Detection rules › Kusto
SAP ETD - Synch alerts
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
Synch alerts coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
Rule body kusto
id: 7a830484-e349-4527-85f6-7850c468c238
kind: Scheduled
name: SAP ETD - Synch alerts
description: Synch alerts coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: SAPETDAlerts
dataTypes:
- SAPETDAlerts_CL
queryFrequency: 1h
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
let minThreshold= 1;
let minScore= 50;
let lookBack= 7d;
let regex_sid = @"^([A-Z0-9]{3})/";
let regex_client = @'\/(.{3})$';
SAPETDAlerts_CL
| mv-expand NormalizedTriggeringEvents
| summarize arg_max(TimeGenerated, *) by AlertId
| where Threshold >= minThreshold and Score >= minScore
| extend
SystemId= extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
ClienId= extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
Host= NormalizedTriggeringEvents.NetworkHostnameInitiator,
Instance= NormalizedTriggeringEvents.NetworkHostnameActor,
User= NormalizedTriggeringEvents.UserAccountActing,
IP= NormalizedTriggeringEvents.NetworkIPAddressInitiator
| mv-expand Users
| extend
UserAccountName = tostring(Users.UserAccountName),
UserEmail = tostring(Users.EmailAddresses[0]);
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: UserAccountName
- entityType: Mailbox
fieldMappings:
- identifier: MailboxPrimaryAddress
columnName: UserEmail
- entityType: CloudApplication
fieldMappings:
- identifier: Name
columnName: SystemId
- identifier: AppId
columnName: ClienId
- identifier: InstanceName
columnName: Instance
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: Host
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IP
alertDetailsOverride:
alertDisplayNameFormat: 'SAP ETD - {{PatternName}} '
alertDescriptionFormat: '{{PatternDescription}}'
customDetails:
SAP_User: User
SAP_UserEmail: UserEmail
ETD_AlertNumber: AlertId
version: 1.0.4
Stages and Predicates
Parameters
let minThreshold = 1;
let minScore = 50;
let lookBack = 7d;
let regex_sid = @"^([A-Z0-9]{3})/";
let regex_client = @'\/(.{3})$';
Stage 1: source
SAPETDAlerts_CL
Stage 2: mv-expand
| mv-expand NormalizedTriggeringEvents
Stage 3: summarize
| summarize arg_max(TimeGenerated, *) by AlertId
Stage 4: where
| where Threshold >= minThreshold and Score >= minScore
Stage 5: extend
| extend
SystemId= extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
ClienId= extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
Host= NormalizedTriggeringEvents.NetworkHostnameInitiator,
Instance= NormalizedTriggeringEvents.NetworkHostnameActor,
User= NormalizedTriggeringEvents.UserAccountActing,
IP= NormalizedTriggeringEvents.NetworkIPAddressInitiator
Stage 6: mv-expand
| mv-expand Users
Stage 7: extend
| extend
UserAccountName = tostring(Users.UserAccountName),
UserEmail = tostring(Users.EmailAddresses[0]);
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
AlertId | summarize |
ClienId | extend |
Host | extend |
IP | extend |
Instance | extend |
SystemId | extend |
User | extend |
UserAccountName | extend |
UserEmail | extend |