Task 05: Check compliance for your SAP security controls

Description

In these steps, you’ll open the SAP Audit Controls workbook, configure a rule for monitoring multiple logons by IP, and activate the alert rule. This helps ensure that your SAP system adheres to security best practices.

Success criteria

• The SAP Audit Controls workbook is accessed and configured.
• A compliance rule is selected and activated.
• Confirmation is received that the rule is active and monitoring is in place.

Learning resources

• SAP Audit controls workbook

Key tasks

1. On the Microsoft Sentinel Workbooks page, select the Templates tab.

2. Select SAP-Audit Controls and then select View template.

3. In the Configure tab, select SAP from the Solution dropdown list.

4. In the Select a rule to configure section, select SAP - Multiple logons by IP.

5. Select Save changes and then Update SAP alert rule.

6. At upper right of the page (or in Alerts), a success message shows that the rule is now active.

7. Close to the top of the page, select the Monitor tab.

8. Select the Report tab.