Pathlock TDnR - TMS Transport and Import Events | Microsoft Sentinel Analytic Rules

Back


Id	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c71
Rulename	Pathlock TDnR - TMS Transport and Import Events
Description	Detects SAP Transport Management System (TMS) transport and import events, forwarded by Pathlock Threat Detection and Response. Unauthorized transports may introduce malicious code changes, configuration weaknesses, or backdoors into production SAP systems, bypassing normal change management and approval processes.
Severity	High
Tactics	Persistence Execution
Techniques	T1059 T1543
Required data connectors	Pathlock_TDnR
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_TRANSPORT_LOG.yaml
Version	1.0.0
Arm template	2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c71.json

KQL

Pathlock_TDnR_CL
| where DataSource == "TRANSPORT_LOG"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs

YAML

suppressionEnabled: false
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: Bname
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Hostname
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: SrcIp
  entityType: IP
id: 2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c71
suppressionDuration: 5h
tactics:
- Persistence
- Execution
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - Pathlock_TDnR_CL
  connectorId: Pathlock_TDnR
queryPeriod: 1h
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_TRANSPORT_LOG.yaml
severity: High
relevantTechniques:
- T1059
- T1543
triggerThreshold: 0
version: 1.0.0
name: Pathlock TDnR - TMS Transport and Import Events
triggerOperator: gt
query: |
  Pathlock_TDnR_CL
  | where DataSource == "TRANSPORT_LOG"
  | project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
            Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
            MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs
status: Available
description: Detects SAP Transport Management System (TMS) transport and import events, forwarded by Pathlock Threat Detection and Response. Unauthorized transports may introduce malicious code changes, configuration weaknesses, or backdoors into production SAP systems, bypassing normal change management and approval processes.
queryFrequency: 1h
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    groupByCustomDetails: []
    lookbackDuration: 5h
    reopenClosedIncident: false
    groupByEntities: []
    matchingMethod: AnyAlert
    groupByAlertDetails: []
  createIncident: true

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c71')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c71')]",
      "properties": {
        "alertRuleTemplateName": "2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c71",
        "customDetails": null,
        "description": "Detects SAP Transport Management System (TMS) transport and import events, forwarded by Pathlock Threat Detection and Response. Unauthorized transports may introduce malicious code changes, configuration weaknesses, or backdoors into production SAP systems, bypassing normal change management and approval processes.",
        "displayName": "Pathlock TDnR - TMS Transport and Import Events",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Bname",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Hostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pathlock_TDnR/Analytic%20Rules/Pathlock_TDnR_TRANSPORT_LOG.yaml",
        "query": "Pathlock_TDnR_CL\n| where DataSource == \"TRANSPORT_LOG\"\n| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,\n          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,\n          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Persistence"
        ],
        "techniques": [
          "T1059",
          "T1543"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}