你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

适用于 SAP 应用程序数据连接器代理 `systemconfig.ini` 文件的 Microsoft Sentinel 解决方案参考

项目
12/17/2024
适用于:

Microsoft Sentinel in the Azure portal, Microsoft Sentinel in the Microsoft Defender portal

systemconfig.ini 文件是旧文件，用于在 2023 年 6 月 22 日以前的版本中配置适用于 SAP 的 Microsoft Sentinel 应用程序数据连接器代理的行为。本文介绍了配置文件各个部分中可用的选项。

本文的内容适用于 SAP BASIS 团队。如果使用了门户中推荐的部署过程，则本文不相关。如果从命令行安装了较新版本的代理，请改用适用于 SAP 的 Microsoft Sentinel 解决方案应用程序 systemconfig.json 文件参考。

Systemconfig 配置文件部分

下表描述了 systemconfig.ini 文件中的各个整体部分：

节名称	说明
ABAP 中心实例	本部分定义要连接到的 SAP 实例的常规选项。
ABAP 表选择器	本部分定义从 ABAP 系统中提取哪些用户主数据日志。
Azure 凭证	本部分定义用于连接到 Azure Log Analytics 的凭据。
连接器配置	本部分定义其他连接器选项。
文件提取 ABAP	本部分定义使用 SAPControl 接口从 ABAP 服务器提取的日志和凭据。
文件提取 JAVA	本部分定义使用 SAPControl 接口从 JAVA 服务器提取的日志和凭据。
日志激活状态	本部分定义从 ABAP 中提取的日志。
机密源	本部分定义存储凭据的位置。

ABAP 中心实例

[ABAP Central Instance]
auth_type=PLAIN_USER_AND_PASSWORD|SNC_WITH_X509
# Authentication type - username/password authentication, or X.509 authentication

ashost=<hostname>
# FQDN, hostname, or IP address of the ABAP server

mshost=<hostname>
# FQDN, hostname, or IP address of the Message server

msserv=<portnumber>
# Port number, or service name (from /etc/services) of the message server

group=<logon group>
# Logon group of the message server

sysnr=<Instance number>
# Instance number of the ABAP server

sysid=<SID>
# System ID of the ABAP server

client=<Client Number>
# Client number of the ABAP server

user=<username>
# Username to use to connect to ABAP server. Used only when secrets setting in Secrets Source section is set to DOCKER_FIXED

passwd=<password>
# Password to use to connect to ABAP server. Used only when secrets setting in Secrets Source section is set to DOCKER_FIXED

snc_lib=<path to libsapcrypto>
# Full path, to the libsapcrypto.so
# Used when SNC is in use
# !!! Note: the path must be valid within the container!!!

snc_partnername=<distinguished name of the server certificate>
# p: -prefixed valid SAP server SNC name, which is equal to Distinguished Name(DN) of SAP server PSE
# Used when SNC is in use

snc_qop=<SNC protection level>
# More information available at https://docs.oracle.com/cd/E19509-01/820-5064/ggrpj/index.html
# Used when SNC is in use

snc_myname=<distinguished name of the client certificate>
# p: -prefixed valid client SNC name, which is equal to Distinguished Name(DN) of client PSE
# Used when SNC is in use

x509cert=<server certificate>
# Base64 encoded server certificate value in a single line (with leading ----BEGIN-CERTIFICATE--- and trailing ----END-CERTIFICATE---- removed)

ABAP 表选择器

[ABAP Table Selector]
# Specify True or False to configure whether table should be collected from the SAP system
AGR_TCODES_FULL = <True/False>
USR01_FULL = <True/False>
USR02_FULL = <True/False>
USR02_INCREMENTAL = <True/False>
AGR_1251_FULL = <True/False>
AGR_USERS_FULL = <True/False>
AGR_USERS_INCREMENTAL = <True/False>
AGR_PROF_FULL = <True/False>
UST04_FULL = <True/False>
USR21_FULL = <True/False>
ADR6_FULL = <True/False>
ADCP_FULL = <True/False>
USR05_FULL = <True/False>
USGRP_USER_FULL = <True/False>
USER_ADDR_FULL = <True/False>
DEVACCESS_FULL = <True/False>
AGR_DEFINE_FULL = <True/False>
AGR_DEFINE_INCREMENTAL = <True/False>
PAHI_FULL = <True/False>
AGR_AGRS_FULL = <True/False>
USRSTAMP_FULL = <True/False>
USRSTAMP_INCREMENTAL = <True/False>
SNCSYSACL_FULL = <True/False> (Preview)
USRACL_FULL = <True/False> (Preview)

Azure 凭证

[Azure Credentials]
loganalyticswsid=<workspace ID>
# Log Analytics workspace ID. Used only when secrets setting in Secrets Source section is set to DOCKER_FIXED

publickey=<publickey>
# Log Analytics workspace primary or secondary key. Used only when secrets setting in Secrets Source section is set to DOCKER_FIXED

连接器配置

extractuseremail = <True/False>
apiretry = <True/False>
auditlogforcexal = <True/False>
auditlogforcelegacyfiles = <True/False>
azure_resource_id = <Azure _ResourceId>
# Used to force a specific resource group for the SAP tables in Log Analytics, useful for applying RBAC on SAP data
# example - /subscriptions/1234568-qwer-qwer-qwer-123456789/resourcegroups/RESOURCE_GROUP_NAME/providers/microsoft.compute/virtualmachines/VIRTUAL_MACHINE_NAME
# for more information - https://learn.microsoft.com/azure/azure-monitor/logs/log-standard-columns#_resourceid.

timechunk = <value>
# Default timechunk value is 60 (minutes). For certain tables, the data connector retrieves data from the ABAP server using timechunks (collecting all events that occurred within a certain timestamp). On busy systems this may result in large datasets, so to reduce memory and CPU utilization footprint, consider configuring to a smaller value.

文件提取 ABAP

[File Extraction ABAP]
osuser = <SAPControl username>
# Username to use to authenticate to SAPControl

ospasswd = <SAPControl password>
# Password to use to authenticate to SAPControl

appserver = <server>
#SAPControl server hostname/fqdn/IP address

instance = <instance>
#SAPControl instance name


abapseverity = <severity>
# 0 = All logs ; 1 = Warning ; 2 = Error

abaptz = <timezone>
# GMT FORMAT
# example - For OS Timezone = NZST (New Zealand Standard Time) use abaptz = GMT+12

文件提取 JAVA

[File Extraction JAVA]
javaosuser = <username>
# Username to use to authenticate to JAVA server

javaospasswd = <password>
# Password to use to authenticate to JAVA server

javaappserver = <server>
#JAVA server hostname/fqdn/IP address

javainstance = <instance number>
#JAVA instance number

javaseverity = <severity>
# 0 = All logs ; 1 = Warning ; 2 = Error

javatz = <timezone>
# GMT FORMAT
# example - For OS Timezone = NZST (New Zealand Standard Time) use abaptz = GMT+12

日志激活状态

[Logs Activation Status]
# The following logs are retrieved using RFC interface
# Specify True or False to configure whether log should be collected using the mentioned interface
ABAPAuditLog = <True/False>
ABAPJobLog = <True/False>
ABAPSpoolLog = <True/False>
ABAPSpoolOutputLog = <True/False>
ABAPChangeDocsLog = <True/False>
ABAPAppLog = <True/False>
ABAPWorkflowLog = <True/False>
ABAPCRLog = <True/False>
ABAPTableDataLog = <True/False>
# The following logs are retrieved using SAP Control interface and OS Login
ABAPFilesLogs = <True/False>
SysLog = <True/False>
ICM = <True/False>
WP = <True/False>
GW = <True/False>
# The following logs are retrieved using SAP Control interface and OS Login
JAVAFilesLogs = <True/False>

机密源

secrets=AZURE_KEY_VAULT|DOCKER_FIXED
# Storage location of SAP credentials and Log Analytics workspace ID and key
# AZURE_KEY_VAULT - store in an Azure Key Vault. Requires keyvault option and intprefix option
# DOCKER_FIXED - store in systemconfig.ini file. Requires user, passwd, loganalyticswsid and publickey options

keyvault=<vaultname>
# Azure Keyvault name, in case secrets = AZURE_KEY_VAULT

intprefix=<prefix>
# intprefix - Prefix for variables created in Azure Key Vault

有关详细信息，请参阅：

通过

适用于 SAP 应用程序数据连接器代理 `systemconfig.ini` 文件的 Microsoft Sentinel 解决方案参考

Systemconfig 配置文件部分

ABAP 中心实例

ABAP 表选择器

Azure 凭证

连接器配置

文件提取 ABAP

文件提取 JAVA

日志激活状态

机密源

反馈

其他资源

通过

适用于 SAP 应用程序数据连接器代理 systemconfig.ini 文件的 Microsoft Sentinel 解决方案参考

Systemconfig 配置文件部分

ABAP 中心实例

ABAP 表选择器

Azure 凭证

连接器配置

文件提取 ABAP

文件提取 JAVA

日志激活状态

机密源

相关内容

反馈

其他资源

适用于 SAP 应用程序数据连接器代理 `systemconfig.ini` 文件的 Microsoft Sentinel 解决方案参考