cancel
Showing results for 
Search instead for 
Did you mean: 

SAP as ESM Data Source

Jump to solution

Hi

Is possible add SAP as Data Source un ESM 10.3?

Is there any guide?

Thanks

2 Solutions

Accepted Solutions
Reliable Contributor David1111
Reliable Contributor
Report Inappropriate Content
Message 2 of 9

Re: SAP as ESM Data Source

Jump to solution


Hi,

About integrating mcAfee ESM with SAP, read this Commnuity Chat Attached below:

https://community.mcafee.com/t5/Security-Information-and-Event/ESM-Integration-with-SAP/td-p/462280

 

Best Regards

David.

Reliable Contributor David1111
Reliable Contributor
Report Inappropriate Content
Message 8 of 9

Re: SAP as ESM Data Source

Jump to solution

Hi

The McAfee ESM SAP Module periodically queries the SAP tables and writes the events to a text file in a configurable directory or file share. The McAfee Event Receiver then polls and processes the event logs.

Best regards 👍👍👍

David.

8 Replies
Reliable Contributor David1111
Reliable Contributor
Report Inappropriate Content
Message 2 of 9

Re: SAP as ESM Data Source

Jump to solution


Hi,

About integrating mcAfee ESM with SAP, read this Commnuity Chat Attached below:

https://community.mcafee.com/t5/Security-Information-and-Event/ESM-Integration-with-SAP/td-p/462280

 

Best Regards

David.

Re: SAP as ESM Data Source

Jump to solution

Perfect.

Which are the settings in the ESM side to integrate SAP?

Any communication ports?

Thanks

Reliable Contributor David1111
Reliable Contributor
Report Inappropriate Content
Message 4 of 9

Re: SAP as ESM Data Source

Jump to solution

Hi, 

Thank's on the Feedback.

Check this Document - 
https://s-download.mcafee.com/corporate/products/protected/SIEM/SAPConfigFiles/version7/McAfee_ESM_S...

Besides that i see in the Products Download in the McAfee Website, a McAfee SIEM Configuration files for SAP 7.0 

Check that out, Could be you need to install the available scripts provided by McAfee.

 

Best regards. 👌

David.

Highlighted

Re: SAP as ESM Data Source

Jump to solution

Hi.

Thanks for your replay.

First of all, Mcafee provides me an url to download scripts, but the script's names are different to PDF. Also, when I try to download, one of them doesn't download well.

But, what I do after? In the PDF I only read the SAP side, but there isn't information about ERC side. Events come to SIEM by syslog, by file, etc? Do I need any port?

Regards

Reliable Contributor David1111
Reliable Contributor
Report Inappropriate Content
Message 6 of 9

Re: SAP as ESM Data Source

Jump to solution

Hi

in the ESM add a data source on the Vendor field set to SAP

insert the ip address name etc.

it's going to integrate via SYSLOG, so open in Firewall Port 514 (TCP & UDP)

attaching a McAfee kb with the full list of ports you need for each application or technology.

https://kc.mcafee.com/corporate/index?page=content&id=KB84217&actp=null&viewlocale=en_US&locale=en_U...

 

Best regards  👍👍👍

David.

Re: SAP as ESM Data Source

Jump to solution

Hi

Then, I only have to install scripts in SAP and inmediatly I'm going to receive events by syslog, because I'm recieving events log from these servers (linux events)

What's the function of these scripts?

Regards

Reliable Contributor David1111
Reliable Contributor
Report Inappropriate Content
Message 8 of 9

Re: SAP as ESM Data Source

Jump to solution

Hi

The McAfee ESM SAP Module periodically queries the SAP tables and writes the events to a text file in a configurable directory or file share. The McAfee Event Receiver then polls and processes the event logs.

Best regards 👍👍👍

David.

Re: SAP as ESM Data Source

Jump to solution

Ok.

I'm already registring SAP events, but where is this file? What's its name?

I supose that in syslog.conf I've to insert a line with that file to send to the ESM by SYSLOG

Regards

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community