SAP ETD - Synch investigations

Back


Id	5096db53-fad3-4844-a264-246f7b7e6e06
Rulename	SAP ETD - Synch investigations
Description	Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
Severity	High
Required data connectors	SAPETDAlerts
Kind	Scheduled
Query frequency	1h
Query period	2d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-SynchInvestigations.yaml
Version	1.0.1
Arm template	5096db53-fad3-4844-a264-246f7b7e6e06.json

KQL

let AuditTimeAgo = 2d;
let _severity= dynamic(["HIGH","VERY HIGH"]);
SAPETDInvestigations_CL
| where TimeGenerated > ago(AuditTimeAgo)
| where Severity in (_severity)
| mv-expand Users
| extend
  UserAccountName = tostring(Users.UserAccountName),
  UserEmail = tostring(Users.EmailAddresses[0])

YAML

status: Available
queryFrequency: 1h
queryPeriod: 2d
triggerOperator: gt
alertDetailsOverride:
  alertDescriptionFormat: 'Description: {{Description}}. Processed by {{Processor}}. Severity: {{Severity}}.'
  alertDisplayNameFormat: 'SAP ETD - {{Description}} '
query: |
  let AuditTimeAgo = 2d;
  let _severity= dynamic(["HIGH","VERY HIGH"]);
  SAPETDInvestigations_CL
  | where TimeGenerated > ago(AuditTimeAgo)
  | where Severity in (_severity)
  | mv-expand Users
  | extend
    UserAccountName = tostring(Users.UserAccountName),
    UserEmail = tostring(Users.EmailAddresses[0])  
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-SynchInvestigations.yaml
tactics: []
triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: UserAccountName
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: UserEmail
requiredDataConnectors:
- connectorId: SAPETDAlerts
  dataTypes:
  - SAPETDInvestigations_CL
kind: Scheduled
relevantTechniques: []
customDetails:
  SAP_UserEmail: UserEmail
  ETD_InvestNumber: InvestigationId
  SAP_UserAccount: UserAccountName
description: Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
name: SAP ETD - Synch investigations
version: 1.0.1
id: 5096db53-fad3-4844-a264-246f7b7e6e06
severity: High

ARM