SAPCloudForCustomerC4C

Integrates with SAP Cloud for Customer (C4C) and collects audit events via its OData Analytics API to boost security monitoring and compliance.

Analytics & SIEM · SAP Cloud For Customer C4C

Details

IDSAPCloudForCustomerC4C
ProviderSAP
CategoryAnalytics & SIEM
From Version8.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesXSIAM

README

Use the SAP Cloud for Customer C4C integration to fetch events from SAP Cloud API.

Configure SAP Cloud For Customer C4C in Cortex

Parameter Description Required
Server URL Confirm that the pre-filled URL matches the correct API endpoint for your SAP C4C integration instance. True
Username The credentials to associate with the instance. True
Password The password to set for the user. True
Report ID The unique identifier of the report to retrieve data from SAP Cloud for Customer (C4C). True
Trust any certificate (not secure)   False
Use system proxy settings Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. False
Maximum number of audit events per fetch Maximum number of events to retrieve per fetch. The default value is 10000. False

Timezone Configuration

Before configuring this integration, you must ensure that the timezone for the user configured in your SAP C4C instance matches the UTC format. Failure to do so may result in errors when fetching events due to timestamp mismatches.

To configure the timezone for your technical user in SAP C4C, follow these steps:

  1. Log in to your SAP C4C system with an administrator account.
  2. Navigate to Application and User Management -> Business Users.
  3. Find and select the technical user that will be used for this integration.
  4. Go to the Details section for the selected user.
  5. Under the General tab, locate the Time Zone field.
  6. Set the time zone to a UTC format (e.g., “UTC”, “UTC+01:00”, “UTC-05:00”).
  7. Save your changes.

For a detailed explanation and visual guide, please refer to the following SAP Community blog post: Technical User Date Time Format Settings Change in C4C.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

sap-cloud-get-events

Retrieves events from the SAP Cloud for Customer API.

Base Command

sap-cloud-get-events

Input

Argument Name Description Required
start_date The start date for filtering events. Events newer than or equal to this date will be retrieved.
Must be in DD-MM-YYYY HH:MM:SS format (e.g., 10-07-2025 14:17:46).
.		 Required
days_from_start The number of days to include events after the start_date. For example, if start_date is
‘10-07-2025 10:00:00’ and days_from_start is ‘2’, events will be retrieved up to ‘12-07-2025 10:00:00’.
It’s recommended to keep this value no more than 5 days to avoid very large result sets.
. Default is 2.		 Optional
should_push_events Set to true to create events in your system from the retrieved data.
If false (default), the command will only display the events without creating them.
. Possible values are: true, false. Default is false.		 Optional
limit The maximum number of events to retrieve. If more events match the criteria, only this
specified amount will be returned.
. Default is 10.		 Optional

Context Output

There is no context output for this command.

Command example

!sap-cloud-get-events start_date="01-07-2025 14:00:00" limit="5"

Human Readable Output

Indicators from Anomali ThreatStream Feed

BROWSER CBROWSER_VERSION CCAL_DAY CCLIENT_TYPE CCOLD_START_IND CDEVICE_TYPE
02 ver1 2025-04-05 RUI 1 default
02 ver2 2025-04-05 RUI 2 default
02 ver3 2025-04-05 RUI 2 default
02 ver4 2025-04-05 RUI 1 default
02 ver5 2025-04-05 RUI 1 default

Configuration parameters

  • url — Server URL (required)
  • username — Username (required)
  • report_id — Report ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • max_fetch — Maximum number of audit events per fetch

Commands (1)

  • sap-cloud-get-events

    Retrieves events from the SAP Cloud for Customer API.

Source

SAPCloudForCustomerC4C.py SAPCloudForCustomerC4C_test.py SAPCloudForCustomerC4C.yml SAPCloudForCustomerC4C_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
provider: SAP
sectionorder:
- Connect
- Collect
commonfields:
  id: SAPCloudForCustomerC4C
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  defaultvalue: ""
  type: 0
  section: Connect
- display: Username
  name: username
  required: true
  defaultvalue: ""
  type: 9
  section: Connect
- display: Report ID
  name: report_id
  type: 0
  additionalinfo: The unique identifier of the report to retrieve data from SAP Cloud for Customer (C4C).
  required: true
  defaultvalue: ""
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
- section: Collect
  display: Maximum number of audit events per fetch
  name: max_fetch
  type: 0
  required: false
  defaultvalue: '10000'
description: 'Integrates with SAP Cloud for Customer (C4C) and collects audit events via its OData Analytics API to boost security monitoring and compliance.'
display: SAP Cloud For Customer (C4C)
name: SAPCloudForCustomerC4C
script:
  commands: 
  - arguments:
    - description: |
        The start date for filtering events. Events newer than or equal to this date will be retrieved.
        Must be in `DD-MM-YYYY HH:MM:SS` format (e.g., `10-07-2025 14:17:46`).
      name: start_date
      required: true
    - description: |
        The number of days to include events after the `start_date`. For example, if `start_date` is 
        '10-07-2025 10:00:00' and `days_from_start` is '2', events will be retrieved up to '12-07-2025 10:00:00'.
        It's recommended to keep this value no more than 5 days to avoid very large result sets.
      defaultValue: '2'
      name: days_from_start
      required: false
    - description: |
        Set to true to create events in your system from the retrieved data. 
        If false (default), the command will only display the events without creating them.
      name: should_push_events  
      predefined:  
      - 'true'  
      - 'false'  
      defaultValue: 'false'
      required: false  
      auto: PREDEFINED  
    - description: |
        The maximum number of events to retrieve. If more events match the criteria, only this
        specified amount will be returned.
      defaultValue: '10'
      name: limit
      required: false
    description: Retrieves events from the SAP Cloud for Customer API.
    name: sap-cloud-get-events
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 8.0.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam