SAP BTP - Malware detected in BAS dev space

id: 31997e9a-7447-47f3-8208-4f5d7efe497c
kind: Scheduled
name: SAP BTP - Malware detected in BAS dev space
description: Identifies instances of malware detected using SAP internal malware agent
  within Business Application Studio dev spaces.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SAPBTPAuditEvents
    dataTypes:
      - SAPBTPAuditLog_CL
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - ResourceDevelopment
  - Execution
  - Persistence
relevantTechniques:
  - T1584
  - T1072
  - T0873
query: |
  SAPBTPAuditLog_CL
  | where Message has "malware"
  | extend MessageData = parse_json(tostring(Message.data))
  | extend MalwareData = parse_json(tostring(MessageData.message))
  | extend
      ClusterID = tostring(MessageData.clusterID),
      WorkspaceID = tostring(MessageData.wsID),
      DevSpaceId = tostring(MalwareData.dev_space_id),
      User = tostring(MalwareData.user),
      Malware = strcat_array(MalwareData.findings, ", "),
      MessageText = tostring(MalwareData.message)
  | extend
      AccountName = tostring(split(User, '@')[0]),
      UPNSuffix = tostring(split(User, '@')[1])
  | where isnotempty(User) and isnotempty(Malware)
  | project
      UpdatedOn,
      ClusterID,
      WorkspaceID,
      DevSpaceId,
      MessageText,
      User,
      Malware,
      Tenant,
      SpaceId,
      Category,
      CloudApp = "SAP BTP",
      AccountName,
      UPNSuffix
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: CloudApp
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: Malware
    fieldMappings:
      - identifier: Name
        columnName: Malware
alertDetailsOverride:
  alertDisplayNameFormat: SAP BTP - Malware detected in Business Apps Studio dev space
  alertDescriptionFormat: 'Malware was found in the following subaccount: {{Tenant}}'
version: 3.0.8