SAP ETD - Synch alerts | Microsoft Sentinel Analytic Rules

Back


Id	7a830484-e349-4527-85f6-7850c468c238
Rulename	SAP ETD - Synch alerts
Description	Synch alerts coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
Severity	Medium
Required data connectors	SAPETDAlerts
Kind	Scheduled
Query frequency	1h
Query period	2d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchAlerts.yaml
Version	1.0.4
Arm template	7a830484-e349-4527-85f6-7850c468c238.json

KQL

let minThreshold= 1;
let minScore= 50;
let lookBack= 7d;
let regex_sid = @"^([A-Z0-9]{3})/";
let regex_client = @'\/(.{3})$';
SAPETDAlerts_CL
| mv-expand NormalizedTriggeringEvents
| summarize arg_max(TimeGenerated, *) by AlertId
| where Threshold >= minThreshold and Score >= minScore
| extend
  SystemId= extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
  ClienId= extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
  Host= NormalizedTriggeringEvents.NetworkHostnameInitiator,
  Instance= NormalizedTriggeringEvents.NetworkHostnameActor,
  User= NormalizedTriggeringEvents.UserAccountActing,
  IP= NormalizedTriggeringEvents.NetworkIPAddressInitiator
| mv-expand Users
| extend
  UserAccountName = tostring(Users.UserAccountName),
  UserEmail = tostring(Users.EmailAddresses[0]);

YAML

triggerOperator: gt
kind: Scheduled
severity: Medium
requiredDataConnectors:
- dataTypes:
  - SAPETDAlerts_CL
  connectorId: SAPETDAlerts
query: |
  let minThreshold= 1;
  let minScore= 50;
  let lookBack= 7d;
  let regex_sid = @"^([A-Z0-9]{3})/";
  let regex_client = @'\/(.{3})$';
  SAPETDAlerts_CL
  | mv-expand NormalizedTriggeringEvents
  | summarize arg_max(TimeGenerated, *) by AlertId
  | where Threshold >= minThreshold and Score >= minScore
  | extend
    SystemId= extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
    ClienId= extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
    Host= NormalizedTriggeringEvents.NetworkHostnameInitiator,
    Instance= NormalizedTriggeringEvents.NetworkHostnameActor,
    User= NormalizedTriggeringEvents.UserAccountActing,
    IP= NormalizedTriggeringEvents.NetworkIPAddressInitiator
  | mv-expand Users
  | extend
    UserAccountName = tostring(Users.UserAccountName),
    UserEmail = tostring(Users.EmailAddresses[0]);
id: 7a830484-e349-4527-85f6-7850c468c238
status: Available
name: SAP ETD - Synch alerts
queryFrequency: 1h
queryPeriod: 2d
tactics: []
entityMappings:
- fieldMappings:
  - columnName: UserAccountName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: UserEmail
    identifier: MailboxPrimaryAddress
  entityType: Mailbox
- fieldMappings:
  - columnName: SystemId
    identifier: Name
  - columnName: ClienId
    identifier: AppId
  - columnName: Instance
    identifier: InstanceName
  entityType: CloudApplication
- fieldMappings:
  - columnName: Host
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: IP
    identifier: Address
  entityType: IP
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: Synch alerts coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
version: 1.0.4
triggerThreshold: 0
alertDetailsOverride:
  alertDisplayNameFormat: 'SAP ETD - {{PatternName}} '
  alertDescriptionFormat: '{{PatternDescription}}'
customDetails:
  SAP_User: User
  ETD_AlertNumber: AlertId
  SAP_UserEmail: UserEmail
relevantTechniques: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchAlerts.yaml

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7a830484-e349-4527-85f6-7850c468c238')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7a830484-e349-4527-85f6-7850c468c238')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{PatternDescription}}",
          "alertDisplayNameFormat": "SAP ETD - {{PatternName}} "
        },
        "alertRuleTemplateName": "7a830484-e349-4527-85f6-7850c468c238",
        "customDetails": {
          "ETD_AlertNumber": "AlertId",
          "SAP_User": "User",
          "SAP_UserEmail": "UserEmail"
        },
        "description": "Synch alerts coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)",
        "displayName": "SAP ETD - Synch alerts",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserAccountName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Mailbox",
            "fieldMappings": [
              {
                "columnName": "UserEmail",
                "identifier": "MailboxPrimaryAddress"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "SystemId",
                "identifier": "Name"
              },
              {
                "columnName": "ClienId",
                "identifier": "AppId"
              },
              {
                "columnName": "Instance",
                "identifier": "InstanceName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Host",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SynchAlerts.yaml",
        "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 7d;\nlet regex_sid = @\"^([A-Z0-9]{3})/\";\nlet regex_client = @'\\/(.{3})$';\nSAPETDAlerts_CL\n| mv-expand NormalizedTriggeringEvents\n| summarize arg_max(TimeGenerated, *) by AlertId\n| where Threshold >= minThreshold and Score >= minScore\n| extend\n  SystemId= extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),\n  ClienId= extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),\n  Host= NormalizedTriggeringEvents.NetworkHostnameInitiator,\n  Instance= NormalizedTriggeringEvents.NetworkHostnameActor,\n  User= NormalizedTriggeringEvents.UserAccountActing,\n  IP= NormalizedTriggeringEvents.NetworkIPAddressInitiator\n| mv-expand Users\n| extend\n  UserAccountName = tostring(Users.UserAccountName),\n  UserEmail = tostring(Users.EmailAddresses[0]);\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P2D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}