Back
Id5096db53-fad3-4844-a264-246f7b7e6e06
RulenameSAP ETD - Synch investigations
DescriptionSynch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
SeverityHigh
Required data connectorsSAPETDAlerts
KindScheduled
Query frequency1h
Query period2d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchInvestigations.yaml
Version1.0.1
Arm template5096db53-fad3-4844-a264-246f7b7e6e06.json
Deploy To Azure
let AuditTimeAgo = 2d;
let _severity= dynamic(["HIGH","VERY HIGH"]);
SAPETDInvestigations_CL
| where TimeGenerated > ago(AuditTimeAgo)
| where Severity in (_severity)
| mv-expand Users
| extend
  UserAccountName = tostring(Users.UserAccountName),
  UserEmail = tostring(Users.EmailAddresses[0])
requiredDataConnectors:
- connectorId: SAPETDAlerts
  dataTypes:
  - SAPETDInvestigations_CL
queryPeriod: 2d
id: 5096db53-fad3-4844-a264-246f7b7e6e06
name: SAP ETD - Synch investigations
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchInvestigations.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  let AuditTimeAgo = 2d;
  let _severity= dynamic(["HIGH","VERY HIGH"]);
  SAPETDInvestigations_CL
  | where TimeGenerated > ago(AuditTimeAgo)
  | where Severity in (_severity)
  | mv-expand Users
  | extend
    UserAccountName = tostring(Users.UserAccountName),
    UserEmail = tostring(Users.EmailAddresses[0])
status: Available
tactics: []
relevantTechniques: []
description: Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
alertDetailsOverride:
  alertDescriptionFormat: 'Description: {{Description}}. Processed by {{Processor}}. Severity: {{Severity}}.'
  alertDisplayNameFormat: 'SAP ETD - {{Description}} '
version: 1.0.1
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: UserAccountName
  entityType: Account
- fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: UserEmail
  entityType: Mailbox
customDetails:
  SAP_UserAccount: UserAccountName
  SAP_UserEmail: UserEmail
  ETD_InvestNumber: InvestigationId
triggerThreshold: 0
queryFrequency: 1h
triggerOperator: gt
severity: High
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5096db53-fad3-4844-a264-246f7b7e6e06')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5096db53-fad3-4844-a264-246f7b7e6e06')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Description: {{Description}}. Processed by {{Processor}}. Severity: {{Severity}}.",
          "alertDisplayNameFormat": "SAP ETD - {{Description}} "
        },
        "alertRuleTemplateName": "5096db53-fad3-4844-a264-246f7b7e6e06",
        "customDetails": {
          "ETD_InvestNumber": "InvestigationId",
          "SAP_UserAccount": "UserAccountName",
          "SAP_UserEmail": "UserEmail"
        },
        "description": "Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)",
        "displayName": "SAP ETD - Synch investigations",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserAccountName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Mailbox",
            "fieldMappings": [
              {
                "columnName": "UserEmail",
                "identifier": "MailboxPrimaryAddress"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchInvestigations.yaml",
        "query": "let AuditTimeAgo = 2d;\nlet _severity= dynamic([\"HIGH\",\"VERY HIGH\"]);\nSAPETDInvestigations_CL\n| where TimeGenerated > ago(AuditTimeAgo)\n| where Severity in (_severity)\n| mv-expand Users\n| extend\n  UserAccountName = tostring(Users.UserAccountName),\n  UserEmail = tostring(Users.EmailAddresses[0])\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P2D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}