Pathlock TDnR - SAP Security Audit Log Events | Microsoft Sentinel Analytic Rules

Back


Id	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c56
Rulename	Pathlock TDnR - SAP Security Audit Log Events
Description	Detects security-relevant events from the SAP Security Audit Log (SM20), forwarded by Pathlock Threat Detection and Response. The Security Audit Log captures critical security events including failed logons, authorization failures, and restricted transactions - anomalies here are strong indicators of attack activity or insider threats.
Severity	High
Tactics	Discovery DefenseEvasion
Techniques	T1082 T1562
Required data connectors	Pathlock_TDnR
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_SECURITY_AUDIT_LOG.yaml
Version	1.0.0
Arm template	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c56.json

KQL

Pathlock_TDnR_CL
| where DataSource == "SECURITY_AUDIT_LOG"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs

YAML

suppressionDuration: 5h
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_SECURITY_AUDIT_LOG.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - Pathlock_TDnR_CL
  connectorId: Pathlock_TDnR
tactics:
- Discovery
- DefenseEvasion
relevantTechniques:
- T1082
- T1562
kind: Scheduled
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 5h
    matchingMethod: AnyAlert
    groupByCustomDetails: []
    enabled: true
    reopenClosedIncident: false
    groupByAlertDetails: []
    groupByEntities: []
  createIncident: true
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: Bname
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Hostname
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: SrcIp
  entityType: IP
description: Detects security-relevant events from the SAP Security Audit Log (SM20), forwarded by Pathlock Threat Detection and Response. The Security Audit Log captures critical security events including failed logons, authorization failures, and restricted transactions - anomalies here are strong indicators of attack activity or insider threats.
triggerOperator: gt
suppressionEnabled: false
status: Available
queryFrequency: 1h
id: 2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c56
name: Pathlock TDnR - SAP Security Audit Log Events
severity: High
query: |
  Pathlock_TDnR_CL
  | where DataSource == "SECURITY_AUDIT_LOG"
  | project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
            Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
            MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs
queryPeriod: 1h
eventGroupingSettings:
  aggregationKind: SingleAlert

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c56')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c56')]",
      "properties": {
        "alertRuleTemplateName": "2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c56",
        "customDetails": null,
        "description": "Detects security-relevant events from the SAP Security Audit Log (SM20), forwarded by Pathlock Threat Detection and Response. The Security Audit Log captures critical security events including failed logons, authorization failures, and restricted transactions - anomalies here are strong indicators of attack activity or insider threats.",
        "displayName": "Pathlock TDnR - SAP Security Audit Log Events",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Bname",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Hostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_SECURITY_AUDIT_LOG.yaml",
        "query": "Pathlock_TDnR_CL\n| where DataSource == \"SECURITY_AUDIT_LOG\"\n| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,\n          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,\n          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Discovery"
        ],
        "techniques": [
          "T1082",
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}