cancel
Showing results for 
Search instead for 
Did you mean: 

ESM Integration with SAP.

Jump to solution

Hi,

We have implemented mcafee ESM as SIEM solution and are trying to integrate SAP with ESM. SAP Version is ECC 6. ESM Version is 9.3.2

The mcafee ESM data source guide for SAP says that mcafee provides transport scripts (K900010.SEC & R900010.SEC)  which are to be loaded in SAP using

using standard SAP procedures. We have been able to do this step and have loaded these scripts in SAP.

However the next step is to change the configurable settings in the SAP Module User Interface and to select one of the following three options:

  1. Read from SAP audit logs
  2. User authorization changes.
  3. User master data changes

However the guide does not clarify how to invoke the configuration page where the options described in the above step are visible and are to be selected.

We are stuck at this step.

kindly help us to proceed

Thanks

Rohit Sharma

1 Solution

Accepted Solutions

Re: ESM Integration with SAP.

Jump to solution

Hi,

I followed the above issue with My Integration partner and Mcafee without any avail.

Finally after analysing the script , our ABAP expert found that the script provided by Mcafee creates a program called ZMCAFEE in the SAP.

This program contains two Transaction codes:

Z_MCAFEE_USER_CHANGES

Z_MCAFEE_ROLE_CHANGES

See the below image


  SAP1.png

You can run the above transaction codes in the SAP command window. These T-Codes generate a report on user changes and role changes.

which can be exported to the file system or desktop.

0 Kudos
4 Replies
edimarco
Level 7

Re: ESM Integration with SAP.

Jump to solution

Hi Rohit,

do you have been able to invoke the configuration page ? How can you do to go forward the procedure?

I have the same doubts.

Thanks

Emanuele

0 Kudos

Re: ESM Integration with SAP.

Jump to solution

Hi,

I followed the above issue with My Integration partner and Mcafee without any avail.

Finally after analysing the script , our ABAP expert found that the script provided by Mcafee creates a program called ZMCAFEE in the SAP.

This program contains two Transaction codes:

Z_MCAFEE_USER_CHANGES

Z_MCAFEE_ROLE_CHANGES

See the below image


  SAP1.png

You can run the above transaction codes in the SAP command window. These T-Codes generate a report on user changes and role changes.

which can be exported to the file system or desktop.

0 Kudos
thuyentv
Level 7

Re: ESM Integration with SAP.

Jump to solution

Hi Support Team,

How to mount to SAP Server (AIX) use NFS version 4.

we do not use mount on Receiver (NFS Client) to NFS Server (SAP Server-AIX).

I know key here NFS domain. But on SIEM we do not use command:

#chnfsdom nfsdomain

bash: chnfsdom: command not found

Please suggest for me this case.

Many thanks support.

0 Kudos
dahmed
Level 7

Re: ESM Integration with SAP.

Jump to solution

Hello All,

I am trying to integrate SAP with SIEM, I have followed the process as mentioned in (McAfee_ESM_SAP_Config_Guide.pdf )

I did run booth the

Z_MCAFEE_USER_CHANGES

Z_MCAFEE_ROLE_CHANGES

It took more than 4 hrs. to complete this,once completed some out has displayed on the screen and saved them.

Zmcafee output.jpg

Now at the SIEM side Data source has added but SAP logs are not coming.

There is no out put in the tcpdump (tcpdump –nni eth1 host x.x.x.x)  too. All though connectivity from SIEM to SAP is fine.

Is am I missing any steps after the job finished, Any one has integrated and prepared some documents than pls. share it.

I also fee that (McAfee_ESM_SAP_Config_Guide.pdf​ is incomplete document for this integration.

Thanks in advance.

Dilnawaz Ahmed

0 Kudos