@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
md 2.99 KB
View source Raw

SAP SIEM

The SAP SIEM integration allows you to collect audit events from the SAP Cloud and forward them to your SIEM stack.

In addition to the audit event collection, there are two additional features that are available:

  • Multiple Logins Detection: This feature allows you to detect when the same IP address is used to log in to multiple accounts.
    • Uses the sap_siem_multiple_logins table
  • Suspicious Login Detection: This feature allows you to detect when a user account has multiple failed login attempts, followed by a successful login.

These features make modifications to the sap_siem_*customer_code* index to set the event_analyzed and event_analyzed_multiple_logins to true and false respectively.

Making an API Call

Global Common Parameters

The following parameters are required for all API calls:

  • UID (Required when making user account level API calls): The unique ID of a connected user, which this method call is associated with. This is the UID you received from SAP Customer Data Cloud after successful login of this user or via accounts.search. Note: If you are using account linking then the UID would be your site user ID. To learn more about Social Sign-On with account linking (best practice), refer to Social Login.
  • apiKey: The site API key from the SAP Customer Data Cloud Dashboard Information published on non-SAP site. You can find instructions for generating an API key here.
  • userKey: The Application key generated by Creating an Application via the Admin tab of the SAP Customer Data Cloud ConsoleInformation published on non-SAP site.
  • When using a userKey you must pass the secret associated with the userKey, not the Account's secret, as another parameter.
  • When using a userKey you do not need to sign the request.
  • When using a userKey the request must be sent over HTTPS (SSL).

Sample Request Over HTTPS

The following is an example of an HTTPS request using an app/user key and app/user secret:

curl -X POST \
https://socialize.us1.gigya.com/socialize.setStatus \
-H 'content-type: application/x-www-form-urlencoded' \
-d 'apiKey=<API-Key>&userKey=<User-Key>&secret=<Secret>&UID=<User-ID>&status=Hello%20World'

Credentials Need For Configuration

  • API Key
  • User Key
  • Secret Key
  • API Domain (Same as the Site Domain in the SAP Customer Data Cloud Dashboard) - See screenshot here