Add SAP SIEM integration documentation and update backend API target
Taylor committed
Feb 14, 2024 at 11:33 UTC
9672314e6b375f485e96b7849ddf446cd213e7c1
2 files changed
+46
-2
backend/app/integrations/markdown/sap_siem.md
+44
@@ -1 +1,45 @@
1
# [SAP SIEM](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/4143815a70b21014bbc5a10ce4041860.html)
2
+
3
+The SAP SIEM integration allows you to collect audit events from the SAP Cloud and forward them to your SIEM stack.
4
+
5
+In addition to the audit event collection, there are two additional features that are available:
6
+
7
+- **Multiple Logins Detection**: This feature allows you to detect when the same IP address is used to log in to multiple accounts.
8
+ - Uses the `sap_siem_multiple_logins` table
9
+- **Suspicious Login Detection**: This feature allows you to detect when a user account has multiple failed login attempts, followed by a successful login.
10
+
11
+These features make modifications to the `sap_siem_*customer_code*` index to set the `event_analyzed` and `event_analyzed_multiple_logins` to `true` and `false` respectively.
12
+
13
+# Making an API Call
14
+
15
+## Global Common Parameters
16
+
17
+The following parameters are required for all API calls:
18
+
19
+- **UID** (Required when making user account level API calls): The unique ID of a connected user, which this method call is associated with. This is the UID you received from SAP Customer Data Cloud after successful login of this user or via accounts.search. Note: If you are using account linking then the UID would be your site user ID. To learn more about Social Sign-On with account linking (best practice), refer to [Social Login](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/4172d0a670b21014bbc5a10ce4041860.html).
20
+- **apiKey**: The site API key from the [SAP Customer Data Cloud Dashboard](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Fconsole.gigya.com) Information published on non-SAP site. You can find instructions for generating an API key [here](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/5c7e37ef11fb4422aedb4a9f3b8a4331.html).
21
+- **userKey**: The Application key generated by Creating an Application via the Admin tab of the SAP Customer Data Cloud ConsoleInformation published on non-SAP site.
22
+
23
+### Important details related to using a userKey:
24
+
25
+- When using a userKey you must pass the secret associated with the userKey, not the Account's secret, as another parameter.
26
+- When using a userKey you do not need to sign the request.
27
+- When using a userKey the request must be sent over HTTPS (SSL).
28
+
29
+## Sample Request Over HTTPS
30
+
31
+The following is an example of an HTTPS request using an app/user key and app/user secret:
32
+
33
+```bash
34
+curl -X POST \
35
+https://socialize.us1.gigya.com/socialize.setStatus \
36
+-H 'content-type: application/x-www-form-urlencoded' \
37
+-d 'apiKey=<API-Key>&userKey=<User-Key>&secret=<Secret>&UID=<User-ID>&status=Hello%20World'
38
+```
39
+
40
+# Credentials Need For Configuration
41
+
42
+- API Key
43
+- User Key
44
+- Secret Key
45
+- API Domain (Same as the `Site Domain` in the SAP Customer Data Cloud Dashboard) - See screenshot [here](https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD/8b8d6fffe113457094a17701f63e3d6a/5c7e37ef11fb4422aedb4a9f3b8a4331.html)
frontend/vite.config.mts
+2
-2
@@ -43,8 +43,8 @@ export default defineConfig({
43
: false,
44
proxy: {
45
"/api": {
46
- //target: "http://copilot-backend:5000",
47
- target: "http://127.0.0.1:5000", // for local development
46
+ target: "http://copilot-backend:5000",
47
+ //target: "http://127.0.0.1:5000", // for local development
48
changeOrigin: true
49
}
50
}