detection.wiki

Detection rules › Kusto

SAP ETD - Synch investigations

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status
available
Severity
high
Time window
2d
Source
github.com/Azure/Azure-Sentinel

Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)

Rule body

id: 5096db53-fad3-4844-a264-246f7b7e6e06
kind: Scheduled
name: SAP ETD - Synch investigations
description: Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SAPETDAlerts
    dataTypes:
      - SAPETDInvestigations_CL
queryFrequency: 1h
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  let AuditTimeAgo = 2d;
  let _severity= dynamic(["HIGH","VERY HIGH"]);
  SAPETDInvestigations_CL
  | where TimeGenerated > ago(AuditTimeAgo)
  | where Severity in (_severity)
  | mv-expand Users
  | extend
    UserAccountName = tostring(Users.UserAccountName),
    UserEmail = tostring(Users.EmailAddresses[0])
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: UserAccountName
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: UserEmail
alertDetailsOverride:
  alertDisplayNameFormat: 'SAP ETD - {{Description}} '
  alertDescriptionFormat: 'Description: {{Description}}. Processed by {{Processor}}. Severity: {{Severity}}.'
customDetails:
  ETD_InvestNumber: InvestigationId
  SAP_UserAccount: UserAccountName
  SAP_UserEmail: UserEmail
version: 1.0.1

Stages and Predicates

Stage 0: let

let AuditTimeAgo = 2d;
let _severity= dynamic(["HIGH","VERY HIGH"]);

Stage 1: source

SAPETDInvestigations_CL

Stage 2: where

| where TimeGenerated > ago(AuditTimeAgo)

Stage 3: where

| where Severity in (_severity)

Stage 4: mv-expand

| mv-expand Users

Stage 5: extend

| extend
  UserAccountName = tostring(Users.UserAccountName),
  UserEmail = tostring(Users.EmailAddresses[0])

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Severityin
  • HIGH
  • VERY HIGH
field:"Severity" kind:in

Output fields

These fields are emitted when the rule matches.

FieldSource
UserAccountNameextend
UserEmailextend