Merge pull request #15042 from MartinPankraz/feature/sap-tools-readme-audit-log-smoke-test

Feature/sap tools readme audit log smoke test

Author: v-atulyadav

Solutions/SAP/Tools/IntegrationSuite/AUDIT-LOG-SMOKE-TEST.md

@@ -0,0 +1,76 @@
+# SAP Security Audit Log Smoke Test — Simulate RFC Call via SAP GUI
+
+This guide describes a quick, manual smoke test you can run **directly on the SAP backend** to confirm that the Security Audit Log RFC used by the agentless SAP data connector is working correctly — before raising a support ticket with Microsoft and/or SAP.
+
+## Purpose
+
+The agentless SAP connector (SAP Integration Suite / SAPCC connector) reads Security Audit Log data from the SAP backend via the `RSAU_API_GET_LOG_DATA` **remote-enabled** function module (RFC). If audit log data (`ABAPAuditLog`) is missing or delayed in Microsoft Sentinel, the fastest way to isolate whether the issue is on the SAP side or the connector side is to call this function module manually using SAP GUI transaction code `SE37`. If the manual call also returns no data (or errors), the issue is on the SAP side (e.g., Security Audit Log not active, no events in the time window, authorization issue, bugs in support package of the SAP Basis release) and should be investigated with SAP first. If the manual call succeeds and returns records, but data still doesn't appear in Sentinel, the issue is more likely in the connector/pipeline.
+
+## Prerequisites
+
+- SAP GUI access to the relevant SAP system with an account that has developer/admin authorization to run `SE37` and test function modules.
+- Knowledge of the SAP client (mandant) number used by the connector.
+
+## Steps
+
+### 1. Open the function module in SE37
+
+On SAPGUI, run transaction `SE37` and enter `RSAU_API_GET_LOG_DATA` as the
+function module. Click **Execute** (the Test/Execute icon highlighted below).
+
+![SE37 - Function Builder initial screen, RSAU_API_GET_LOG_DATA entered](media/01-se37-function-module.jpg)
+
+This opens the **Test Function Module: Initial Screen**, listing the import parameters
+(`IS_INTERVAL`, `IT_R_MSG`, `IT_R_MANDT`, `IT_R_USER`, `IT_R_TCD`, `IT_R_REPS`,
+`IT_R_INSTANCE`):
+
+![Test Function Module initial screen with import parameters](media/02-test-function-module-initial.jpg)
+
+### 2. Set the time window (IS_INTERVAL)
+
+Click on the value of `IS_INTERVAL` to edit the time window of the audit log query.
+Enter a narrow window to mimic the connectors behavior and avoid too large data set selections (e.g., 1 minute) in the `DAT_FROM` / `DAT_TO` / `TIM_FROM` /
+`TIM_TO` fields, then click the **Insert Date** (copy) button to confirm the entry.
+
+> [!NOTE]
+> The required date format on the input field may vary based on your language settings.
+
+![Editing IS_INTERVAL to a 1-minute time window](media/03-is-interval-time-window.jpg)
+
+### 3. Filter by SAP client (IT_R_MANDT)
+
+Back on the function module screen, edit the value of `IT_R_MANDT` to filter by your SAP
+client: `S = I`, `OP = EQ`, `LOW = <your client>` (e.g., `001`). Click the exit/back
+button to save the entry.
+
+![Setting IT_R_MANDT client filter](media/04-it-r-mandt-client-filter.jpg)
+
+### 4. Execute and review results
+
+Click **Execute** to run the audit log query. Record the **runtime** and the **number of
+records returned** (`ET_LOG` entry count) — these confirm whether the SAP backend can
+generate and return audit log data for the requested window.
+
+> [!IMPORTANT]
+> A runtime of more than 3 minutes for a single minute time window indicate performance issues on the SAP backend. Consult the [performance guide](https://learn.microsoft.com/azure/sentinel/sap/sap-deploy-troubleshoot#long-message-processing-times-or-message-volume-anomalies-on-sap-cloud-integration) for troubleshooting steps. Consult SAP's notes for optimized audit log retrieval.
+> - 3726943 - RSAU_API_GET_LOG_DATA | Dataselection only from Filesystem details
+> - 3407647 - RSAU_READ_LOG | Optimization of reading audit log files
+
+![Result screen showing runtime](media/05-execute-result-runtime.jpg)
+
+![Result screen showing export parameters, ET_LOG and ET_RETURN entry counts](media/06-execute-result-records.jpg)
+
+## Before opening a support ticket
+
+Use the results of this smoke test as evidence when engaging support:
+
+- [ ] Security Audit Log is active and required message classes are being recorded on the SAP system for the tested time window (confirm via `RSAU_CONFIG` / `SM19` if `ET_LOG` returns 0 entries).
+- [ ] `IT_R_MANDT` client filter matches the client configured in the connector/destination.
+- [ ] Note the runtime and record count (`ET_LOG` entries) returned by the RFC call.
+- [ ] Check `ET_RETURN` for any warning/error messages from the function module.
+- [ ] If records **are** returned here but do **not** appear in Sentinel's `ABAPAuditLog` table for the same time window, the issue is likely in the connector/pipeline
+- [ ] If records are **not** returned here (and Security Audit Log is confirmed active), the issue is on the SAP backend side — investigate with your **SAP** Basis/Security team first. Start with SAP notes listed on the [prerequisites page on Microsoft Learn](https://learn.microsoft.com/azure/sentinel/sap/prerequisites-for-deploying-sap-continuous-threat-monitoring#sap-prerequisites-for-the-agentless-data-connector).
+
+## Related
+
+- [IntegrationSuite README](README.md) — connector onboarding scripts and architecture.

Solutions/SAP/Tools/IntegrationSuite/IntegrationSuiteHelpers.ps1

@@ -2,6 +2,12 @@
 # Shared helper functions for SAP Integration Suite Sentinel Connector scripts
 # This module provides common functionality for Azure authentication, DCR/DCE management,
 # and data connector operations for SAP Integration Suite integration with Microsoft Sentinel.
+#
+# NAMING CONVENTION (must match Azure portal deployed resources, downstream tooling depends on it):
+#   Data Collection Rule     : Microsoft-Sentinel-SAPCC-DCR-<first 12 chars of workspace GUID>
+#   Data Collection Endpoint : ASI-<full workspace GUID>
+# Both names are derived from the Log Analytics workspace ID (customerId) and are enforced
+# through Get-SapccDcrName / Get-SapccDceName and Assert-SapccResourceName.
 
 # Function to log messages with colored output
 function Write-Log {
@@ -16,6 +22,116 @@ function Write-Log {
     Write-Host "[$timestamp] [$Level] $Message" -ForegroundColor $color
 }
 
+#region SAPCC resource naming convention
+
+# Prefixes and patterns for the enforced SAP Cloud Connector / Integration Suite naming convention
+$script:SapccDcrNamePrefix = "Microsoft-Sentinel-SAPCC-DCR-"
+$script:SapccDceNamePrefix = "ASI-"
+$script:SapccDcrNamePattern = '^Microsoft-Sentinel-SAPCC-DCR-[0-9a-f]{8}-[0-9a-f]{3}$'
+$script:SapccDceNamePattern = '^ASI-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+
+# Function to normalize and validate a workspace GUID (Log Analytics customerId)
+function Get-NormalizedWorkspaceId {
+    param(
+        [Parameter(Mandatory=$true)]
+        [string]$WorkspaceId
+    )
+
+    $normalized = $WorkspaceId.Trim().ToLowerInvariant()
+
+    $parsed = [Guid]::Empty
+    if (-not [Guid]::TryParse($normalized, [ref]$parsed)) {
+        Write-Log "Workspace ID '$WorkspaceId' is not a valid GUID. Cannot build SAPCC resource names." -Level "ERROR"
+        throw "Invalid workspace ID '$WorkspaceId'. A GUID is required to enforce the SAPCC naming convention."
+    }
+
+    return $parsed.ToString("D").ToLowerInvariant()
+}
+
+# Function to build the Data Collection Rule name: Microsoft-Sentinel-SAPCC-DCR-<first 12 chars of workspace GUID>
+function Get-SapccDcrName {
+    param(
+        [Parameter(Mandatory=$true)]
+        [string]$WorkspaceId
+    )
+
+    $normalized = Get-NormalizedWorkspaceId -WorkspaceId $WorkspaceId
+    $name = "$($script:SapccDcrNamePrefix)$($normalized.Substring(0, 12))"
+
+    Assert-SapccResourceName -Name $name -Type "DCR"
+    return $name
+}
+
+# Function to build the Data Collection Endpoint name: ASI-<full workspace GUID>
+function Get-SapccDceName {
+    param(
+        [Parameter(Mandatory=$true)]
+        [string]$WorkspaceId
+    )
+
+    $normalized = Get-NormalizedWorkspaceId -WorkspaceId $WorkspaceId
+    $name = "$($script:SapccDceNamePrefix)$normalized"
+
+    Assert-SapccResourceName -Name $name -Type "DCE"
+    return $name
+}
+
+# Function to test a resource name against the enforced convention
+function Test-SapccResourceName {
+    param(
+        [Parameter(Mandatory=$true)]
+        [AllowEmptyString()]
+        [string]$Name,
+        [Parameter(Mandatory=$true)]
+        [ValidateSet("DCR", "DCE")]
+        [string]$Type
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Name)) {
+        return $false
+    }
+
+    $pattern = if ($Type -eq "DCR") { $script:SapccDcrNamePattern } else { $script:SapccDceNamePattern }
+    return $Name -match $pattern
+}
+
+# Function to get the expected name format for error messages
+function Get-SapccExpectedNameFormat {
+    param(
+        [Parameter(Mandatory=$true)]
+        [ValidateSet("DCR", "DCE")]
+        [string]$Type
+    )
+
+    if ($Type -eq "DCR") {
+        return "Microsoft-Sentinel-SAPCC-DCR-<first 12 chars of workspace GUID> (e.g. Microsoft-Sentinel-SAPCC-DCR-befd8617-c90)"
+    }
+
+    return "ASI-<full workspace GUID> (e.g. ASI-befd8617-c90d-40e8-82f4-4e79d3e4c92b)"
+}
+
+# Function to enforce the naming convention, throwing on any deviation
+function Assert-SapccResourceName {
+    param(
+        [Parameter(Mandatory=$true)]
+        [AllowEmptyString()]
+        [string]$Name,
+        [Parameter(Mandatory=$true)]
+        [ValidateSet("DCR", "DCE")]
+        [string]$Type
+    )
+
+    if (Test-SapccResourceName -Name $Name -Type $Type) {
+        return
+    }
+
+    $expected = Get-SapccExpectedNameFormat -Type $Type
+    Write-Log "$Type name '$Name' violates the required naming convention. Expected: $expected" -Level "ERROR"
+    throw "$Type name '$Name' violates the required SAPCC naming convention. Expected: $expected"
+}
+
+#endregion
+
 # Function to check if Azure CLI is installed
 function Test-AzCli {
     try {
@@ -208,9 +324,9 @@ function Get-SentinelWorkspaceDetails {
 
         $response = Invoke-RestMethod -Uri $uri -Method Get -Headers $headers
 
-        # Extract a short ID from workspace ID for naming (first 12 chars of last GUID segment)
-        $workspaceId = $response.properties.customerId
-        $shortId = $workspaceId.Substring(0, [Math]::Min(12, $workspaceId.Length))
+        # Extract a short ID from workspace ID for naming (first 12 chars of the workspace GUID)
+        $workspaceId = Get-NormalizedWorkspaceId -WorkspaceId $response.properties.customerId
+        $shortId = $workspaceId.Substring(0, 12)
 
         Write-Log "Workspace details retrieved successfully" -Level "SUCCESS"
         Write-Log "  Location: $($response.location)"
@@ -239,14 +355,14 @@ function Get-OrCreateSapccDataCollectionEndpoint {
         [Parameter(Mandatory=$true)]
         [string]$ResourceGroupName,
         [Parameter(Mandatory=$true)]
-        [string]$WorkspaceShortId,
+        [string]$WorkspaceId,
         [Parameter(Mandatory=$true)]
         [string]$Location
     )
 
     try {
-        # DCE naming convention: Microsoft-Sentinel-SAPCC-{workspace-short-id}
-        $dceName = "Microsoft-Sentinel-SAPCC-$WorkspaceShortId"
+        # DCE naming convention: ASI-{full workspace GUID}
+        $dceName = Get-SapccDceName -WorkspaceId $WorkspaceId
 
         Write-Log "Checking for existing Data Collection Endpoint '$dceName'..."
 
@@ -339,6 +455,9 @@ function Get-DataCollectionEndpointById {
         $dceName = $DataCollectionEndpointId.Split('/')[-1]
 
         Write-Log "Found DCE '$dceName'" -Level "SUCCESS"
+        if (-not (Test-SapccResourceName -Name $dceName -Type "DCE")) {
+            Write-Log "DCE '$dceName' does not follow the required naming convention: $(Get-SapccExpectedNameFormat -Type 'DCE'). Existing ingestion is left untouched, but downstream tooling may not recognize this resource." -Level "WARNING"
+        }
         Write-Log "  Logs Ingestion Endpoint: $($response.properties.logsIngestion.endpoint)"
 
         return @{
@@ -416,7 +535,7 @@ function Get-OrCreateSapccDataCollectionRule {
         [Parameter(Mandatory=$true)]
         [string]$ResourceGroupName,
         [Parameter(Mandatory=$true)]
-        [string]$WorkspaceShortId,
+        [string]$WorkspaceId,
         [Parameter(Mandatory=$true)]
         [string]$WorkspaceResourceId,
         [Parameter(Mandatory=$false)]
@@ -426,8 +545,8 @@ function Get-OrCreateSapccDataCollectionRule {
     )
 
     try {
-        # DCR naming convention: Microsoft-Sentinel-SAPCC-DCR-{workspace-short-id}
-        $dcrName = "Microsoft-Sentinel-SAPCC-DCR-$WorkspaceShortId"
+        # DCR naming convention: Microsoft-Sentinel-SAPCC-DCR-{first 12 chars of workspace GUID}
+        $dcrName = Get-SapccDcrName -WorkspaceId $WorkspaceId
 
         Write-Log "Checking for existing Data Collection Rule '$dcrName'..."
 
@@ -473,6 +592,10 @@ function Get-OrCreateSapccDataCollectionRule {
             return $null
         }
 
+        # The referenced DCE must follow the naming convention, otherwise downstream processing breaks
+        $referencedDceName = $DataCollectionEndpointId.Split('/')[-1]
+        Assert-SapccResourceName -Name $referencedDceName -Type "DCE"
+        
         # Load DCR schema from SAPCC_DCR.json
         $dcrProperties = Get-SapccDcrTemplate -WorkspaceResourceId $WorkspaceResourceId -DataCollectionEndpointId $DataCollectionEndpointId
 

Solutions/SAP/Tools/IntegrationSuite/README.md

@@ -26,6 +26,11 @@ These standard tables integrate natively with the Microsoft Sentinel Solution fo
 - **CSV-based destination management**: Process multiple SAP destinations from a CSV file
 - **Automatic connection naming**: Connections are named `{ConnectionPrefix}-{DestinationName}`
 - **Shared infrastructure**: Single DCE/DCR shared across all connections
+- **Enforced DCE/DCR naming**: Names are derived from the Log Analytics workspace ID and validated, so they always match Azure portal deployed resources:
+  - DCR: `Microsoft-Sentinel-SAPCC-DCR-<first 12 chars of workspace GUID>`
+  - DCE: `ASI-<full workspace GUID>`
+
+  The scripts abort with a clear error if a name (or a supplied DCE reference) violates this convention, because downstream processes depend on it.
 
 ## Files
 
@@ -37,6 +42,7 @@ These standard tables integrate natively with the Microsoft Sentinel Solution fo
 | `IntegrationSuiteHelpers.ps1` | Shared helper functions for Azure, DCR/DCE, CSV processing, and CF operations |
 | `SAPCC_DCR.json` | Data Collection Rule template with SAP data streams |
 | `destinations-sample.csv` | Sample CSV file showing expected destination format |
+| [`AUDIT-LOG-SMOKE-TEST.md`](AUDIT-LOG-SMOKE-TEST.md) | Manual smoke test to validate the Security Audit Log RFC on the SAP backend before raising a support ticket |
 
 ## Architecture
 

Solutions/SAP/Tools/IntegrationSuite/connect-sentinel-to-integration-suite.ps1

@@ -270,7 +270,7 @@ if ($null -eq $workspaceDetails) {
 $dcrInfo = Get-OrCreateSapccDataCollectionRule `
     -SubscriptionId $SubscriptionId `
     -ResourceGroupName $ResourceGroupName `
-    -WorkspaceShortId $workspaceDetails.ShortId `
+    -WorkspaceId $workspaceDetails.WorkspaceId `
     -WorkspaceResourceId $workspaceDetails.ResourceId `
     -Location $workspaceDetails.Location
 
@@ -289,7 +289,7 @@ if ($null -eq $dceInfo) {
     $dceInfo = Get-OrCreateSapccDataCollectionEndpoint `
         -SubscriptionId $SubscriptionId `
         -ResourceGroupName $ResourceGroupName `
-        -WorkspaceShortId $workspaceDetails.ShortId `
+        -WorkspaceId $workspaceDetails.WorkspaceId `
         -Location $workspaceDetails.Location
 
     if ($null -eq $dceInfo) {
@@ -301,7 +301,7 @@ if ($null -eq $dceInfo) {
     $dcrInfo = Get-OrCreateSapccDataCollectionRule `
         -SubscriptionId $SubscriptionId `
         -ResourceGroupName $ResourceGroupName `
-        -WorkspaceShortId $workspaceDetails.ShortId `
+        -WorkspaceId $workspaceDetails.WorkspaceId `
         -WorkspaceResourceId $workspaceDetails.ResourceId `
         -DataCollectionEndpointId $dceInfo.ResourceId `
         -Location $workspaceDetails.Location