. Create ARM Resources and Provide the Required Permissions", "description": "We will create data collection rule (DCR) and data collection endpoint (DCE) resources. We will also create a Microsoft Entra app registration and assign the required permissions to it.", "instructions": [ { "type": "Markdown", "parameters": { "content": "#### Automated deployment of Azure resources\nClicking on \"Deploy push connector resources\" will trigger the creation of DCR and DCE resources.\nIt will then create a Microsoft Entra app registration with client secret and grant permissions on the DCR. This setup enables data to be sent securely to the DCR using a OAuth v2 client credentials." } }, { "parameters": { "label": "Deploy push connector resources", "applicationDisplayName": "SAP LogServ push to Microsoft Sentinel" }, "type": "DeployPushConnectorButton_test" } ] }, { "title": "3. Maintain the data collection endpoint details and authentication info in SAP LogServ", "description": "Share the data collection endpoint URL and authentication info with the SAP LogServ administrator to configure the SAP LogServ to send data to the data collection endpoint.\n\nLearn more from [this blog series](https://community.sap.com/t5/enterprise-resource-planning-blog-posts-by-members/ultimate-blog-series-sap-logserv-integration-with-microsoft-sentinel/ba-p/14126401).", "instructions": [ { "parameters": { "label": "Use this value to configure as Tenant ID in the LogIngestionAPI credential.", "fillWith": [ "TenantId" ] }, "type": "CopyableLabel" }, { "parameters": { "label": "Entra Application ID", "fillWith": [ "ApplicationId" ], "placeholder": "Deploy push connector to get the Application ID" }, "type": "CopyableLabel" }, { "parameters": { "label": "Entra Application Secret", "fillWith": [ "ApplicationSecret" ], "placeholder": "Deploy push connector to get the Application Secret" }, "type": "CopyableLabel" }, { "parameters": { "label": "Use this value to configure the LogsIngestionURL parameter when deploying the IFlow.", "fillWith": [ "DataCollectionEndpoint" ], "placeholder": "Deploy push connector to get the DCE URI" }, "type": "CopyableLabel" }, { "parameters": { "label": "DCR Immutable ID", "fillWith": [ "DataCollectionRuleId" ], "placeholder": "Deploy push connector to get the DCR ID" }, "type": "CopyableLabel" } ] } ] } } }