Skip to main content

Does anyone know how these logs could be ingested in SecOps?

I’ve noticed that there is a log type for SAP Business Technology Platform, but I couldn’t find the SAP_BTP log type when trying to configure a Third Party API SIEM Feed.

Also, Bindplane doesn’t seem to have a “Source” for this solution.

Hello, It will need  custom solution that would involve the below 2 steps at a high level since SecOps and Bindplane don't offer a direct integration.

 

  1. Configure the SAP BTP application to generate the audit logs https://help.sap.com/docs/btp/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment#create-instance-of-the-auditlog-management-service
  2. Use the SecOps ingestion script for log ingestion: Sample ingestion scripts that leverage GCP cloud run can be found below. You can deploy something similar in AWS Lambda. You will  need to update the ingestion scripts so that the underlined code can make calls to SAP BTP API and then push logs to SecOps. I would advise to use the ingestion script that we have for BOX since that API endpoint also uses Oauth . Please note that these ingestion scripts are provided for reference and no additional support will be offered by us to update or deploy these for customer  specific  usecase. https://cloud.google.com/chronicle/docs/ingestion/ingest-using-cloud-functions

 

Alternately you can also write a simple python program that runs at a scheduled interval, reads the logs from SAP BTP API and writes them to a GCS or AWS bucket. You can then pull the logs into SecOps from these buckets  using Feed management.