let AuditTimeAgo = 2d;
let _severity= dynamic(["HIGH","VERY HIGH"]);
SAPETDInvestigations_CL
| where TimeGenerated > ago(AuditTimeAgo)
| where Severity in (_severity)
| mv-expand Users
| extend
UserAccountName = tostring(Users.UserAccountName),
UserEmail = tostring(Users.EmailAddresses[0])
id: 5096db53-fad3-4844-a264-246f7b7e6e06
triggerOperator: gt
entityMappings:
- fieldMappings:
- identifier: Name
columnName: UserAccountName
entityType: Account
- fieldMappings:
- identifier: MailboxPrimaryAddress
columnName: UserEmail
entityType: Mailbox
eventGroupingSettings:
aggregationKind: AlertPerResult
requiredDataConnectors:
- dataTypes:
- SAPETDInvestigations_CL
connectorId: SAPETDAlerts
queryFrequency: 1h
alertDetailsOverride:
alertDisplayNameFormat: 'SAP ETD - {{Description}} '
alertDescriptionFormat: 'Description: {{Description}}. Processed by {{Processor}}. Severity: {{Severity}}.'
queryPeriod: 2d
status: Available
query: |
let AuditTimeAgo = 2d;
let _severity= dynamic(["HIGH","VERY HIGH"]);
SAPETDInvestigations_CL
| where TimeGenerated > ago(AuditTimeAgo)
| where Severity in (_severity)
| mv-expand Users
| extend
UserAccountName = tostring(Users.UserAccountName),
UserEmail = tostring(Users.EmailAddresses[0])
name: SAP ETD - Synch investigations
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-SynchInvestigations.yaml
tactics: []
severity: High
relevantTechniques: []
triggerThreshold: 0
version: 1.0.1
description: Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
customDetails:
ETD_InvestNumber: InvestigationId
SAP_UserAccount: UserAccountName
SAP_UserEmail: UserEmail
