SAP BTP - Audit log service unavailable

// Configure the detection threshold (in minutes) - adjust based on your environment
let detection_threshold_in_minutes = 60;
// Lookback period to identify known subaccounts
let lookback = 7d;
// Get all known subaccounts and their last log time
let last_activity = SAPBTPAuditLog_CL
    | where TimeGenerated > ago(lookback)
    | summarize LastLogTime = max(TimeGenerated) by SubaccountName, Tenant;
// Identify subaccounts with no recent activity exceeding the threshold
last_activity
| where datetime_diff('minute', now(), LastLogTime) > detection_threshold_in_minutes
| extend TimeSinceLastLog = datetime_diff('minute', now(), LastLogTime)
| project 
    SubaccountName,
    Tenant,
    LastLogTime,
    TimeSinceLastLog,
    CloudApp = "SAP BTP"

version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Audit%20log%20service%20unavailable.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - SAPBTPAuditLog_CL
  connectorId: SAPBTPAuditEvents
tactics:
- DefenseEvasion
customDetails:
  SubaccountName: SubaccountName
  LastLogTime: LastLogTime
  Tenant: Tenant
  TimeSinceLastLog: TimeSinceLastLog
relevantTechniques:
- T1562.008
kind: Scheduled
alertDetailsOverride:
  alertDescriptionFormat: |
    The SAP BTP subaccount '{{SubaccountName}}' has not reported any audit logs since {{LastLogTime}}.

    Time without logs: {{TimeSinceLastLog}} minutes

    This could indicate:
    - Audit log service has been disabled (potential compromise to hide malicious activity)
    - Data connector authentication or connectivity issues
    - SAP BTP service availability problems

    Recommended actions:
    1. Verify the audit log service status in SAP BTP cockpit
    2. Check the data connector health in Microsoft Sentinel
    3. Review any recent administrative changes to the subaccount
    4. Investigate for potential unauthorized access or configuration changes
  alertDisplayNameFormat: 'SAP BTP: No audit logs received from {{SubaccountName}} for {{TimeSinceLastLog}} minutes'
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: CloudApp
  entityType: CloudApplication
description: |
  Identifies SAP BTP subaccounts that have not reported audit logs for an unusual period.
  This could indicate that the audit log service has been disabled or tampered with,
  potentially by an attacker attempting to hide malicious activity. It may also indicate
  service key expiry or SAP BTP service availability problems.
triggerOperator: gt
status: Available
queryFrequency: 1h
id: 8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d
name: SAP BTP - Audit log service unavailable
severity: High
query: |
  // Configure the detection threshold (in minutes) - adjust based on your environment
  let detection_threshold_in_minutes = 60;
  // Lookback period to identify known subaccounts
  let lookback = 7d;
  // Get all known subaccounts and their last log time
  let last_activity = SAPBTPAuditLog_CL
      | where TimeGenerated > ago(lookback)
      | summarize LastLogTime = max(TimeGenerated) by SubaccountName, Tenant;
  // Identify subaccounts with no recent activity exceeding the threshold
  last_activity
  | where datetime_diff('minute', now(), LastLogTime) > detection_threshold_in_minutes
  | extend TimeSinceLastLog = datetime_diff('minute', now(), LastLogTime)
  | project 
      SubaccountName,
      Tenant,
      LastLogTime,
      TimeSinceLastLog,
      CloudApp = "SAP BTP"
queryPeriod: 7d
eventGroupingSettings:
  aggregationKind: AlertPerResult

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "The SAP BTP subaccount '{{SubaccountName}}' has not reported any audit logs since {{LastLogTime}}.\n\nTime without logs: {{TimeSinceLastLog}} minutes\n\nThis could indicate:\n- Audit log service has been disabled (potential compromise to hide malicious activity)\n- Data connector authentication or connectivity issues\n- SAP BTP service availability problems\n\nRecommended actions:\n1. Verify the audit log service status in SAP BTP cockpit\n2. Check the data connector health in Microsoft Sentinel\n3. Review any recent administrative changes to the subaccount\n4. Investigate for potential unauthorized access or configuration changes\n",
          "alertDisplayNameFormat": "SAP BTP: No audit logs received from {{SubaccountName}} for {{TimeSinceLastLog}} minutes"
        },
        "alertRuleTemplateName": "8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d",
        "customDetails": {
          "LastLogTime": "LastLogTime",
          "SubaccountName": "SubaccountName",
          "Tenant": "Tenant",
          "TimeSinceLastLog": "TimeSinceLastLog"
        },
        "description": "Identifies SAP BTP subaccounts that have not reported audit logs for an unusual period.\nThis could indicate that the audit log service has been disabled or tampered with,\npotentially by an attacker attempting to hide malicious activity. It may also indicate\nservice key expiry or SAP BTP service availability problems.\n",
        "displayName": "SAP BTP - Audit log service unavailable",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudApp",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Audit%20log%20service%20unavailable.yaml",
        "query": "// Configure the detection threshold (in minutes) - adjust based on your environment\nlet detection_threshold_in_minutes = 60;\n// Lookback period to identify known subaccounts\nlet lookback = 7d;\n// Get all known subaccounts and their last log time\nlet last_activity = SAPBTPAuditLog_CL\n    | where TimeGenerated > ago(lookback)\n    | summarize LastLogTime = max(TimeGenerated) by SubaccountName, Tenant;\n// Identify subaccounts with no recent activity exceeding the threshold\nlast_activity\n| where datetime_diff('minute', now(), LastLogTime) > detection_threshold_in_minutes\n| extend TimeSinceLastLog = datetime_diff('minute', now(), LastLogTime)\n| project \n    SubaccountName,\n    Tenant,\n    LastLogTime,\n    TimeSinceLastLog,\n    CloudApp = \"SAP BTP\"\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P7D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1562.008"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}