| 1 | # [SAP SIEM](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/4143815a70b21014bbc5a10ce4041860.html) |
| 2 | |
| 3 | The SAP SIEM integration allows you to collect audit events from the SAP Cloud and forward them to your SIEM stack. |
| 4 | |
| 5 | In addition to the audit event collection, there are two additional features that are available: |
| 6 | |
| 7 | - **Multiple Logins Detection**: This feature allows you to detect when the same IP address is used to log in to multiple accounts. |
| 8 | - Uses the `sap_siem_multiple_logins` table |
| 9 | - **Suspicious Login Detection**: This feature allows you to detect when a user account has multiple failed login attempts, followed by a successful login. |
| 10 | |
| 11 | These features make modifications to the `sap_siem_*customer_code*` index to set the `event_analyzed` and `event_analyzed_multiple_logins` to `true` and `false` respectively. |
| 12 | |
| 13 | # Making an API Call |
| 14 | |
| 15 | ## Global Common Parameters |
| 16 | |
| 17 | The following parameters are required for all API calls: |
| 18 | |
| 19 | - **UID** (Required when making user account level API calls): The unique ID of a connected user, which this method call is associated with. This is the UID you received from SAP Customer Data Cloud after successful login of this user or via accounts.search. Note: If you are using account linking then the UID would be your site user ID. To learn more about Social Sign-On with account linking (best practice), refer to [Social Login](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/4172d0a670b21014bbc5a10ce4041860.html). |
| 20 | - **apiKey**: The site API key from the [SAP Customer Data Cloud Dashboard](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Fconsole.gigya.com) Information published on non-SAP site. You can find instructions for generating an API key [here](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/5c7e37ef11fb4422aedb4a9f3b8a4331.html). |
| 21 | - **userKey**: The Application key generated by Creating an Application via the Admin tab of the SAP Customer Data Cloud ConsoleInformation published on non-SAP site. |
| 22 | |
| 23 | ### Important details related to using a userKey: |
| 24 | |
| 25 | - When using a userKey you must pass the secret associated with the userKey, not the Account's secret, as another parameter. |
| 26 | - When using a userKey you do not need to sign the request. |
| 27 | - When using a userKey the request must be sent over HTTPS (SSL). |
| 28 | |
| 29 | ## Sample Request Over HTTPS |
| 30 | |
| 31 | The following is an example of an HTTPS request using an app/user key and app/user secret: |
| 32 | |
| 33 | ```bash |
| 34 | curl -X POST \ |
| 35 | https://socialize.us1.gigya.com/socialize.setStatus \ |
| 36 | -H 'content-type: application/x-www-form-urlencoded' \ |
| 37 | -d 'apiKey=<API-Key>&userKey=<User-Key>&secret=<Secret>&UID=<User-ID>&status=Hello%20World' |
| 38 | ``` |
| 39 | |
| 40 | # Credentials Need For Configuration |
| 41 | |
| 42 | - API Key |
| 43 | - User Key |
| 44 | - Secret Key |
| 45 | - API Domain (Same as the `Site Domain` in the SAP Customer Data Cloud Dashboard) - See screenshot [here](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/5c7e37ef11fb4422aedb4a9f3b8a4331.html) |