Create Sentinel
Before we start integrating SAP with Microsoft Sentinel, we need to setup components to allow this communication to happen.
This section will show the steps required for this to be accomplished:
Setting up Log Analytics
- Go to Azure Portal, click on Create Resource and look for Log Analytics Workspaces
- Click Create
- Fill in the required informations:
- Subscription: SELECT YOUR SUBSCRIPTION
- Resource Group: SAP CAL Resource Group
- Name: SAPLogAnalyticsWorkspace
- Region: East US
- Click on Review + create and then Create
Creating a Microsoft Sentinel workspace
- Go to Azure Portal, click on Create Resource and look for Microsoft Sentinel
- Click Create
- Select the previously created SAPLogAnalyticsWorkspace and click Add
- If this is your first Microsoft Sentinel, accept the Trial
- On the Get Started click on go to Content Hub so we can add SAP log model to Sentinel
- Look for SAP, select the Solution and click Install
- On the next screen, click Create
- Fill in the required informations:
- Subscription: SELECT YOUR SUBSCRIPTION
- Resource Group: SAP CAL Resource Group
- Deployment Target Workspace: SAPLogAnalyticsWorkspace
- Click on Review + create and then Create
Alright! With that we set up a place to receive the logs sent by SAP and prepared Sentinel to understand these logs.
On the next steps we will configure SAP to send those logs.