SAP ETD - No new data received

// Configurable freshness threshold for the entire SAP ETD data feed.
// When changing this value also update queryFrequency and queryPeriod accordingly.
let LookbackPeriod = 1h;
SAPETDAlerts_CL
| summarize
    LastIngestionTime = max(TimeGenerated),
    RecordsInWindow   = countif(TimeGenerated > ago(LookbackPeriod))
| where RecordsInWindow == 0 or isnull(LastIngestionTime)
| extend
    LookbackPeriod = LookbackPeriod,
    TimeSinceLastIngestion = now() - coalesce(LastIngestionTime, datetime(null)),
    FeedName = "SAPETD",
    Reason = iff(isnull(LastIngestionTime),
        "No SAPETDAlerts_CL records have ever been ingested.",
        strcat("No SAPETDAlerts_CL records ingested in the last ", tostring(LookbackPeriod), " (last ingestion: ", tostring(LastIngestionTime), ")."))

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-NoNewDataReceived.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - SAPETDAlerts_CL
  connectorId: SAPETDAlerts
tactics:
- DefenseEvasion
customDetails:
  LookbackPeriod: LookbackPeriod
  LastIngestionGap: TimeSinceLastIngestion
  LastIngestion: LastIngestionTime
relevantTechniques:
- T1562
- T1562.006
kind: Scheduled
alertDetailsOverride:
  alertDescriptionFormat: |
    {{Reason}}

    A complete gap in the SAP ETD feed may indicate that an adversary is tampering with the security telemetry pipeline (for example by stopping the SAP ETD collector, disabling the data connector, or blocking network egress to Microsoft Sentinel) in order to hide malicious activity in the SAP landscape. Treat the silence as suspicious until proven otherwise: validate the integrity and runtime state of the SAP ETD data connector, the SAP ETD service, and the network path between them, and review recent change / admin activity on those components before concluding the cause is a benign outage.
  alertDisplayNameFormat: SAP ETD - No new data received in the last {{LookbackPeriod}}
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: FeedName
  entityType: CloudApplication
description: |
  Identifies a complete gap in the SAP Enterprise Threat Detection (ETD) feed when no records have been ingested into the SAPETDAlerts_CL table within the configured time window (default 1 hour). A full-feed blackout may indicate that an adversary is tampering with the security telemetry pipeline (for example by stopping the SAP ETD collector, disabling the data connector, or blocking network egress to Microsoft Sentinel) to hide follow-on activity in the SAP landscape. Benign causes such as a service outage, connector failure, or maintenance window are also possible and should be ruled out during triage. This rule is complementary to the per-SAP-system rule "SAP ETD - SAP system stopped reporting data", which can help distinguish a targeted silencing of a single system from a full-feed blackout. To change the freshness threshold, update the `LookbackPeriod` variable in the query and align `queryFrequency` / `queryPeriod` accordingly.
triggerOperator: gt
status: Available
queryFrequency: 1h
id: a9206c5a-3e72-4c10-807f-313a56075b20
name: SAP ETD - No new data received
severity: High
query: |
  // Configurable freshness threshold for the entire SAP ETD data feed.
  // When changing this value also update queryFrequency and queryPeriod accordingly.
  let LookbackPeriod = 1h;
  SAPETDAlerts_CL
  | summarize
      LastIngestionTime = max(TimeGenerated),
      RecordsInWindow   = countif(TimeGenerated > ago(LookbackPeriod))
  | where RecordsInWindow == 0 or isnull(LastIngestionTime)
  | extend
      LookbackPeriod = LookbackPeriod,
      TimeSinceLastIngestion = now() - coalesce(LastIngestionTime, datetime(null)),
      FeedName = "SAPETD",
      Reason = iff(isnull(LastIngestionTime),
          "No SAPETDAlerts_CL records have ever been ingested.",
          strcat("No SAPETDAlerts_CL records ingested in the last ", tostring(LookbackPeriod), " (last ingestion: ", tostring(LastIngestionTime), ")."))
queryPeriod: 1h
eventGroupingSettings:
  aggregationKind: SingleAlert

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a9206c5a-3e72-4c10-807f-313a56075b20')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a9206c5a-3e72-4c10-807f-313a56075b20')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{Reason}}\n\nA complete gap in the SAP ETD feed may indicate that an adversary is tampering with the security telemetry pipeline (for example by stopping the SAP ETD collector, disabling the data connector, or blocking network egress to Microsoft Sentinel) in order to hide malicious activity in the SAP landscape. Treat the silence as suspicious until proven otherwise: validate the integrity and runtime state of the SAP ETD data connector, the SAP ETD service, and the network path between them, and review recent change / admin activity on those components before concluding the cause is a benign outage.\n",
          "alertDisplayNameFormat": "SAP ETD - No new data received in the last {{LookbackPeriod}}"
        },
        "alertRuleTemplateName": "a9206c5a-3e72-4c10-807f-313a56075b20",
        "customDetails": {
          "LastIngestion": "LastIngestionTime",
          "LastIngestionGap": "TimeSinceLastIngestion",
          "LookbackPeriod": "LookbackPeriod"
        },
        "description": "Identifies a complete gap in the SAP Enterprise Threat Detection (ETD) feed when no records have been ingested into the SAPETDAlerts_CL table within the configured time window (default 1 hour). A full-feed blackout may indicate that an adversary is tampering with the security telemetry pipeline (for example by stopping the SAP ETD collector, disabling the data connector, or blocking network egress to Microsoft Sentinel) to hide follow-on activity in the SAP landscape. Benign causes such as a service outage, connector failure, or maintenance window are also possible and should be ruled out during triage. This rule is complementary to the per-SAP-system rule \"SAP ETD - SAP system stopped reporting data\", which can help distinguish a targeted silencing of a single system from a full-feed blackout. To change the freshness threshold, update the `LookbackPeriod` variable in the query and align `queryFrequency` / `queryPeriod` accordingly.\n",
        "displayName": "SAP ETD - No new data received",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "FeedName",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-NoNewDataReceived.yaml",
        "query": "// Configurable freshness threshold for the entire SAP ETD data feed.\n// When changing this value also update queryFrequency and queryPeriod accordingly.\nlet LookbackPeriod = 1h;\nSAPETDAlerts_CL\n| summarize\n    LastIngestionTime = max(TimeGenerated),\n    RecordsInWindow   = countif(TimeGenerated > ago(LookbackPeriod))\n| where RecordsInWindow == 0 or isnull(LastIngestionTime)\n| extend\n    LookbackPeriod = LookbackPeriod,\n    TimeSinceLastIngestion = now() - coalesce(LastIngestionTime, datetime(null)),\n    FeedName = \"SAPETD\",\n    Reason = iff(isnull(LastIngestionTime),\n        \"No SAPETDAlerts_CL records have ever been ingested.\",\n        strcat(\"No SAPETDAlerts_CL records ingested in the last \", tostring(LookbackPeriod), \" (last ingestion: \", tostring(LastIngestionTime), \").\"))\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1562.006"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}