Edit

Microsoft Sentinel solution for SAP® applications overview

  • Article

SAP systems pose a unique security challenge. SAP systems handle extremely sensitive information and are prime targets for attackers.

Security operations teams have traditionally had very little visibility into SAP systems. An SAP system breach could result in stolen files, exposed data, or disrupted supply chain. Once an attacker is in the system, there are few controls to detect exfiltration or other bad acts. SAP activity needs to be correlated with other data across the organization for effective threat detection.

To help close this gap, Microsoft Sentinel offers the Microsoft Sentinel solution for SAP® applications. This comprehensive solution uses components at every level of Microsoft Sentinel to offer end-to-end detection, analysis, investigation, and response to threats in your SAP environment.

What the Microsoft Sentinel solution for SAP® applications does

The Microsoft Sentinel solution for SAP® applications continuously monitors SAP systems for threats at all layers - business logic, application, database, and OS. It allows you to:

  • Correlate SAP monitoring with other signals across your organization, and to use detections provided by the solution—or build your own detections—to monitor sensitive transactions and other business risks such as privilege escalation, unapproved changes, and unauthorized access.

  • Build automated response processes to interact with your SAP systems to stop active security threats.

The Microsoft Sentinel solution for SAP® applications also offers threat monitoring and detection for SAP Business Technology Platform.

For example, the following image shows a multi-SID SAP landscape with a split between productive and non-productive systems, including the SAP Business Technology Platform. All of the systems in this image are onboarded to Microsoft Sentinel for the SAP solution.

Diagram of a multi-SID SAP landscape with Microsoft Sentinel.

Solution details

Log sources

The solution's data connector retrieves a wide variety of SAP Log Sources:

  • ABAP Security Audit Log
  • ABAP Change Documents Log
  • ABAP Spool Log
  • ABAP Spool Output Log
  • ABAP Job Log
  • ABAP Workflow Log
  • ABAP DB Table Data
  • SAP User Master Data
  • ABAP CR Log
  • ICM Logs
  • JAVA Webdispacher Logs
  • Syslog

Threat detection coverage

  • Suspicious privileges operations  – Privileged user creation

    • Usage of break-glass users
    • Unlocking a user and logging into to it from the same IP
    • Assignment of sensitive roles and admin privileges
    • User Unlocks and uses other users
    • Critical Authorization Assignment   

  • Attempts to bypass SAP security mechanisms –

    • Disabling audit logging (HANA and SAP)
    • Execution of sensitive function modules
    • Unlocking blocked transactions
    • Debugging production systems
    • Sensitive Tables Direct access by RFC
    • RFC Execution of Sanative Function
    • System Configuration Change,  Dynamic ABAP Program.

  • Backdoor creation  (persistency) 

    • Creation of new internet facing interfaces (ICF)
    • Directly accessing sensitive tables by remote-function-call
    • Assigning new service handlers to ICF
    • Execution of obsolete programs
    • User Unlocks and uses other users.  

  • Data exfiltration 

    • Multiple files downloads
    • Spool takeovers
    • Allowing access to insecure FTP servers & connections from unauthorized hosts
    • Dynamic RFC Destination
    • HANA DB - User Admin Actions from DB level.  

  • Initial Access – Brute force

    • Multiple logons from the same IP
    • Privileged user logons from unexpected networks
    • SPNego Replay Attack

Certification

Microsoft Sentinel solution for SAP® applications is certified for SAP S/4HANA® Cloud, Private Edition RISE with SAP and SAP S/4 on-premises.

  • The integration scenarios include S/4-BC-XAL 1.0/S/4 EXTERNAL ALERT AND MONITORING 1.0 (for S/4).
  • Our certification includes S/4 and SAP Rise S/4 HANA® Cloud Private Edition running in any cloud and on-premises.
  • We support hybrid deployments that can cover the entire customer estate.

See the certification on the SAP Certified Solutions Directory.

Trademark attribution

SAP S/4HANA and SAP are trademarks or registered trademarks of SAP SE or its affiliates in Germany and in other countries/regions. 

Next steps

Learn more about the Microsoft Sentinel solution for SAP® applications:

Troubleshooting:

Reference files: