Task 02: Explore workbooks

Description

Installing the SAP Solution for Sentinel causes the system to install three SAP-specific workbook templates. Workbook templates allow you to visualize data that you’ve collected in pre-defined ways. In these steps, you’ll open and explore the SAP-specific workbook templates installed with the Sentinel solution. These templates provide visual insights into SAP log data, including failed logons and access trends. You’ll interact with filters and refresh visualizations to understand how data is presented.

Success criteria

• SAP workbook templates are accessed in Microsoft Sentinel.
• Filters are applied and visualizations are refreshed.
• Key insights from the workbook are identified and interpreted.

Learning resources

• Log Analytics tutorial
• SAP Audit Log workbook

Key tasks

1. Select **Microsoft Sentinel

   Data connectors** in the upper-left part of the page, in the breadcrumbs menu, to go to the Microsoft Sentinel main page.

2. In the left pane, in the Threat management section, select Workbooks.

   

3. On the Workbooks page, select the Templates tab.

   

4. Select the SAP - Security Audit log and Initial Access template and then select View template.

   

   This workbook allows you to visualize logon failures, trends in login types, and other related information.

5. In the list of filter options at the top of the workbook, in System Roles, select All System Roles.

   The system automatically updates the queries in the workbook to include all system roles.

6. From the upper side of the page select the Refresh icon.

7. Scroll down to Unique User failed logons per SAP system. To the right, select the ellipses …. Select Refresh to force an update to the visualizations.

8. Go back to the Microsoft Sentinel page by selecting Microsoft Sentinel Workbooks in the breadcrumbs menu.