SAP BTP - Audit log service unavailable

// Configure the detection threshold (in minutes) - adjust based on your environment
let detection_threshold_in_minutes = 60;
// Lookback period to identify known subaccounts
let lookback = 7d;
// Get all known subaccounts and their last log time
let last_activity = SAPBTPAuditLog_CL
    | where TimeGenerated > ago(lookback)
    | summarize LastLogTime = max(TimeGenerated) by SubaccountName, Tenant;
// Identify subaccounts with no recent activity exceeding the threshold
last_activity
| where datetime_diff('minute', now(), LastLogTime) > detection_threshold_in_minutes
| extend TimeSinceLastLog = datetime_diff('minute', now(), LastLogTime)
| project 
    SubaccountName,
    Tenant,
    LastLogTime,
    TimeSinceLastLog,
    CloudApp = "SAP BTP"

name: SAP BTP - Audit log service unavailable
triggerOperator: gt
kind: Scheduled
queryFrequency: 1h
description: |
  Identifies SAP BTP subaccounts that have not reported audit logs for an unusual period.
  This could indicate that the audit log service has been disabled or tampered with,
  potentially by an attacker attempting to hide malicious activity. It may also indicate
  service key expiry or SAP BTP service availability problems.
id: 8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d
triggerThreshold: 0
queryPeriod: 7d
query: |
  // Configure the detection threshold (in minutes) - adjust based on your environment
  let detection_threshold_in_minutes = 60;
  // Lookback period to identify known subaccounts
  let lookback = 7d;
  // Get all known subaccounts and their last log time
  let last_activity = SAPBTPAuditLog_CL
      | where TimeGenerated > ago(lookback)
      | summarize LastLogTime = max(TimeGenerated) by SubaccountName, Tenant;
  // Identify subaccounts with no recent activity exceeding the threshold
  last_activity
  | where datetime_diff('minute', now(), LastLogTime) > detection_threshold_in_minutes
  | extend TimeSinceLastLog = datetime_diff('minute', now(), LastLogTime)
  | project 
      SubaccountName,
      Tenant,
      LastLogTime,
      TimeSinceLastLog,
      CloudApp = "SAP BTP"
version: 1.0.1
customDetails:
  Tenant: Tenant
  LastLogTime: LastLogTime
  SubaccountName: SubaccountName
  TimeSinceLastLog: TimeSinceLastLog
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SAPBTPAuditEvents
  dataTypes:
  - SAPBTPAuditLog_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Audit%20log%20service%20unavailable.yaml
alertDetailsOverride:
  alertDescriptionFormat: |
    The SAP BTP subaccount '{{SubaccountName}}' has not reported any audit logs since {{LastLogTime}}.

    Time without logs: {{TimeSinceLastLog}} minutes

    This could indicate:
    - Audit log service has been disabled (potential compromise to hide malicious activity)
    - Data connector authentication or connectivity issues
    - SAP BTP service availability problems

    Recommended actions:
    1. Verify the audit log service status in SAP BTP cockpit
    2. Check the data connector health in Microsoft Sentinel
    3. Review any recent administrative changes to the subaccount
    4. Investigate for potential unauthorized access or configuration changes
  alertDisplayNameFormat: 'SAP BTP: No audit logs received from {{SubaccountName}} for {{TimeSinceLastLog}} minutes'
relevantTechniques:
- T1562.008
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: CloudApp
  entityType: CloudApplication

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "The SAP BTP subaccount '{{SubaccountName}}' has not reported any audit logs since {{LastLogTime}}.\n\nTime without logs: {{TimeSinceLastLog}} minutes\n\nThis could indicate:\n- Audit log service has been disabled (potential compromise to hide malicious activity)\n- Data connector authentication or connectivity issues\n- SAP BTP service availability problems\n\nRecommended actions:\n1. Verify the audit log service status in SAP BTP cockpit\n2. Check the data connector health in Microsoft Sentinel\n3. Review any recent administrative changes to the subaccount\n4. Investigate for potential unauthorized access or configuration changes\n",
          "alertDisplayNameFormat": "SAP BTP: No audit logs received from {{SubaccountName}} for {{TimeSinceLastLog}} minutes"
        },
        "alertRuleTemplateName": "8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d",
        "customDetails": {
          "LastLogTime": "LastLogTime",
          "SubaccountName": "SubaccountName",
          "Tenant": "Tenant",
          "TimeSinceLastLog": "TimeSinceLastLog"
        },
        "description": "Identifies SAP BTP subaccounts that have not reported audit logs for an unusual period.\nThis could indicate that the audit log service has been disabled or tampered with,\npotentially by an attacker attempting to hide malicious activity. It may also indicate\nservice key expiry or SAP BTP service availability problems.\n",
        "displayName": "SAP BTP - Audit log service unavailable",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "CloudApp",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20BTP/Analytic%20Rules/BTP%20-%20Audit%20log%20service%20unavailable.yaml",
        "query": "// Configure the detection threshold (in minutes) - adjust based on your environment\nlet detection_threshold_in_minutes = 60;\n// Lookback period to identify known subaccounts\nlet lookback = 7d;\n// Get all known subaccounts and their last log time\nlet last_activity = SAPBTPAuditLog_CL\n    | where TimeGenerated > ago(lookback)\n    | summarize LastLogTime = max(TimeGenerated) by SubaccountName, Tenant;\n// Identify subaccounts with no recent activity exceeding the threshold\nlast_activity\n| where datetime_diff('minute', now(), LastLogTime) > detection_threshold_in_minutes\n| extend TimeSinceLastLog = datetime_diff('minute', now(), LastLogTime)\n| project \n    SubaccountName,\n    Tenant,\n    LastLogTime,\n    TimeSinceLastLog,\n    CloudApp = \"SAP BTP\"\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P7D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1562.008"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}