Pathlock TDnR - J2EE Security Events | Microsoft Sentinel Analytic Rules

Back


Id	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c35
Rulename	Pathlock TDnR - J2EE Security Events
Description	Detects security events from SAP J2EE (Java) engine security logs, forwarded by Pathlock Threat Detection and Response. J2EE security anomalies may indicate web application attacks, unauthorized access to SAP NetWeaver Java services, or exploitation of Java-based SAP components.
Severity	Medium
Tactics	InitialAccess Discovery
Techniques	T1190 T1082
Required data connectors	Pathlock_TDnR
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_J2EE_SECURITY_LOG.yaml
Version	1.0.0
Arm template	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c35.json

KQL

Pathlock_TDnR_CL
| where DataSource == "J2EE_SECURITY_LOG"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs

YAML

triggerThreshold: 0
suppressionDuration: 5h
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    groupByAlertDetails: []
    matchingMethod: AnyAlert
    groupByEntities: []
    enabled: true
    groupByCustomDetails: []
    lookbackDuration: 5h
kind: Scheduled
description: Detects security events from SAP J2EE (Java) engine security logs, forwarded by Pathlock Threat Detection and Response. J2EE security anomalies may indicate web application attacks, unauthorized access to SAP NetWeaver Java services, or exploitation of Java-based SAP components.
queryFrequency: 1h
triggerOperator: gt
relevantTechniques:
- T1190
- T1082
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: Bname
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Hostname
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: SrcIp
  entityType: IP
id: 2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c35
query: |
  Pathlock_TDnR_CL
  | where DataSource == "J2EE_SECURITY_LOG"
  | project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
            Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
            MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_J2EE_SECURITY_LOG.yaml
requiredDataConnectors:
- dataTypes:
  - Pathlock_TDnR_CL
  connectorId: Pathlock_TDnR
suppressionEnabled: false
tactics:
- InitialAccess
- Discovery
queryPeriod: 1h
severity: Medium
status: Available
name: Pathlock TDnR - J2EE Security Events

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c35')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c35')]",
      "properties": {
        "alertRuleTemplateName": "2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c35",
        "customDetails": null,
        "description": "Detects security events from SAP J2EE (Java) engine security logs, forwarded by Pathlock Threat Detection and Response. J2EE security anomalies may indicate web application attacks, unauthorized access to SAP NetWeaver Java services, or exploitation of Java-based SAP components.",
        "displayName": "Pathlock TDnR - J2EE Security Events",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Bname",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Hostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_J2EE_SECURITY_LOG.yaml",
        "query": "Pathlock_TDnR_CL\n| where DataSource == \"J2EE_SECURITY_LOG\"\n| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,\n          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,\n          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "InitialAccess"
        ],
        "techniques": [
          "T1082",
          "T1190"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}