Skip to content

Commit b851d98

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #12415 from MartinPankraz/enhance-sap-logserv
Enhance SAP LogServ
2 parents e742095 + 6d49569 commit b851d98

File tree

12 files changed

+1146
-13
lines changed

12 files changed

+1146
-13
lines changed

‎.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,24 @@
11
[
2+
{
3+
"id": "e8394afb-82a7-4718-8d31-cc57ad352fa8",
4+
"templateName": "SAPLogServ-AuditTrailPolicyChanges.yaml",
5+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
6+
},
7+
{
8+
"id": "a9e4b02a-5a8c-4c59-9836-a204d1028632",
9+
"templateName": "SAPLogServ-UserAdminActions.yaml",
10+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
11+
},
12+
{
13+
"id": "8fb9fb88-693f-4906-8be2-4bb9771418fc",
14+
"templateName": "SAPLogServ-DeactivationofAuditTrail.yaml",
15+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
16+
},
17+
{
18+
"id": "4981469b-8618-43a7-b44c-5744594fa494",
19+
"templateName": "SAPLogServ-AssignAdminAuthorizations.yaml",
20+
"validationFailReason": "The name 'Raw' does not refer to any known column, table, variable or function."
21+
},
222
{
323
"id": "5dd72ebe-03ac-43ac-851b-68cfe5106e4f",
424
"templateName": "SAPETD-LoginFromUnexpectedNetwork.yaml",

‎Solutions/SAP LogServ/Analytic Rules/SAPLogServ-AssignAdminAuthorizations.yaml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
id: 4981469b-8618-43a7-b44c-5744594fa494
2+
kind: Scheduled
3+
name: SAP LogServ - HANA DB - Assign Admin Authorizations
4+
description: |
5+
Identifies admin privileges/roles assignment.
6+
7+
Source Action: Assign a user with any Admin role / privileges.
8+
9+
*Data Sources: SAP LogServ - HANA DB (Syslog)*
10+
severity: High
11+
status: Available
12+
requiredDataConnectors:
13+
- connectorId: SAPLogServ
14+
dataTypes:
15+
- SAPLogServ_CL
16+
queryFrequency: 10m
17+
queryPeriod: 1h
18+
triggerOperator: gt
19+
triggerThreshold: 0
20+
tactics:
21+
- PrivilegeEscalation
22+
relevantTechniques: []
23+
query: |
24+
let AuditTimeAgo = 60m;
25+
SAPLogServ_CL
26+
| where TimeGenerated >= ago(AuditTimeAgo)
27+
| where clz_subdir == "hanaaudit"
28+
| extend raw_split = split(Raw, ";")
29+
| extend
30+
event_timestamp__col_0 = tostring(raw_split[0]),
31+
service_name__col_1 = tostring(raw_split[1]),
32+
hostname__col_2 = tostring(raw_split[2]),
33+
sid__col_3 = tostring(raw_split[3]),
34+
instance_number__col_4 = tostring(raw_split[4]),
35+
port_number__col_5 = tostring(raw_split[5]),
36+
database_name__col_6 = tostring(raw_split[6]),
37+
client_ip_address__col_7 = tostring(raw_split[7]),
38+
client_name__col_8 = tostring(raw_split[8]),
39+
client_process_id__col_9 = tostring(raw_split[9]),
40+
client_port_number__col_10 = tostring(raw_split[10]),
41+
policy_name__col_11 = tostring(raw_split[11]),
42+
audit_level__col_12 = tostring(raw_split[12]),
43+
audit_action__col_13 = tostring(raw_split[13]),
44+
session_user__col_14 = tostring(raw_split[14]),
45+
target_schema__col_15 = tostring(raw_split[15]),
46+
target_object__col_16 = tostring(raw_split[16]),
47+
privilege_name__col_17 = tostring(raw_split[17]),
48+
grantable__col_18 = tostring(raw_split[18]),
49+
role_name__col_19 = tostring(raw_split[19]),
50+
target_principal__col_20 = tostring(raw_split[20]),
51+
action_status__col_21 = tostring(raw_split[21]),
52+
component__col_22 = tostring(raw_split[22]),
53+
section__col_23 = tostring(raw_split[23]),
54+
parameter__col_24 = tostring(raw_split[24]),
55+
old_value__col_25 = tostring(raw_split[25]),
56+
new_value__col_26 = tostring(raw_split[26]),
57+
comment__col_27 = tostring(raw_split[27]),
58+
executed_statement__col_28 = tostring(raw_split[28]),
59+
session_id__col_29 = tostring(raw_split[29]),
60+
application_user_name__col_30 = tostring(raw_split[30]),
61+
role_schema_name__col_31 = tostring(raw_split[31]),
62+
grantee_schema_name__col_32 = tostring(raw_split[32]),
63+
origin_database_name__col_33 = tostring(raw_split[33]),
64+
origin_user_name__col_34 = tostring(raw_split[34]),
65+
xs_application_user_name__col_35 = tostring(raw_split[35]),
66+
application_name__col_36 = tostring(raw_split[36]),
67+
statement_user_name__col_37 = tostring(raw_split[37]),
68+
create_time__col_38 = tostring(raw_split[38]),
69+
xsa_message_ip__col_39 = tostring(raw_split[39]),
70+
xsa_tenant__col_40 = tostring(raw_split[40]),
71+
xsa_uuid__col_41 = tostring(raw_split[41]),
72+
xsa_channel__col_42 = tostring(raw_split[42]),
73+
xsa_attachment_id__col_43 = tostring(raw_split[43]),
74+
xsa_attachment_name__col_44 = tostring(raw_split[44]),
75+
xsa_organization_id__col_45 = tostring(raw_split[45]),
76+
xsa_space_id__col_46 = tostring(raw_split[46]),
77+
xsa_instance_id__col_47 = tostring(raw_split[47]),
78+
xsa_binding_id__col_48 = tostring(raw_split[48]),
79+
xsa_object__col_49 = tostring(raw_split[49]),
80+
xsa_data_subject__col_50 = tostring(raw_split[50])
81+
| where
82+
audit_action__col_13 =~ "GRANT PRIVILEGE"
83+
and privilege_name__col_17 contains "ADMIN"
84+
| extend AlertRuleUniqueName = 'hanadb-assignadminauthorizations-logserv'
85+
eventGroupingSettings:
86+
aggregationKind: SingleAlert
87+
entityMappings:
88+
- entityType: CloudApplication
89+
fieldMappings:
90+
- identifier: AppId
91+
columnName: sid__col_3
92+
- identifier: InstanceName
93+
columnName: database_name__col_6
94+
- entityType: Host
95+
fieldMappings:
96+
- identifier: FullName
97+
columnName: hostname__col_2
98+
- entityType: IP
99+
fieldMappings:
100+
- identifier: Address
101+
columnName: client_ip_address__col_7
102+
alertDetailsOverride:
103+
alertDisplayNameFormat: 'SAP LogServ - HANA DB - Assign Admin Authorizations'
104+
alertDescriptionFormat: |
105+
{{comment__col_27}}
106+
customDetails:
107+
SAP_User: session_user__col_14
108+
version: 1.0.0

‎Solutions/SAP LogServ/Analytic Rules/SAPLogServ-AuditTrailPolicyChanges.yaml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
id: e8394afb-82a7-4718-8d31-cc57ad352fa8
2+
kind: Scheduled
3+
name: SAP LogServ - HANA DB - Audit Trail Policy Changes
4+
description: |
5+
Identifies changes for HANA DB audit trail policies.
6+
7+
Source Action: Create / update existing audit policy in security definitions.
8+
9+
*Data Sources: SAP LogServ - HANA DB (Syslog)*
10+
severity: High
11+
status: Available
12+
requiredDataConnectors:
13+
- connectorId: SAPLogServ
14+
dataTypes:
15+
- SAPLogServ_CL
16+
queryFrequency: 10m
17+
queryPeriod: 1h
18+
triggerOperator: gt
19+
triggerThreshold: 0
20+
tactics:
21+
- Persistence
22+
- LateralMovement
23+
- DefenseEvasion
24+
relevantTechniques: []
25+
query: |
26+
let AuditTimeAgo = 60m;
27+
SAPLogServ_CL
28+
| where TimeGenerated >= ago(AuditTimeAgo)
29+
| where clz_subdir == "hanaaudit"
30+
| extend raw_split = split(Raw, ";")
31+
| extend
32+
event_timestamp__col_0 = tostring(raw_split[0]),
33+
service_name__col_1 = tostring(raw_split[1]),
34+
hostname__col_2 = tostring(raw_split[2]),
35+
sid__col_3 = tostring(raw_split[3]),
36+
instance_number__col_4 = tostring(raw_split[4]),
37+
port_number__col_5 = tostring(raw_split[5]),
38+
database_name__col_6 = tostring(raw_split[6]),
39+
client_ip_address__col_7 = tostring(raw_split[7]),
40+
client_name__col_8 = tostring(raw_split[8]),
41+
client_process_id__col_9 = tostring(raw_split[9]),
42+
client_port_number__col_10 = tostring(raw_split[10]),
43+
policy_name__col_11 = tostring(raw_split[11]),
44+
audit_level__col_12 = tostring(raw_split[12]),
45+
audit_action__col_13 = tostring(raw_split[13]),
46+
session_user__col_14 = tostring(raw_split[14]),
47+
target_schema__col_15 = tostring(raw_split[15]),
48+
target_object__col_16 = tostring(raw_split[16]),
49+
privilege_name__col_17 = tostring(raw_split[17]),
50+
grantable__col_18 = tostring(raw_split[18]),
51+
role_name__col_19 = tostring(raw_split[19]),
52+
target_principal__col_20 = tostring(raw_split[20]),
53+
action_status__col_21 = tostring(raw_split[21]),
54+
component__col_22 = tostring(raw_split[22]),
55+
section__col_23 = tostring(raw_split[23]),
56+
parameter__col_24 = tostring(raw_split[24]),
57+
old_value__col_25 = tostring(raw_split[25]),
58+
new_value__col_26 = tostring(raw_split[26]),
59+
comment__col_27 = tostring(raw_split[27]),
60+
executed_statement__col_28 = tostring(raw_split[28]),
61+
session_id__col_29 = tostring(raw_split[29]),
62+
application_user_name__col_30 = tostring(raw_split[30]),
63+
role_schema_name__col_31 = tostring(raw_split[31]),
64+
grantee_schema_name__col_32 = tostring(raw_split[32]),
65+
origin_database_name__col_33 = tostring(raw_split[33]),
66+
origin_user_name__col_34 = tostring(raw_split[34]),
67+
xs_application_user_name__col_35 = tostring(raw_split[35]),
68+
application_name__col_36 = tostring(raw_split[36]),
69+
statement_user_name__col_37 = tostring(raw_split[37]),
70+
create_time__col_38 = tostring(raw_split[38]),
71+
xsa_message_ip__col_39 = tostring(raw_split[39]),
72+
xsa_tenant__col_40 = tostring(raw_split[40]),
73+
xsa_uuid__col_41 = tostring(raw_split[41]),
74+
xsa_channel__col_42 = tostring(raw_split[42]),
75+
xsa_attachment_id__col_43 = tostring(raw_split[43]),
76+
xsa_attachment_name__col_44 = tostring(raw_split[44]),
77+
xsa_organization_id__col_45 = tostring(raw_split[45]),
78+
xsa_space_id__col_46 = tostring(raw_split[46]),
79+
xsa_instance_id__col_47 = tostring(raw_split[47]),
80+
xsa_binding_id__col_48 = tostring(raw_split[48]),
81+
xsa_object__col_49 = tostring(raw_split[49]),
82+
xsa_data_subject__col_50 = tostring(raw_split[50])
83+
| where audit_action__col_13 contains 'AUDIT POLICY'
84+
| extend AlertRuleUniqueName = 'hanadb-audittrailpolicychanges-logserv'
85+
eventGroupingSettings:
86+
aggregationKind: SingleAlert
87+
entityMappings:
88+
- entityType: CloudApplication
89+
fieldMappings:
90+
- identifier: AppId
91+
columnName: sid__col_3
92+
- identifier: InstanceName
93+
columnName: database_name__col_6
94+
- entityType: Host
95+
fieldMappings:
96+
- identifier: FullName
97+
columnName: hostname__col_2
98+
- entityType: IP
99+
fieldMappings:
100+
- identifier: Address
101+
columnName: client_ip_address__col_7
102+
alertDetailsOverride:
103+
alertDisplayNameFormat: 'SAP LogServ - HANA DB - Audit Trail Policy Change'
104+
alertDescriptionFormat: |
105+
{{comment__col_27}}
106+
customDetails:
107+
SAP_User: session_user__col_14
108+
version: 1.0.0

‎Solutions/SAP LogServ/Analytic Rules/SAPLogServ-DeactivationofAuditTrail.yaml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
id: 8fb9fb88-693f-4906-8be2-4bb9771418fc
2+
kind: Scheduled
3+
name: SAP LogServ - HANA DB - Deactivation of Audit Trail
4+
description: |
5+
Identifies deactivation of HANA DB audit log.
6+
7+
Source Action: Deactivate Audit Log in HANA DB security defnitions.
8+
9+
*Data Sources: SAP LogServ - HANA DB (Syslog)*
10+
severity: High
11+
status: Available
12+
requiredDataConnectors:
13+
- connectorId: SAPLogServ
14+
dataTypes:
15+
- SAPLogServ_CL
16+
queryFrequency: 10m
17+
queryPeriod: 1h
18+
triggerOperator: gt
19+
triggerThreshold: 0
20+
tactics:
21+
- Persistence
22+
- LateralMovement
23+
- DefenseEvasion
24+
relevantTechniques: []
25+
query: |
26+
let AuditTimeAgo = 60m;
27+
SAPLogServ_CL
28+
| where TimeGenerated >= ago(AuditTimeAgo)
29+
| where clz_subdir == "hanaaudit"
30+
| extend raw_split = split(Raw, ";")
31+
| extend
32+
event_timestamp__col_0 = tostring(raw_split[0]),
33+
service_name__col_1 = tostring(raw_split[1]),
34+
hostname__col_2 = tostring(raw_split[2]),
35+
sid__col_3 = tostring(raw_split[3]),
36+
instance_number__col_4 = tostring(raw_split[4]),
37+
port_number__col_5 = tostring(raw_split[5]),
38+
database_name__col_6 = tostring(raw_split[6]),
39+
client_ip_address__col_7 = tostring(raw_split[7]),
40+
client_name__col_8 = tostring(raw_split[8]),
41+
client_process_id__col_9 = tostring(raw_split[9]),
42+
client_port_number__col_10 = tostring(raw_split[10]),
43+
policy_name__col_11 = tostring(raw_split[11]),
44+
audit_level__col_12 = tostring(raw_split[12]),
45+
audit_action__col_13 = tostring(raw_split[13]),
46+
session_user__col_14 = tostring(raw_split[14]),
47+
target_schema__col_15 = tostring(raw_split[15]),
48+
target_object__col_16 = tostring(raw_split[16]),
49+
privilege_name__col_17 = tostring(raw_split[17]),
50+
grantable__col_18 = tostring(raw_split[18]),
51+
role_name__col_19 = tostring(raw_split[19]),
52+
target_principal__col_20 = tostring(raw_split[20]),
53+
action_status__col_21 = tostring(raw_split[21]),
54+
component__col_22 = tostring(raw_split[22]),
55+
section__col_23 = tostring(raw_split[23]),
56+
parameter__col_24 = tostring(raw_split[24]),
57+
old_value__col_25 = tostring(raw_split[25]),
58+
new_value__col_26 = tostring(raw_split[26]),
59+
comment__col_27 = tostring(raw_split[27]),
60+
executed_statement__col_28 = tostring(raw_split[28]),
61+
session_id__col_29 = tostring(raw_split[29]),
62+
application_user_name__col_30 = tostring(raw_split[30]),
63+
role_schema_name__col_31 = tostring(raw_split[31]),
64+
grantee_schema_name__col_32 = tostring(raw_split[32]),
65+
origin_database_name__col_33 = tostring(raw_split[33]),
66+
origin_user_name__col_34 = tostring(raw_split[34]),
67+
xs_application_user_name__col_35 = tostring(raw_split[35]),
68+
application_name__col_36 = tostring(raw_split[36]),
69+
statement_user_name__col_37 = tostring(raw_split[37]),
70+
create_time__col_38 = tostring(raw_split[38]),
71+
xsa_message_ip__col_39 = tostring(raw_split[39]),
72+
xsa_tenant__col_40 = tostring(raw_split[40]),
73+
xsa_uuid__col_41 = tostring(raw_split[41]),
74+
xsa_channel__col_42 = tostring(raw_split[42]),
75+
xsa_attachment_id__col_43 = tostring(raw_split[43]),
76+
xsa_attachment_name__col_44 = tostring(raw_split[44]),
77+
xsa_organization_id__col_45 = tostring(raw_split[45]),
78+
xsa_space_id__col_46 = tostring(raw_split[46]),
79+
xsa_instance_id__col_47 = tostring(raw_split[47]),
80+
xsa_binding_id__col_48 = tostring(raw_split[48]),
81+
xsa_object__col_49 = tostring(raw_split[49]),
82+
xsa_data_subject__col_50 = tostring(raw_split[50])
83+
| where
84+
audit_action__col_13 contains "AUDIT CONFIGURATION" and
85+
parameter__col_24 =~ "global_auditing_state" and
86+
new_value__col_26 =~ "false"
87+
| extend AlertRuleUniqueName = 'hanadb-deactivationofaudittrail-logserv'
88+
eventGroupingSettings:
89+
aggregationKind: SingleAlert
90+
entityMappings:
91+
- entityType: CloudApplication
92+
fieldMappings:
93+
- identifier: AppId
94+
columnName: sid__col_3
95+
- identifier: InstanceName
96+
columnName: database_name__col_6
97+
- entityType: Host
98+
fieldMappings:
99+
- identifier: FullName
100+
columnName: hostname__col_2
101+
- entityType: IP
102+
fieldMappings:
103+
- identifier: Address
104+
columnName: client_ip_address__col_7
105+
alertDetailsOverride:
106+
alertDisplayNameFormat: 'SAP LogServ - HANA DB - Deactivation of Audit Trail'
107+
alertDescriptionFormat: |
108+
{{comment__col_27}}
109+
customDetails:
110+
SAP_User: session_user__col_14
111+
version: 1.0.0

0 commit comments

Comments
 (0)