SAP ETD - SAP system stopped reporting data

// ---- Configurable thresholds ----
let LookbackPeriod = 2h;
let BaselineLookback = 7d;
// ---------------------------------
let regex_sid = @"^([A-Z0-9]{3})/";
let regex_client = @'\/(.{3})$';
SAPETDAlerts_CL
| where TimeGenerated > ago(BaselineLookback)
| mv-expand NormalizedTriggeringEvents
| extend
    SystemId = extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
    ClientId = extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
    Host     = tostring(NormalizedTriggeringEvents.NetworkHostnameInitiator),
    Instance = tostring(NormalizedTriggeringEvents.NetworkHostnameActor)
| where isnotempty(SystemId)
| summarize
    LastIngestionTime = max(TimeGenerated),
    Host     = take_any(Host),
    Instance = take_any(Instance),
    ClientId = take_any(ClientId)
    by SystemId
| extend TimeSinceLastIngestion = now() - LastIngestionTime
| where TimeSinceLastIngestion > LookbackPeriod
| extend
    LookbackPeriod = LookbackPeriod,
    Reason = strcat("SAP system ", SystemId, " has not reported any data to SAP ETD in the last ", tostring(LookbackPeriod), " (last seen: ", tostring(LastIngestionTime), ").")

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SystemStoppedReporting.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - SAPETDAlerts_CL
  connectorId: SAPETDAlerts
tactics:
- DefenseEvasion
customDetails:
  SAP_SID: SystemId
  SAP_Client: ClientId
  LastIngestion: LastIngestionTime
  LastIngestionGap: TimeSinceLastIngestion
  LookbackPeriod: LookbackPeriod
relevantTechniques:
- T1562
- T1562.006
kind: Scheduled
alertDetailsOverride:
  alertDescriptionFormat: |
    {{Reason}}

    A selective silence of a single SAP SID may indicate that an adversary is tampering with the security telemetry pipeline for this specific system (for example by stopping the SAP ETD collector for that SID, disabling the relevant data connector path, or blocking network egress from that host) in order to hide malicious activity while leaving the rest of the SAP ETD feed intact. Treat the silence as suspicious until proven otherwise: validate the integrity and runtime state of the SAP system, the SAP ETD collector configuration for this SID, and the data connector between SAP ETD and Microsoft Sentinel, and review recent change / admin activity on those components before concluding the cause is a benign outage.
  alertDisplayNameFormat: SAP ETD - SAP system {{SystemId}} stopped reporting data
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: SystemId
  - identifier: AppId
    columnName: ClientId
  - identifier: InstanceName
    columnName: Instance
  entityType: CloudApplication
- fieldMappings:
  - identifier: FullName
    columnName: Host
  entityType: Host
description: |
  Identifies a per-system silence when an individual SAP system (identified by its SID) that has recently been reporting to SAP Enterprise Threat Detection (ETD) stops producing new records in the SAPETDAlerts_CL table within the configured per-system grace period (default 2 hours). A targeted silence of a single SID may indicate that an adversary with access to the SAP system, the SAP ETD collector for that SID, or the data connector is selectively blocking security telemetry to hide follow-on activity while leaving the rest of the SAP ETD feed intact; benign causes such as connectivity issues, collector misconfiguration, or planned maintenance for that SID are also possible and should be ruled out during triage. The set of "expected" SIDs is derived from any system that has reported within the `BaselineLookback` period (default 7 days); systems silent for longer are considered decommissioned and are not alerted on. Tunable parameters at the top of the query: `LookbackPeriod` (silence threshold per SID; align with `queryFrequency`) and `BaselineLookback` (how far back to look to discover known SIDs; align with `queryPeriod`). This rule is complementary to the overall-feed rule "SAP ETD - No new data received".
triggerOperator: gt
status: Available
queryFrequency: 1h
id: b1413b43-9410-46f4-94d9-da507105d834
name: SAP ETD - SAP system stopped reporting data
severity: High
query: |
  // ---- Configurable thresholds ----
  let LookbackPeriod = 2h;
  let BaselineLookback = 7d;
  // ---------------------------------
  let regex_sid = @"^([A-Z0-9]{3})/";
  let regex_client = @'\/(.{3})$';
  SAPETDAlerts_CL
  | where TimeGenerated > ago(BaselineLookback)
  | mv-expand NormalizedTriggeringEvents
  | extend
      SystemId = extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
      ClientId = extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
      Host     = tostring(NormalizedTriggeringEvents.NetworkHostnameInitiator),
      Instance = tostring(NormalizedTriggeringEvents.NetworkHostnameActor)
  | where isnotempty(SystemId)
  | summarize
      LastIngestionTime = max(TimeGenerated),
      Host     = take_any(Host),
      Instance = take_any(Instance),
      ClientId = take_any(ClientId)
      by SystemId
  | extend TimeSinceLastIngestion = now() - LastIngestionTime
  | where TimeSinceLastIngestion > LookbackPeriod
  | extend
      LookbackPeriod = LookbackPeriod,
      Reason = strcat("SAP system ", SystemId, " has not reported any data to SAP ETD in the last ", tostring(LookbackPeriod), " (last seen: ", tostring(LastIngestionTime), ").")
queryPeriod: 7d
eventGroupingSettings:
  aggregationKind: AlertPerResult

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b1413b43-9410-46f4-94d9-da507105d834')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b1413b43-9410-46f4-94d9-da507105d834')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{Reason}}\n\nA selective silence of a single SAP SID may indicate that an adversary is tampering with the security telemetry pipeline for this specific system (for example by stopping the SAP ETD collector for that SID, disabling the relevant data connector path, or blocking network egress from that host) in order to hide malicious activity while leaving the rest of the SAP ETD feed intact. Treat the silence as suspicious until proven otherwise: validate the integrity and runtime state of the SAP system, the SAP ETD collector configuration for this SID, and the data connector between SAP ETD and Microsoft Sentinel, and review recent change / admin activity on those components before concluding the cause is a benign outage.\n",
          "alertDisplayNameFormat": "SAP ETD - SAP system {{SystemId}} stopped reporting data"
        },
        "alertRuleTemplateName": "b1413b43-9410-46f4-94d9-da507105d834",
        "customDetails": {
          "LastIngestion": "LastIngestionTime",
          "LastIngestionGap": "TimeSinceLastIngestion",
          "LookbackPeriod": "LookbackPeriod",
          "SAP_Client": "ClientId",
          "SAP_SID": "SystemId"
        },
        "description": "Identifies a per-system silence when an individual SAP system (identified by its SID) that has recently been reporting to SAP Enterprise Threat Detection (ETD) stops producing new records in the SAPETDAlerts_CL table within the configured per-system grace period (default 2 hours). A targeted silence of a single SID may indicate that an adversary with access to the SAP system, the SAP ETD collector for that SID, or the data connector is selectively blocking security telemetry to hide follow-on activity while leaving the rest of the SAP ETD feed intact; benign causes such as connectivity issues, collector misconfiguration, or planned maintenance for that SID are also possible and should be ruled out during triage. The set of \"expected\" SIDs is derived from any system that has reported within the `BaselineLookback` period (default 7 days); systems silent for longer are considered decommissioned and are not alerted on. Tunable parameters at the top of the query: `LookbackPeriod` (silence threshold per SID; align with `queryFrequency`) and `BaselineLookback` (how far back to look to discover known SIDs; align with `queryPeriod`). This rule is complementary to the overall-feed rule \"SAP ETD - No new data received\".\n",
        "displayName": "SAP ETD - SAP system stopped reporting data",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "SystemId",
                "identifier": "Name"
              },
              {
                "columnName": "ClientId",
                "identifier": "AppId"
              },
              {
                "columnName": "Instance",
                "identifier": "InstanceName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Host",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP%20ETD%20Cloud/Analytic%20Rules/SAPETD-SystemStoppedReporting.yaml",
        "query": "// ---- Configurable thresholds ----\nlet LookbackPeriod = 2h;\nlet BaselineLookback = 7d;\n// ---------------------------------\nlet regex_sid = @\"^([A-Z0-9]{3})/\";\nlet regex_client = @'\\/(.{3})$';\nSAPETDAlerts_CL\n| where TimeGenerated > ago(BaselineLookback)\n| mv-expand NormalizedTriggeringEvents\n| extend\n    SystemId = extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),\n    ClientId = extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),\n    Host     = tostring(NormalizedTriggeringEvents.NetworkHostnameInitiator),\n    Instance = tostring(NormalizedTriggeringEvents.NetworkHostnameActor)\n| where isnotempty(SystemId)\n| summarize\n    LastIngestionTime = max(TimeGenerated),\n    Host     = take_any(Host),\n    Instance = take_any(Instance),\n    ClientId = take_any(ClientId)\n    by SystemId\n| extend TimeSinceLastIngestion = now() - LastIngestionTime\n| where TimeSinceLastIngestion > LookbackPeriod\n| extend\n    LookbackPeriod = LookbackPeriod,\n    Reason = strcat(\"SAP system \", SystemId, \" has not reported any data to SAP ETD in the last \", tostring(LookbackPeriod), \" (last seen: \", tostring(LastIngestionTime), \").\")\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P7D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1562.006"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}