| 1 | --- |
| 2 | title: SAP SIEM (Customer Data Cloud) |
| 3 | description: Collect SAP Customer Data Cloud audit events and forward them into the SOCFortress SIEM stack. |
| 4 | --- |
| 5 | |
| 6 | ## What this integration is |
| 7 | |
| 8 | This integration collects **audit events** from SAP Customer Data Cloud (Gigya) and forwards them into your SOCFortress SIEM stack. |
| 9 | |
| 10 | It may also support higher-level detections such as: |
| 11 | - multiple logins detection |
| 12 | - suspicious login detection |
| 13 | |
| 14 | Vendor reference: |
| 15 | - SAP doc: https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/4143815a70b21014bbc5a10ce4041860.html |
| 16 | |
| 17 | --- |
| 18 | |
| 19 | ## Credentials you’ll need |
| 20 | |
| 21 | - API Key |
| 22 | - User Key |
| 23 | - Secret Key |
| 24 | - API Domain (site domain) |
| 25 | |
| 26 | --- |
| 27 | |
| 28 | ## CoPilot setup (recommended workflow) |
| 29 | |
| 30 | 1) Provision the customer. |
| 31 | 2) Add the **SAP SIEM** integration under the customer. |
| 32 | 3) Provide the API key/user key/secret and domain. |
| 33 | 4) Validate events arrive and are searchable. |
| 34 | |
| 35 | --- |
| 36 | |
| 37 | ## Success criteria |
| 38 | |
| 39 | - [ ] Audit events appear for the expected tenant |
| 40 | - [ ] Optional detections (if enabled) mark/analyze events as expected |
| 41 | |
| 42 | --- |
| 43 | |
| 44 | ## Troubleshooting |
| 45 | |
| 46 | - Confirm you are using the correct domain/region for your SAP tenant. |
| 47 | - Confirm the secret is the one associated with the userKey. |
| 48 | - Ensure HTTPS is used when required by the auth method. |