Custom KQL parser functions for Microsoft Sentinel for SAP log tables populated by the community integration flows.
| Parser | Function Name | Description |
|---|---|---|
| pahi-legacy-parser.kql | SAP_PAHI |
Unifies the agent-based ABAP_PAHI_CL and agentless ABAP_PAHI_2_CL tables into a single schema. Required by the legacy analytic rule Monitor the configuration of static SAP security parameters. |
- Open the Log Analytics workspace query editor in the Azure portal.
- Paste the KQL from the parser file.
- Click Save → Save as function and name it as indicated above (e.g.,
SAP_PAHI). - Override if a previous version exists.
Refer to the configuration hints for details on table setup and prerequisites.