detection.wiki

Detection rules › Kusto

SAP ETD - Synch investigations

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status
available
Severity
high
Time window
2d
Source
github.com/Azure/Azure-Sentinel

Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)

Rule body kusto

id: 5096db53-fad3-4844-a264-246f7b7e6e06
kind: Scheduled
name: SAP ETD - Synch investigations
description: Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SAPETDAlerts
    dataTypes:
      - SAPETDInvestigations_CL
queryFrequency: 1h
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  let AuditTimeAgo = 2d;
  let _severity= dynamic(["HIGH","VERY HIGH"]);
  SAPETDInvestigations_CL
  | where TimeGenerated > ago(AuditTimeAgo)
  | where Severity in (_severity)
  | mv-expand Users
  | extend
    UserAccountName = tostring(Users.UserAccountName),
    UserEmail = tostring(Users.EmailAddresses[0])
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: UserAccountName
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: UserEmail
alertDetailsOverride:
  alertDisplayNameFormat: 'SAP ETD - {{Description}} '
  alertDescriptionFormat: 'Description: {{Description}}. Processed by {{Processor}}. Severity: {{Severity}}.'
customDetails:
  ETD_InvestNumber: InvestigationId
  SAP_UserAccount: UserAccountName
  SAP_UserEmail: UserEmail
version: 1.0.1

Stages and Predicates

Parameters

let AuditTimeAgo = 2d;
let _severity = dynamic(["HIGH","VERY HIGH"]);

Stage 1: source

SAPETDInvestigations_CL

Stage 2: where

| where TimeGenerated > ago(AuditTimeAgo)

Stage 3: where

| where Severity in (_severity)

Stage 4: mv-expand

| mv-expand Users

Stage 5: extend

| extend
  UserAccountName = tostring(Users.UserAccountName),
  UserEmail = tostring(Users.EmailAddresses[0])

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Severityin
  • HIGH transforms: cased
  • VERY HIGH transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
UserAccountNameextend
UserEmailextend