Back
Id5096db53-fad3-4844-a264-246f7b7e6e06
RulenameSAP ETD - Synch investigations
DescriptionSynch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
SeverityHigh
Required data connectorsSAPETDAlerts
KindScheduled
Query frequency1h
Query period2d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchInvestigations.yaml
Version1.0.1
Arm template5096db53-fad3-4844-a264-246f7b7e6e06.json
Deploy To Azure
let AuditTimeAgo = 2d;
let _severity= dynamic(["HIGH","VERY HIGH"]);
SAPETDInvestigations_CL
| where TimeGenerated > ago(AuditTimeAgo)
| where Severity in (_severity)
| mv-expand Users
| extend
  UserAccountName = tostring(Users.UserAccountName),
  UserEmail = tostring(Users.EmailAddresses[0])
id: 5096db53-fad3-4844-a264-246f7b7e6e06
entityMappings:
- fieldMappings:
  - columnName: UserAccountName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: UserEmail
    identifier: MailboxPrimaryAddress
  entityType: Mailbox
severity: High
status: Available
customDetails:
  SAP_UserEmail: UserEmail
  ETD_InvestNumber: InvestigationId
  SAP_UserAccount: UserAccountName
alertDetailsOverride:
  alertDisplayNameFormat: 'SAP ETD - {{Description}} '
  alertDescriptionFormat: 'Description: {{Description}}. Processed by {{Processor}}. Severity: {{Severity}}.'
eventGroupingSettings:
  aggregationKind: AlertPerResult
requiredDataConnectors:
- dataTypes:
  - SAPETDInvestigations_CL
  connectorId: SAPETDAlerts
kind: Scheduled
query: |
  let AuditTimeAgo = 2d;
  let _severity= dynamic(["HIGH","VERY HIGH"]);
  SAPETDInvestigations_CL
  | where TimeGenerated > ago(AuditTimeAgo)
  | where Severity in (_severity)
  | mv-expand Users
  | extend
    UserAccountName = tostring(Users.UserAccountName),
    UserEmail = tostring(Users.EmailAddresses[0])
name: SAP ETD - Synch investigations
queryPeriod: 2d
description: Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
tactics: []
triggerOperator: gt
triggerThreshold: 0
relevantTechniques: []
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchInvestigations.yaml
queryFrequency: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5096db53-fad3-4844-a264-246f7b7e6e06')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5096db53-fad3-4844-a264-246f7b7e6e06')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Description: {{Description}}. Processed by {{Processor}}. Severity: {{Severity}}.",
          "alertDisplayNameFormat": "SAP ETD - {{Description}} "
        },
        "alertRuleTemplateName": "5096db53-fad3-4844-a264-246f7b7e6e06",
        "customDetails": {
          "ETD_InvestNumber": "InvestigationId",
          "SAP_UserAccount": "UserAccountName",
          "SAP_UserEmail": "UserEmail"
        },
        "description": "Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)",
        "displayName": "SAP ETD - Synch investigations",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserAccountName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Mailbox",
            "fieldMappings": [
              {
                "columnName": "UserEmail",
                "identifier": "MailboxPrimaryAddress"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchInvestigations.yaml",
        "query": "let AuditTimeAgo = 2d;\nlet _severity= dynamic([\"HIGH\",\"VERY HIGH\"]);\nSAPETDInvestigations_CL\n| where TimeGenerated > ago(AuditTimeAgo)\n| where Severity in (_severity)\n| mv-expand Users\n| extend\n  UserAccountName = tostring(Users.UserAccountName),\n  UserEmail = tostring(Users.EmailAddresses[0])\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P2D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}