Scribd Logo
Upload

Welcome to Scribd!

  • 38 views

    SAP Configuration 30

    Uploaded by

    vijay konduru
    This document is a user guide for version 14.7 of Database Activity Monitoring for SAP transactions. It provides instructions on: 1. Configuring the SecureSphere gateway to properly monitor SAP activity. 2. Defining SAP transactions of interest through data enrichment policies to extract transaction codes from SQL statements. 3. Creating audit policies to monitor for the defined SAP transactions and view audited activity.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    SAP Configuration 30

    Uploaded by

    vijay konduru
    38 views12 pages
    This document is a user guide for version 14.7 of Database Activity Monitoring for SAP transactions. It provides instructions on: 1. Configuring the SecureSphere gateway to properly monitor SAP activity. 2. Defining SAP transactions of interest through data enrichment policies to extract transaction codes from SQL statements. 3. Creating audit policies to monitor for the defined SAP transactions and view audited activity.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document is a user guide for version 14.7 of Database Activity Monitoring for SAP transactions. It provides instructions on: 1. Configuring the SecureSphere gateway to properly monitor SAP activity. 2. Defining SAP transactions of interest through data enrichment policies to extract transaction codes from SQL statements. 3. Creating audit policies to monitor for the defined SAP transactions and view audited activity.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    38 views12 pages

    SAP Configuration 30

    Uploaded by

    vijay konduru
    This document is a user guide for version 14.7 of Database Activity Monitoring for SAP transactions. It provides instructions on: 1. Configuring the SecureSphere gateway to properly monitor SAP activity. 2. Defining SAP transactions of interest through data enrichment policies to extract transaction codes from SQL statements. 3. Creating audit policies to monitor for the defined SAP transactions and view audited activity.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 12

    v14.

    7 Database Activity Monitoring User Guide

    v14.7 Database Activity Monitoring User


    Guide

    v14.7 Database Activity Monitoring User Guide 1


    Contents

    Contents
    SAP Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
    Configuring the SecureSphere Gateway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
    Monitoring SAP Transactions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
    Defining SAP Transactions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
    Configuring SAP Transactions for use in SecureSphere. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
    Configure Data Enrichment Policy for SAP Transaction Detection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
    Configure an Audit Policy for Auditing SAP Transactions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
    Viewing SAP Transactions in Audit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
    Other Audit Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
    Database Table Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

    v14.7 Database Activity Monitoring User Guide


    v14.7 Database Activity Monitoring User Guide

    SAP Configuration
    This section describes issues related to SAP configuration in Imperva SecureSphere, including:

    • Configuring the SecureSphere Gateway


    • Monitoring SAP Transactions
    • Defining SAP Transactions
    • Other Audit Policies
    • Database Table Groups

    v14.7 Database Activity Monitoring User Guide 3


    v14.7 Database Activity Monitoring User Guide

    Configuring the SecureSphere Gateway


    SAP applications access the database in a unique way, which requires that SecureSphere be configured appropriately.

    To configure the SecureSphere Gateway:

    1. Edit (using a text editor) the file /opt/SecureSphere/etc/hades.cfg.template on the Gateway as


    follows:
    ◦ Change the value of the parameter sql_max_template_events to 500
    2. Restart the SecureSphere Gateway using the following command:

    impctl gateway restart

    v14.7 Database Activity Monitoring User Guide 4


    v14.7 Database Activity Monitoring User Guide

    Monitoring SAP Transactions


    SAP includes many thousands of pre-defined transactions, each of which defines a logical business unit of work, to
    accomplish specific tasks. SAP DBA’s, programmers, users and auditors are accustomed to working at the transaction
    level rather than at the SQL statement level, and need to monitor, track and audit SAP applications at the SAP
    transaction level.

    In addition to the option of monitoring SAP applications at the level of SQL statement, Imperva SecureSphere
    monitors SAP applications at the level of SAP transactions, enabling SAP administrators to audit SAP transaction
    activity directly.

    Monitoring an application requires the ability to perform the following tasks:

    Monitoring Task Overview

    Task Overview Description For more information, see

    A list of sensitive SAP transactions which access


    Define events of
    sensitive data such as user roles and
    interest, that is, the
    authorizations, system monitoring, auditing etc. The SecureSphere Admin Guide
    events to be
    Users can also define additional SAP transactions
    monitored
    to be tracked.

    Two pre-defined audit policies audit these SAP


    Identify these
    transactions, and users can edit these policies  
    events as they occur
    and define new ones

    React to the events:


    Administrators can define reports based on the
    audit, alert, report, Reporting
    collected audit data.
    etc

    v14.7 Database Activity Monitoring User Guide 5


    v14.7 Database Activity Monitoring User Guide

    Defining SAP Transactions


    Imperva SecureSphere includes a list of sensitive SAP transactions, defined in SecureSphere as elements of a
    privileged operations group.

    SecureSphere administrators cannot make changes to this list, but they can add SAP transactions to the User Defined
    Privileged Operations Group and include these transactions in auditing and reporting.

    v14.7 Database Activity Monitoring User Guide 6


    v14.7 Database Activity Monitoring User Guide

    Configuring SAP Transactions for use in SecureSphere

    Because SecureSphere uses the privileged operations mechanism to identify SAP transactions, you must create a data
    enrichment policy to extract the SAP transactions from the SQL which is then recognized by SecureSphere as a
    privileged operation.

    Note: This solution applies to SAP ECC 6.0.

    The following table lists the main tasks that need to be conducted to configure SAP Transactions for use in
    SecureSphere:

      Action Description For more information, see

    Configuring Data Enrichment Define a Data Enrichment policy to Configure Data Enrichment Policy
    1
    Policies extract SAP Literals from SQL for SAP Transaction Detection

    Define an audit policy that will


    Configure an Audit Policy for
    2 Define an Audit Policy only audit the transactions defined
    Auditing SAP Transactions
    using the data enrichment policy

    Configure an audit view to display


    3 View audited transactions SAP transactions and save it as a Viewing SAP Transactions in Audit
    report for future reference.

    v14.7 Database Activity Monitoring User Guide 7


    v14.7 Database Activity Monitoring User Guide

    Configure Data Enrichment Policy for SAP Transaction Detection

    To configure a Data Enrichment Policy for SAP SQL Transactions:

    1. In the Main workspace, select Policies > Data Enrichment.


    2. In the Create New Policy window, click New, type a Name, and from Type select DB Service Enrichment, then
    click Create.
    3. On the Rules tab, create a new User Defined Field, under Target Field Name type SAP-T-Code, select the From
    Event SQL extraction method, then click Save. The field becomes expandable.
    4. Expand the item you just added, under Extract Literal #, type 3, and in the From Query field, type:

    select "devclass" from "tadir" where "pgmid" = ? and "object" = ? and


    "obj_name" = ?

    5. Expand the Additional Conditions option, in the when Literal # field, type 2. In the second field after is, type
    TRAN.
    6. In the Apply to tab, select the database service on which the SAP application is running, for example Oracle.
    7. Click Save.

    Once you have completed configuring the data enrichment policy to extract the required fields, you need to
    configure an Audit policy to audit this traffic as described in Configure an Audit Policy for Auditing SAP
    Transactions.

    v14.7 Database Activity Monitoring User Guide 8


    v14.7 Database Activity Monitoring User Guide

    Configure an Audit Policy for Auditing SAP Transactions

    Once you have created a data enrichment policy to extract the literals needed to audit SAP transactions, you need to
    configure an audit policy.

    To configure an Audit Policy to view SAP SQL extraction:

    1. In the Main workspace, select Policies > Audit.


    2. In the Create New Policy window, click New, type an intuitive Name such as SAP SQL Transactions, from Type
    select Database, then click Create.
    3. On the Match Criteria tab, add the Destinations Table criteria by clicking its Green Arrow .
    4. Expand the criteria and add the table tadir, to the selected pane.
    5. On the Match Criteria tab, add the Enrichment Data criteria by clicking its Green Arrow .
    6. Expand the criteria,
    ◦ Under User Defined Field type SAP-T-Code
    ◦ In the Operation field select Exclude All, and under User Defined, click new then type TXX. This tells the
    audit policy to filter only events with enrichment data on the SAP-T-Code field.
    7. On the Settings tab, under User Defined 1, select SAP-T-Code.
    8. In the Apply to tab, apply the policy to the appropriate SAP database server and save it.

    v14.7 Database Activity Monitoring User Guide 9


    v14.7 Database Activity Monitoring User Guide

    Viewing SAP Transactions in Audit

    Once you have configured a data enrichment policy to extract SAP data and an audit policy to audit this data, you can
    view SAP transactions in the audit window.

    To view SAP transactions in the audit window:

    1. In the Main workspace, select Audit > DB Audit Data.


    2. In the Views pane, select the Data view.
    3. In the upper right-hand corner of the main audit window, under Select Field, choose User Defined 1.

    4. Select a row in the resulting data, then click Retrieve Event Data.
    5. To save this view for easy access, click Save as Report .

    v14.7 Database Activity Monitoring User Guide 10


    v14.7 Database Activity Monitoring User Guide

    Other Audit Policies


    You can define additional audit policies for SAP transactions, using the “SAP - Transactions” audit policy as a model.
    However, you should note that if you add one of the individual SAP transactions listed under Privileged Operations to
    the Selected list, the individual SAP transaction will be audited twice, because “SAP Transaction” includes all SAP
    transactions. In this case, remove “SAP Transaction” from the Selected list.

    v14.7 Database Activity Monitoring User Guide 11


    v14.7 Database Activity Monitoring User Guide

    Database Table Groups


    For SAP, SecureSphere defines a number of Database Table Groups. For SAP versions prior to ECC 6.0 (4.6. 4.7 and 5.0),
    the tables relevant to each group have different names in SAP.

    Note: The information given here relates to the default SAP configuration. If you changed
    table names during configuration, you must also modify these objects accordingly (see
    below).

    If you are using one of these versions, you must:

    1. Manually create a Database Table Group for this purpose.


    2. Associate the Database Table Group with the SAP application.
    3. Clone the different audit and security policies which use the Database Table Groups and replace those default
    Database Table Groups with the ones you have just created.

    To manually create a Database Table Group for ECC 4.6, 4.7 and SAP 5.0:

    1. In the Main workspace, select Setup > Global Objects.


    2. Under DB-Related Objects, right-click on Database Table Groups.
    3. Select Create Database Table Group from the menu.
    4. In the Create Database Table Group window, enter a Name.
    5. Select the relevant database services.

    To associate the Database Table Group with the SAP application:

    1. In the Main workspace, select Setup > Sites.


    2. Navigate to the SAP application.
    3. In the Definitions tab, add the Database Table Group.

    v14.7 Database Activity Monitoring User Guide 12

    You might also like