Skip to content

Commit 88d3efb

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #11722 from MartinPankraz/add-sapetd
Initial SAP etd release
2 parents 44cc69f + 79ba298 commit 88d3efb

File tree

20 files changed

+2081
-2
lines changed

20 files changed

+2081
-2
lines changed

‎.script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"Name": "SAPETDAlerts_CL",
3+
"Properties": [
4+
{
5+
"name": "TimeGenerated",
6+
"type": "datetime"
7+
},
8+
{
9+
"name": "Version",
10+
"type": "string"
11+
},
12+
{
13+
"name": "AlertId",
14+
"type": "int"
15+
},
16+
{
17+
"name": "PatternName",
18+
"type": "string"
19+
},
20+
{
21+
"name": "PatternDescription",
22+
"type": "string"
23+
},
24+
{
25+
"name": "Status",
26+
"type": "string"
27+
},
28+
{
29+
"name": "CreationTimestamp",
30+
"type": "datetime"
31+
},
32+
{
33+
"name": "MinTimestamp",
34+
"type": "datetime"
35+
},
36+
{
37+
"name": "MaxTimestamp",
38+
"type": "datetime"
39+
},
40+
{
41+
"name": "Score",
42+
"type": "int"
43+
},
44+
{
45+
"name": "Threshold",
46+
"type": "int"
47+
},
48+
{
49+
"name": "Measure",
50+
"type": "int"
51+
},
52+
{
53+
"name": "TriggeringEvents",
54+
"type": "dynamic"
55+
}
56+
]
57+
}

‎.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
[
2+
{
3+
"id": "5dd72ebe-03ac-43ac-851b-68cfe5106e4f",
4+
"templateName": "SAPETD-LoginFromUnexpectedNetwork.yaml",
5+
"validationFailReason": "The name 'Network' does not refer to any known column, table, variable or function. The name 'geo_info_from_ip_address' does not refer to any known function."
6+
},
27
{
38
"id": "ef895ada-e8e8-4cf0-9313-b1ab67fab69f",
49
"templateName": "AuthenticationAttemptfromNewCountry.yaml",

‎.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@
154154
"SalesforceServiceCloud",
155155
"SAP",
156156
"SAPBTPAuditEvents",
157+
"SAPETDAlerts",
157158
"SecurityEvents",
158159
"SemperisDSP",
159160
"SenservaPro",

‎Logos/SAPETD_cloud.svg‎

Lines changed: 8 additions & 0 deletions
Loading

‎Solutions/Google Threat Intelligence/ReleaseNotes.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|------------------------------------------------|
3-
| 3.0.0 | 05-12-2024 | Initial Solution Release |
4-
| 3.1.0 | 29-01-2025 | Threat Intelligence Ingestion |
3+
| 3.1.0 | 18-02-2025 | Added new **Playbooks** Custom Connector endpoint.<br/> Added new **Playbook** GT Threat List.<br/> Fixed bug in GT Enrich Incident **Playbook**. |
4+
| 3.0.0 | 05-12-2024 | Initial Solution Release. |

‎Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
id: 5dd72ebe-03ac-43ac-851b-68cfe5106e4f
2+
kind: Scheduled
3+
name: SAP ETD - Login from unexpected network
4+
description: |
5+
Identifies logons from an unexpected network.
6+
Source Action: Logon to the backend system from an IP address which is not assigned to one of the networks.
7+
networks can be maintained in the "SAP - Networks" watchlist of the Microsoft Sentinel Solution for SAP package.
8+
9+
*Data Sources: SAP Enterprise Thread Detection Solution - Alerts*
10+
severity: Medium
11+
status: Available
12+
requiredDataConnectors:
13+
- connectorId: SAPETDAlerts
14+
dataTypes:
15+
- SAPETDAlerts_CL
16+
queryFrequency: 1h
17+
queryPeriod: 2d
18+
triggerOperator: gt
19+
triggerThreshold: 0
20+
tactics: []
21+
relevantTechniques: []
22+
query: |
23+
let regex_ip = @"user_ip:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})";
24+
let regex_user = @"user_name:(\w+)";
25+
let regex_sid = @"sid:(\w{3})";
26+
let regex_client = @"client:(\d{3})";
27+
let regex_instance_name = @"instance_name:(\w+)";
28+
let regex_instance_host = @"instance_host:([\w-]+)";
29+
let SAPNetworks = _GetWatchlist('SAP - Networks');
30+
SAPETDAlerts_CL
31+
| mv-expand TriggeringEvents
32+
| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)
33+
| extend Id_ = TriggeringEvents.Id
34+
| extend extracted_user_ip = extract(regex_ip, 1, sapOriginalEvent)
35+
| extend extracted_sap_user = extract(regex_user, 1, sapOriginalEvent)
36+
| extend extracted_sid = extract(regex_sid, 1, sapOriginalEvent)
37+
| extend extracted_client = extract(regex_client, 1, sapOriginalEvent)
38+
| extend extracted_instance_name = extract(regex_instance_name, 1, sapOriginalEvent)
39+
| extend extracted_instance_host = extract(regex_instance_host, 1, sapOriginalEvent)
40+
| evaluate ipv4_lookup(SAPNetworks, extracted_user_ip, Network, return_unmatched = true)
41+
| where isempty(Network)
42+
| project TimeGenerated, extracted_user_ip, extracted_sap_user, extracted_sid, extracted_client, extracted_instance_name, extracted_instance_host, AlertId, PatternName, PatternDescription, Status
43+
| extend GeoLocation= iff(ipv4_is_private( extracted_user_ip), dynamic({"IsPrivate": true}), geo_info_from_ip_address(extracted_user_ip))
44+
eventGroupingSettings:
45+
aggregationKind: AlertPerResult
46+
entityMappings:
47+
- entityType: CloudApplication
48+
fieldMappings:
49+
- identifier: AppId
50+
columnName: extracted_sid
51+
- identifier: InstanceName
52+
columnName: extracted_instance_name
53+
- entityType: Host
54+
fieldMappings:
55+
- identifier: FullName
56+
columnName: extracted_instance_host
57+
- entityType: IP
58+
fieldMappings:
59+
- identifier: Address
60+
columnName: extracted_user_ip
61+
alertDetailsOverride:
62+
alertDisplayNameFormat: 'SAP ETD - {{PatternName}} '
63+
alertDescriptionFormat: |
64+
{{PatternDescription}}
65+
customDetails:
66+
SAP_User: extracted_sap_user
67+
ETD_AlertID: AlertId
68+
version: 1.0.0

‎Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-SynchAlerts.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
id: 7a830484-e349-4527-85f6-7850c468c238
2+
kind: Scheduled
3+
name: SAP ETD - Synch alerts
4+
description: Synch alerts coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors:
8+
- connectorId: SAPETDAlerts
9+
dataTypes:
10+
- SAPETDAlerts_CL
11+
queryFrequency: 1h
12+
queryPeriod: 2d
13+
triggerOperator: gt
14+
triggerThreshold: 0
15+
tactics: []
16+
relevantTechniques: []
17+
query: |
18+
let minThreshold= 1;
19+
let minScore= 50;
20+
let lookBack= 70d;
21+
SAPETDAlerts_CL
22+
| mv-expand TriggeringEvents
23+
| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)
24+
| where PatternName <> "Logon from external with SAP standard users"
25+
| summarize arg_max(TimeGenerated, *) by AlertId
26+
| where Threshold >= minThreshold and Score >= minScore
27+
| extend NewEvent= split(sapOriginalEvent, "\n")
28+
| mv-expand NewEvent to typeof(string)
29+
| parse NewEvent with Key: string ":" Value: string
30+
| extend Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value), Key= iff(isempty(Key) and isnotempty(NewEvent), TriggeringEvents.EventLogType, Key)
31+
| extend KV= bag_pack(Key, Value)
32+
| summarize KeyValues= make_bag(KV), take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, TriggeringEvents.EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, TriggeringEvents.OriginalEvent) by AlertId
33+
| extend SystemId= KeyValues.sid, ClienId= KeyValues.client, Host= KeyValues.instance_host, Instance= KeyValues.instance_name, User= KeyValues.user_name, IP= KeyValues.user_ip
34+
eventGroupingSettings:
35+
aggregationKind: AlertPerResult
36+
entityMappings:
37+
- entityType: CloudApplication
38+
fieldMappings:
39+
- identifier: Name
40+
columnName: SystemId
41+
- identifier: AppId
42+
columnName: ClienId
43+
- identifier: InstanceName
44+
columnName: Instance
45+
- entityType: Host
46+
fieldMappings:
47+
- identifier: FullName
48+
columnName: Host
49+
- entityType: IP
50+
fieldMappings:
51+
- identifier: Address
52+
columnName: IP
53+
alertDetailsOverride:
54+
alertDisplayNameFormat: 'SAP ETD - {{PatternName}} '
55+
alertDescriptionFormat: 'Alert synched from SAP Enterprise Threat Detection, cloud edition into Microsoft Sentinel (one way). {{PatternDescription}}'
56+
customDetails:
57+
SAP_User: User
58+
ETD_AlertID: AlertId
59+
version: 1.0.0

‎Solutions/SAP ETD Cloud/Data Connectors/SAPETD.json‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
{
2+
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
3+
"apiVersion": "2022-09-01-preview",
4+
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
5+
"location": "[parameters('workspace-location')]",
6+
"kind": "Customizable",
7+
"properties": {
8+
"connectorUiConfig": {
9+
"title": "SAP Enterprise Threat Detection, cloud edition",
10+
"logo": "SapLogo.svg",
11+
"id": "SAPETDAlerts",
12+
"publisher": "SAP",
13+
"descriptionMarkdown": "The SAP Enterprise Threat Detection, cloud edition (ETD) data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.",
14+
"graphQueriesTableName": "SAPETDAlerts_CL",
15+
"graphQueries": [
16+
{
17+
"metricName": "Total events received",
18+
"legend": "ETD Events",
19+
"baseQuery": "{{graphQueriesTableName}}"
20+
}
21+
],
22+
"sampleQueries": [
23+
{
24+
"description": "Get Sample of ETD Events",
25+
"query": "{{graphQueriesTableName}}\n | take 10"
26+
}
27+
],
28+
"dataTypes": [
29+
{
30+
"name": "{{graphQueriesTableName}}",
31+
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
32+
}
33+
],
34+
"connectivityCriteria": [
35+
{
36+
"type": "HasDataConnectors"
37+
}
38+
],
39+
"availability": {
40+
"isPreview": true
41+
},
42+
"permissions": {
43+
"resourceProvider": [
44+
{
45+
"provider": "Microsoft.OperationalInsights/workspaces",
46+
"permissionsDisplayText": "Read and Write permissions are required.",
47+
"providerDisplayName": "Workspace",
48+
"scope": "Workspace",
49+
"requiredPermissions": {
50+
"write": true,
51+
"read": true,
52+
"delete": true
53+
}
54+
},
55+
{
56+
"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
57+
"permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
58+
"providerDisplayName": "Keys",
59+
"scope": "Workspace",
60+
"requiredPermissions": {
61+
"action": true
62+
}
63+
}
64+
],
65+
"customs": [
66+
{
67+
"name": "Client Id and Client Secret for ETD Retrieval API",
68+
"description": "Enable API access in ETD."
69+
}
70+
]
71+
},
72+
"instructionSteps": [
73+
{
74+
"description": "**Step 1 - Configuration steps for the SAP ETD Audit Retrieval API**\n\nFollow the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**.\n\n>**NOTE:** You can onboard one or more ETD subaccounts by following the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment/). Add a connection for each subaccount."
75+
},
76+
{
77+
"description": "Connect using OAuth client credentials",
78+
"title": "Connect events from SAP ETD to Microsoft Sentinel",
79+
"instructions": [
80+
{
81+
"type": "ContextPane",
82+
"parameters": {
83+
"contextPaneType": "DataConnectorsContextPane",
84+
"label": "Add account",
85+
"isPrimary": true,
86+
"title": "ETD connection",
87+
"instructionSteps": [
88+
{
89+
"title": "Account Details",
90+
"instructions": [
91+
{
92+
"type": "Textbox",
93+
"parameters": {
94+
"label": "SAP ETD Client ID",
95+
"placeholder": "Client ID",
96+
"type": "text",
97+
"name": "clientId"
98+
}
99+
},
100+
{
101+
"type": "Textbox",
102+
"parameters": {
103+
"label": "SAP ETD Client Secret",
104+
"placeholder": "Client Secret",
105+
"type": "password",
106+
"name": "clientSecret"
107+
}
108+
},
109+
{
110+
"type": "Textbox",
111+
"parameters": {
112+
"label": "Authorization server URL (UAA server)",
113+
"placeholder": "https://your-tenant.authentication.region.hana.ondemand.com/oauth/token",
114+
"type": "text",
115+
"name": "authServerUrl"
116+
}
117+
},
118+
{
119+
"type": "Textbox",
120+
"parameters": {
121+
"label": "SAP ETD data retrieval API URL",
122+
"placeholder": "https://your-etd-cloud-data-retrieval-service.cfapps.region.hana.ondemand.com",
123+
"type": "text",
124+
"name": "etdHost"
125+
}
126+
}
127+
]
128+
}
129+
]
130+
}
131+
}
132+
]
133+
},
134+
{
135+
"title": "ETD accounts",
136+
"description": "Each row represents a connected ETD account",
137+
"instructions": [
138+
{
139+
"type": "DataConnectorsGrid",
140+
"parameters": {
141+
"mapping": [
142+
{
143+
"columnName": "Data retrieval endpoint",
144+
"columnValue": "properties.request.apiEndpoint"
145+
}
146+
],
147+
"menuItems": [
148+
"DeleteConnector"
149+
]
150+
}
151+
}
152+
]
153+
}
154+
],
155+
"metadata": {
156+
"id": "SAPSAPETD",
157+
"version": "3.1.0",
158+
"kind": "dataConnector",
159+
"source": {
160+
"kind": "solution",
161+
"name": "SAP ETD Cloud for Microsoft Sentinel"
162+
},
163+
"author": {
164+
"name": "Michael Schmitt",
165+
"email": "m.schmitt@sap.com"
166+
},
167+
"support": {
168+
"tier": "Partner",
169+
"name": "SAP SE",
170+
"email": "support@sap.com",
171+
"link": "https://me.sap.com/"
172+
}
173+
}
174+
}
175+
}
176+
}

0 commit comments

Comments
 (0)