Update SAP connector and DCR settings

  • Applies to: Microsoft Sentinel in the Microsoft Defender portal, Microsoft Sentinel in the Azure portal

Update the SAP data connector or its data collection rule (DCR) independently to tune collection settings without disconnecting SAP systems. You don't need to update both resources. This article shows one option for each resource: Azure API Playground for the connector and the Azure portal template experience for the DCR.

Important

Update the active dataConnectors resource, not the connector-definition resource. The DCR might be shared by multiple connectors, so review its impact before you deploy DCR changes.

Important

Changing polling frequency or other defaults can affect SAP and SAP Integration Suite performance, ingestion latency, and Microsoft Sentinel costs. A shorter interval might increase source-system load, while a longer interval might delay detections or create a backlog. Test changes on one connector first, monitor connector health and ingestion volume, and then roll out the change to other systems. For more guidance, see Run the agentless SAP connector cost-efficiently.

Update a data connector with API Playground

Several options are available for updating a data connector, including REST API clients and scripts. The following procedure shows one option using Azure API Playground.

SAP BTP connector

  1. Use the Data Connectors - List operation. Select the latest preview API version in the reference. For example:

    GET /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.OperationalInsights/workspaces/<workspace-name>/providers/Microsoft.SecurityInsights/dataConnectors?api-version=<api-version>-preview

  2. In the response, locate the target connector in the value array. Copy its id.

  3. Use the copied id as the URL for a PUT request. Use the existing connector properties as the starting point, and change only the settings you need.

    The following SAP BTP example changes the polling frequency. queryWindowInMin is the polling-frequency field.

    {
  "id": "<connector-resource-id>",
  "name": "<connector-id>",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "RestApiPoller",
  "properties": {
    "dataType": "SAPBTPAuditLog_CL",
    "connectorDefinitionName": "SAPBTPAuditEvents",
    "addOnAttributes": {
      "SubaccountName": "<subaccount-name>"
    },
    "auth": {
      "ClientSecret": "<client-secret>",
      "ClientId": "<client-id>",
      "grantType": "client_credentials",
      "tokenEndpoint": "<token-endpoint>",
      "type": "OAuth2"
    },
    "request": {
      "apiEndpoint": "<api-endpoint>/auditlog/v2/auditlogrecords",
      "queryWindowInMin": 1
    }
  }
}

    Retrieve <client-id>, <client-secret>, <token-endpoint>, and <api-endpoint> from the SAP BTP auditlog-management service key: uaa.clientid, uaa.clientsecret, uaa.url, and url. For details, see Set up the BTP subaccount and solution. The list API response omits the client ID and client secret, so read them from your secure store and don't submit blank credential values.

  4. Select Send. The update might take several minutes to become active.

SAP applications agentless connector

The SAP BTP and SAP applications agentless connectors use different request properties. For the SAP applications agentless connector, use the existing connector id and include the SAPCC definition. If the RFC destination changes, update the rfcDestinationName header. For example:

{
  "id": "<connector-resource-id>",
  "name": "<connector-id>",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "RestApiPoller",
  "properties": {
    "dataType": "SentinelHealth",
    "connectorDefinitionName": "SAPCC",
    "auth": {
      "GrantType": "client_credentials",
      "ClientSecret": "<client-secret>",
      "ClientId": "<client-id>",
      "tokenEndpoint": "<token-endpoint>?grant_type=client_credentials",
      "type": "OAuth2"
    },
    "request": {
      "apiEndpoint": "<integration-suite-endpoint>/http/microsoft/sentinel/sap-log-trigger",
      "rateLimitQPS": 2,
      "queryWindowInMin": 1,
      "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss.000000+00:00",
      "retryCount": 1,
      "timeoutInSeconds": 180,
      "headers": {
        "rfcDestinationName": "<rfc-destination-name>"
      },
      "startTimeAttributeName": "startTimeUTC",
      "endTimeAttributeName": "endTimeUTC"
    }
  }
}

Keep the existing SAPCC properties unless you intend to change them. Use the full resource returned by the list operation as your starting point, and preserve any properties not shown in this minimal example.

Retrieve <client-id>, <client-secret>, <token-endpoint>, and <integration-suite-endpoint> from the SAP BTP Process Integration Runtime service key: clientid, clientsecret, tokenurl, and url. For details, see Connect your agentless data connector. The list API response omits the client ID and client secret, so read them from your secure store and don't submit blank credential values.

Keep queryTimeFormat, startTimeAttributeName, and endTimeAttributeName together. They define how the poller supplies the time window to the SAP Data Collector endpoint.

For the full SAP BTP field mapping, see the SAP BTP polling configuration. For the SAP applications agentless field mapping, see the SAP Integration Suite tools.

Update the DCR with an exported template

Several options are available for updating a DCR, including REST API clients, scripts, and ARM templates. The following procedure shows one portal-based option using an exported template.

  1. In the Azure portal, open the DCR and select Automation > Export template.
  2. Select Copy, to store the well-formatted template JSON.
  3. Select Deploy, then on the next screen select Edit template and paste the copied JSON into the editor.
  4. Change only the required DCR properties (streamDeclarations and dataFlows) and keep the resource name unchanged.
  5. Select Review + create, then select Create.

Wait for the deployment to complete and for the DCR change to take effect. Verify connector health and new data in the relevant SAP tables before relying on the update.

For more detail about selectively updating SAP-related DCR data flows, see the SAP community blog Activating Advanced Security Information Model (ASIM) LogServ with Sentinel for SAP RISE.

Automate updates at scale

For mass onboarding and updates, use the API and CLI-based approaches in Deploy the Microsoft Sentinel solution for SAP BTP and Connect your SAP system to Microsoft Sentinel.

Related content

  • Last updated on