Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Sap Logserv Overview

4 September 2026Doc update+41 / −6 lines

In brief

The article now explains LogServ stream routing, DCR-based filtering before ingestion, examples for excluding log types, ASIM content reuse, and verification timing after DCR changes.

What Defender admins need to know

Administrators can reduce ingestion costs and control which LogServ data reaches each destination. Existing DCRs are not changed when the solution is upgraded.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

What logs does SAP LogServ provide?

LogServ extends your monitoring scope beyond the SAP application layer to include logs that SAP ECS owns as the system provider. The available log types include sources such as:

Log categoryExamples
Network and securityNetwork, DNS, Proxy, Firewall logs
Third-party databasesNon-HANA database logs where applicable

Always check with SAP for the latest available log types and any updates to supported log sources using their Service Description Document.

  • Near real-time log collection with agentless integration into Microsoft Sentinel via the SAP LogServ data connector.
  • Built-in security content including analytics rules and workbooks provided by SAP for LogServ-specific log types.
  • Activationand reuse of Microsoft Advanced Security Information Model (ASIM) security content
  • Long-term retention configurable per data source with up to 12 years retention using Microsoft Sentinel Data Lake.
  • SOAR integration with Microsoft Sentinel's security orchestration, automation, and response capabilities, including and SAP user blocking via Microsoft Teams.
  • Cross-signal correlation across endpoints, Microsoft Entra ID data, and other data sources in your Microsoft Sentinel workspace.
  • The SAP LogServ (RISE), S/4HANA Cloud private edition solution installed from the Microsoft Sentinel Content Hub.

Deploy the solution

For more information on how to customize and use the workbook, see Tutorial: Visualize and monitor your data.

Built-in analyticsanalytic rules

The SAP LogServ solution and the Microsoft Sentinel Solution for SAP applications each provide analytics rules that target different layers of the SAP RISE stack:

  • SAP LogServ analytics rules: Focus on infrastructure-layer detections, such asincluding SAP HANA database audit trail deactivation, OS-leveloperating system anomalies, network activity, and firewall events, and other logsevents from SAP-managed infrastructure. TheseThrough ASIM normalization, customers can benefit from existing Microsoft Advanced Security Information Model (ASIM) security content and investments they already have in place, without creating SAP RISE-specific analytics rules are installed with the SAP LogServ solution from the Content Hub.or altering existing security operations processes.

  • Microsoft Sentinel Solution for SAP applications analytics rules: Cover the application layer, including 60+ built-in rules for detecting privilege escalation, sensitive transactions, data exfiltration, and unauthorized user activity within the SAP business logic.

Deploy both solutions together for cross-layer detection coverage spanning from SAP HANA database and OS infrastructure up through the SAP application layer.

The following example shows aan isolated SAP LogServ infrastructure-layer detection for a HANA database audit trail deactivation in Microsoft Sentinel, surfaced as an incident in Microsoft Defender portal:portal. Find a end-to-end scenario in this social engineering attack replay.

:::image type="content" source="./media/partner/logserv-hana-db-detection.png" alt-text="Screenshot of a SAP LogServ HANA DB - Deactivation of Audit Trail incident in Microsoft Defender." lightbox="./media/partner/logserv-hana-db-detection.png":::

Filter LogServ logs before ingestion

Not every log type that SAP LogServ forwards needs to land in your Analytics tier. Filtering happens in the Data Collection Rule (DCR) that the connector deploys, so excluded records are dropped before ingestion and don't incur ingestion cost.

The DCR routes records to several streams based on the clz_dir and clz_subdir attributes supplied by LogServ. For example:

Source (clz_dir / clz_subdir)Destination
windows / securitySecurityEvent
windows / anything elseWindowsEvent
linux (selected sublogs), hana / hanaauditSyslog
dnsASimDnsActivityLogs
webdispatcher / accesslog, denylogASimWebSessionLogs
everything elseSAPLogServ_CL (catch-all)

For filtering, identify and remove or narrow the data flow that selects the log type you want to exclude.

For example, to exclude SAP HANA database logs, delete the data flow that selects clz_dir == "hana". For the current data flow definitions, see the SAPLogServ_DCR.json in the Microsoft Sentinel GitHub repository.

Edit the DCR with the transformation editor in the Azure portal, the ARM template export, or the Data Connectors REST API. We recommend that you export the current configuration first and use it as your working template, so you only replace the dataFlows section.

Related content