4 Replies Latest reply on Sep 8, 2016 7:50 AM by dahmed

    ESM Integration with SAP.

    rohitsharma79

      Hi,

      We have implemented mcafee ESM as SIEM solution and are trying to integrate SAP with ESM. SAP Version is ECC 6. ESM Version is 9.3.2

       

      The mcafee ESM data source guide for SAP says that mcafee provides transport scripts (K900010.SEC & R900010.SEC)  which are to be loaded in SAP using

      using standard SAP procedures. We have been able to do this step and have loaded these scripts in SAP.

       

      However the next step is to change the configurable settings in the SAP Module User Interface and to select one of the following three options:

      1. Read from SAP audit logs
      2. User authorization changes.
      3. User master data changes

       

      However the guide does not clarify how to invoke the configuration page where the options described in the above step are visible and are to be selected.

      We are stuck at this step.

       

      kindly help us to proceed

       

       

      Thanks

       

      Rohit Sharma

        • 1. Re: ESM Integration with SAP.
          edimarco

          Hi Rohit,

           

          do you have been able to invoke the configuration page ? How can you do to go forward the procedure?

           

          I have the same doubts.

           

          Thanks

          Emanuele

          • 2. Re: ESM Integration with SAP.
            rohitsharma79

            Hi,

            I followed the above issue with My Integration partner and Mcafee without any avail.

            Finally after analysing the script , our ABAP expert found that the script provided by Mcafee creates a program called ZMCAFEE in the SAP.

            This program contains two Transaction codes:

            Z_MCAFEE_USER_CHANGES

            Z_MCAFEE_ROLE_CHANGES

             

             

            See the below image

             


              SAP1.png

             

             

             

            You can run the above transaction codes in the SAP command window. These T-Codes generate a report on user changes and role changes.

            which can be exported to the file system or desktop.

            • 3. Re: ESM Integration with SAP.
              thuyentv

              Hi Support Team,

              How to mount to SAP Server (AIX) use NFS version 4.

              we do not use mount on Receiver (NFS Client) to NFS Server (SAP Server-AIX).

              I know key here NFS domain. But on SIEM we do not use command:

              #chnfsdom nfsdomain

              bash: chnfsdom: command not found

               

              Please suggest for me this case.

              Many thanks support.

              • 4. Re: ESM Integration with SAP.
                dahmed

                Hello All,

                 

                I am trying to integrate SAP with SIEM, I have followed the process as mentioned in (McAfee_ESM_SAP_Config_Guide.pdf )

                I did run booth the

                Z_MCAFEE_USER_CHANGES

                Z_MCAFEE_ROLE_CHANGES

                 

                It took more than 4 hrs. to complete this,once completed some out has displayed on the screen and saved them.

                Zmcafee output.jpg

                Now at the SIEM side Data source has added but SAP logs are not coming.

                There is no out put in the tcpdump (tcpdump –nni eth1 host x.x.x.x)  too. All though connectivity from SIEM to SAP is fine.

                 

                Is am I missing any steps after the job finished, Any one has integrated and prepared some documents than pls. share it.

                 

                I also fee that (McAfee_ESM_SAP_Config_Guide.pdf is incomplete document for this integration.

                 

                Thanks in advance.

                Dilnawaz Ahmed