From bf442ba96a4c60389e9da94bc0a50a10a83b5aa3 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Mon, 27 Jan 2025 15:47:01 +0100 Subject: [PATCH 01/17] Initial SAP etd release --- ...P ETD - Login from unexpected network.yaml | 63 + .../SAP ETD - Synch alerts.yaml | 74 ++ Solutions/SAP ETD Cloud/Package/1.0.0.zip | Bin 0 -> 9716 bytes .../Package/createUiDefinition.json | 127 ++ .../SAP ETD Cloud/Package/mainTemplate.json | 1050 +++++++++++++++++ .../SAP ETD Cloud/Package/testParameters.json | 38 + Solutions/SAP ETD Cloud/ReleaseNotes.md | 3 + Solutions/SAP ETD Cloud/SolutionMetadata.json | 16 + 8 files changed, 1371 insertions(+) create mode 100644 Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml create mode 100644 Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml create mode 100644 Solutions/SAP ETD Cloud/Package/1.0.0.zip create mode 100644 Solutions/SAP ETD Cloud/Package/createUiDefinition.json create mode 100644 Solutions/SAP ETD Cloud/Package/mainTemplate.json create mode 100644 Solutions/SAP ETD Cloud/Package/testParameters.json create mode 100644 Solutions/SAP ETD Cloud/ReleaseNotes.md create mode 100644 Solutions/SAP ETD Cloud/SolutionMetadata.json diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml new file mode 100644 index 00000000000..b317a2dae5c --- /dev/null +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml @@ -0,0 +1,63 @@ +id: 7a830484-e349-4527-85f6-7850c468c238 +kind: Scheduled +name: "SAP ETD - Login from unexpected network" +description: "Identifies logons from an unexpected network.\r\nSource Action: Logon to the backend system from an IP address which is not assigned to one of the networks.\r\networks can be maintained in the \"SAP - Networks\" watchlist of the Sentinel Solution for SAP package.\r\n*Data Sources: SAP Enterprise Thread Detection Solution - Alerts*" +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: SAPETDAlerts + dataTypes: + - ETDAlerts_CL +queryFrequency: 1h +queryPeriod: 2d +triggerOperator: gt +triggerThreshold: 0 +tactics: [] +relevantTechniques: [] +query: | + let regex_ip = @"user_ip:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"; + let regex_user = @"user_name:(\w+)"; + let regex_sid = @"sid:(\w{3})"; + let regex_client = @"client:(\d{3})"; + let regex_instance_name = @"instance_name:(\w+)"; + let regex_instance_host = @"instance_host:([\w-]+)"; + let SAPNetworks = _GetWatchlist('SAP - Networks'); + ETDAlerts_CL + | mv-expand TriggeringEvents + | extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent) + | extend Id_ = TriggeringEvents.Id + | extend extracted_user_ip = extract(regex_ip, 1, sapOriginalEvent) + | extend extracted_sap_user = extract(regex_user, 1, sapOriginalEvent) + | extend extracted_sid = extract(regex_sid, 1, sapOriginalEvent) + | extend extracted_client = extract(regex_client, 1, sapOriginalEvent) + | extend extracted_instance_name = extract(regex_instance_name, 1, sapOriginalEvent) + | extend extracted_instance_host = extract(regex_instance_host, 1, sapOriginalEvent) + | evaluate ipv4_lookup(SAPNetworks, extracted_user_ip, Network, return_unmatched = true) + | where isempty(Network) + | project TimeGenerated, extracted_user_ip, extracted_sap_user, extracted_sid, extracted_client, extracted_instance_name, extracted_instance_host, AlertId, PatternName, PatternDescription, Status + | extend GeoLocation= iff(ipv4_is_private( extracted_user_ip), dynamic({"IsPrivate": true}), geo_info_from_ip_address(extracted_user_ip)) +eventGroupingSettings: + aggregationKind: AlertPerResult +entityMappings: + - entityType: CloudApplication + fieldMappings: + - identifier: AppId + columnName: extracted_sid + - identifier: InstanceName + columnName: extracted_instance_name + - entityType: Host + fieldMappings: + - identifier: FullName + columnName: extracted_instance_host + - entityType: IP + fieldMappings: + - identifier: Address + columnName: extracted_user_ip +alertDetailsOverride: + alertDisplayNameFormat: 'SAP ETD - {{PatternName}} ' + alertDescriptionFormat: | + {{PatternDescription}} +customDetails: + SAP_User: extracted_sap_user + ETD_AlertID: AlertId +version: 1.0.0 diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml new file mode 100644 index 00000000000..db7963e388c --- /dev/null +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml @@ -0,0 +1,74 @@ +id: 7a830484-e349-4527-85f6-7850c468c238 +kind: Scheduled +name: SAP ETD - Synch alerts +description: Synch alerts coming in from SAP® enterprise threat detection into Sentinel + (one way) +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: SAPETDAlerts + dataTypes: + - ETDAlerts_CL +queryFrequency: 1h +queryPeriod: 2d +triggerOperator: gt +triggerThreshold: 0 +tactics: [] +relevantTechniques: [] +query: | + let minThreshold= 1; + let minScore= 50; + let lookBack= 70d; + ETDAlerts_CL + // | where CreationTimestamp > ago(lookBack) + | where PatternName <> "Logon from external with SAP standard users" + | summarize arg_max(TimeGenerated, *) by AlertId, Id + | project-away TenantId, Type, Version, EventSourceId, Technical* + | where Threshold >= minThreshold and Score >= minScore + | order by Timestamp + | extend NewEvent= split(OriginalEvent, "\n") + | mv-expand NewEvent to typeof(string) + | parse NewEvent with Key: string ":" Value: string + | extend + Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value), + Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key) + | extend KV= bag_pack(Key, Value) + | summarize + KeyValues= make_bag(KV), + take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent) + by AlertId, Id + | extend + SystemId= KeyValues.sid, + ClienId= KeyValues.client, + Host= KeyValues.instance_host, + Instance= KeyValues.instance_name, + User= KeyValues.user_name, + IP= KeyValues.user_ip +eventGroupingSettings: + aggregationKind: AlertPerResult +entityMappings: + - entityType: CloudApplication + fieldMappings: + - identifier: Name + columnName: SystemId + - identifier: AppId + columnName: ClienId + - identifier: InstanceName + columnName: Instance + - entityType: Host + fieldMappings: + - identifier: FullName + columnName: Host + - entityType: IP + fieldMappings: + - identifier: Address + columnName: IP +alertDetailsOverride: + alertDisplayNameFormat: 'SAP ETD - {{PatternName}} ' + alertDescriptionFormat: | + Alert synched from SAP® enterprise threat detection into Sentinel (one way). + {{PatternDescription}} +customDetails: + SAP_User: User + ETD_AlertID: AlertId +version: 1.0.0 \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Package/1.0.0.zip b/Solutions/SAP ETD Cloud/Package/1.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..c4a30d64440f038096601d9a4847a8f555ac9bdf GIT binary patch literal 9716 zcma)?V{j&1v#y`m$;6)6HYc|2OgOP^b7I@JjVHEk+cx(5o~pCYw||_f-Cea%)z$0g z)wS+hK^hDk4FLU5$~y6A0sbQ}0fYb}hd%~Re^kvy{+O8Cm^+!<+R$4#+S)j~!2v+P z|E>K$i>e9&0LmyL#Z)sT#kBr!is_`rxy?E|+84k6wSXC}6;ypDI2Jp&G#m$2JLoA6 z>F)?4L|CnSI(oFS_{7adxLVUyunVFmO3(N#VO?6y`V6b{TK*8ppV{ZG^b4WW{3HYK zb3shfrLH2KD{BjQQDU!hu?muyv<7pK58lO^KgtU^SqeUP2s!bJ)9JXhqvTi%l0RQQ z5+~aZl4-CzM}iJ(;&)674luK?jR#f40?ZR1146a1*;;y6ZmaDn!%}2$^@9cw3`cxsD?qA+7B1(}5-20h3(lA+L+0kvKooxtXlQCW6vSnqxok#P$Z1`7d3j;cZ#qx9VtUpsj|d*mgy#- zR7?lanb&rLY$H(?CO_BQAK#nXYI0l&!x3uu9~rBw3oG`#M2M{XETp%`FJ$67#SPp#vVL@SJ$6Cfu+F`YyCOY2aF z+{6k9-%x?g6Co$65mK0}Wt`s#(6cp2n8N#UL@z{2jsCEEg<^aQF_}V1wR@Oe$_3JI z1K)$nOP!@po}xn&Uep85MK3Ri>5yLtUM+ zCOxT|6|exeD&13XpXaWqI;BX~M(?~XN}VkosM-^$CbgZKD5N27PUU@2dx+N&s2w;c zQdSx+xvsmsnxnw`5rJD z9QBSs@dO2;#d-4#wfuX2(Kb(Foj!H|wxjO(;?~U3zHHTmVjRjW)uVo|#k7DOYNisQ;<0Gj=J!#^jG}bfF2}XQ ztKX6ZaR;Ul`B^R^&&b%g14s->gAz< zbi!E=^?M%9_3=*w`WAzdu)^ojjj}jwuoM1*{d)Q-EZHpG)F1cemSU`7h@;K7ar7Y` zH%pcF{q?~~|3zU#6-EN$V}numgxgJe(;Cc0zs3$zl>`~rt!SQ@yvHnbv`Hcp6XnL~Wf(20C7nX0x{A9f-~y zs#g=h&30SSsE%eZF0OTA%ySdLBzeX>Lg9@Dq{#1m*OC0QeyN{VkFF6P5mJk>?+RTb zf42~|daZ+7n(Q~jT-ASVr_Scm6lpqM=>ow+nx1Q2*^bv%zP9mv^I{*qd!aA-HDF`5 z??N&Rq;D&l4x%(yCp(G|qBNH+HPqGWEnNhzrjMo@_3r_9o{2G$|BAZuRiYdGo!1J4STTBfoPgPy2VX zXE?4|EaOFQ$#4keYzDmUh4g2ya60)sVc*d(PiQ$66i0ur;TQSM9JpV+2%_v%V3>es zy>I<8s;q}VmInd;bG_CKw>H{t` zYkoo6C;#`@dv}ZmUSZtiZxKNp#3eC{N+eM?w)vDBLmmg=aNTR`*jQGRso2aSm|JYe zRN;8PAl7J@C=<1K9RS&0(8rw?qA|XF;DRIViN$A>CWHCG3W(GDACZyi$X1_B#xp{d zcp2>1L+UX4z1X!0rP42<>f-8OWHvH*7;Pzx2kvMSZuiSPq~|jkMm_~TU1>F1=(Sv3 z_GvR(XJY~U753psX7^Ed+^MnnIUdX5mczAEw1x*!mg0hVnG^?DE@|g1 zNGW_Kk~qyWl|2`>29bm6t@ZXl4hPwz0z}B6r6#;r(}qqpeIi9EPG>o>2l9^lz8!xU zw9{YQenFZRiymc$is_j4z9tVGlSS!x9M$DN@Tzu*)4R#TY#TI5UV*!1rhH2%t{(L4 zzRbsxO-XzhDaMErUReVEE?u)sKz_bv_+-2MqHg=3d|c^h0QO^SQPb&k2a7mWKq}+$ zZL9pWfkL$Xp!>YKJxaLF*0{J$;MbP#_Iap!++051*4XxWek}ex$hf``j{(y3j0MIs zGH>zQL4I0IiVaW5k#Mx}-59wt%kD+tlfpeI58G@&6*Kkb>KRt>qQI`$k67u` zh!y?t%KzO=zv}MiRiK&C_fu%J0r!Q^Dw}X^^A|0R(<{D~RmGFUlW|N|M|Vc)FGyxE zks&$v985pTA(7&RUh_lc@w)NMWIYkbO6kgFW`h%Cb@Fu2WrHc~Qtd1nf+Ak=+5UvL z>F(ld$^e?g+wgoe&&nCtFIt^Y|2X@(OZ@LmqN4Q;KNgDXH>w)VJ-o=-U=L?bv z>=L$=+dz-Q+_Y$fJN%XQ-4nG5sY^KST{|aQ`2vZt=2EIOJn^jE@YRwoxaWFFja3Li8$xCeyPw3;glcjc^K5-10Nz)1fFS z{!ayeod^4kL_JKWm$CIVgi0U2B!UGSGcdZQNS09JZW^{V*I+a}t1M%;!Z>)%61e4K z!&fY|6@S6ZHMI!a*H=UH7O|zmPEiNkKmcaI4n;MC4qC1E*RwCQLZGO@fkUX=fSC|p z&p1YMZVtHPy6umbTF;Y5Eqoi!Mz~_CF8WpHqRq0?aW5U=!ac4>L$z(_sp=CPK~GvD z#w64pj%>*6`$((L^_3L)m`g&#>5=7(yEsg6OkXhnhe)rE)1C&I9PUl;Ur!wDBeruJ zn}e(Ujq)4VC;Uzr@y9`O0sf%1>`$um!s&p;Rv77QK8pRVbA1$v`urc!euqK1g46)U z?L6e?bkW<^P`f=RcCe|>BxD>}In#%IK&W@GSK|0dowgo{>2i>f2f+6y=L#GaV0A6O z7XAP{?C3s)qP8kTg!wA=La#3#U%Cv*HtpA=B3|`0MQmI&udf;*8HfrDMV?o`?{Ksr zI26rZ;w)6o9mz0}?J7FKBR29?xN97by+8EF?hk0zpYQuWOLi{i3<-qO&x5Mj65)Ga z1x~U$@vV?|Mk^6Yj%ZxEWJPfO+J0RjU*RcEA3;ZXA7FjmVcSnnL-lNzx*`DjaB>Q8 z-vx=Y%b0fTl!1t%+f8`@@Gfru-EUC&u;AVyF0HP&Q*5q+1m%@GOlXNHRs9GnoiF;3 zB7p8ST06q;&%#=vN2J2_$K1X);kzNa4^jT3FKWZ*kXfv$(mcbnt~PM&BW!PpXw>w= zTe~Sw8NFFMO~rMEz-#1l+-Dl9I;rwh4yr##=?=Z6N#}={L&f>_W@x zDcbK5cBnf|YaU(>;|>A?j-&ORe})o%&dN?_|6?|kNVt+~63Fj2_7tU13T=iA9D@20 zgqL3X7c=>JMw8s!p4$;5*`wA|nPo`S#nyG^nzAX zcYm+p`~<2+MNyYAPDl@Hi<#YtU&WDr-W z>P_Q_WSR?9E7j<7noqeAYP44OvR$o-momMGr0;X)v-g>MR@ty(7k?rTXQyZTB`0Dw z*=FjMU6RN-F{7g9E}sx#ACokSB-~_>rxSDdO3-+p`rN{PA1>kz2}a59&%I>^qiMN) z($vd3aKyG^!QEI+Q3MF_{cj72h|u}6nU*K!3D!BWK$MmVQn71+?J#}oj1i)AQ?0#c zLDm9EcJ}bu4ds?EINY>?y6;nERkE(OS#y1C6Gs-O=+zCZNk7BD3|uAo(zE`t0%|4# z-k*bNIfMK5xd%${$^2M{bvwdm2@6mis1o3nrw!otSWyLa4Df&I``hd@prwD(%~64| zOm+(-&>g*rLZ0r#DiGZq)zRxiqQI^_3}7;`j|}&6g%XQLyxQHl8iHlAh|LT`<0A32 z@!9@5ny~PvqSgwC^Att(JZrPhCp1|ni!fC(kjb;_y31Qq6ec(Hxor+}NVgSP7%dZi zs*g(Ttq)_|*?X+c{z;g9N3UAe#k`CJZS;g}#dH_>;k=O$vihXY>%wP^K(HM-TyUhf zJoM`n7bW(G5F&;RYmm!h&0&as$zPWnINRGYSeev{{InNceKl*%T1nB+z5)+CSPa`T zOun_BouM{Mp*rFk1cNd&yAKf3K5Fo6CzxqfK(*W0!(Z$aeVKvx@wgxMQx(YbwL9>B zaq$AbNs>FF#%u!N$NU{(@o6saZNNV$@<%jE98U8>z1S5hnMk$!VWlja1ag!1{D{%K zRv-{fqluxNtWt&lse%^a7MR#g#I6v@44^RvDUH8nRcIp-Lwbz&pxWwa-91cDeyA+o zB^=J_KRZK2cSJORA~iqADgJ_gO(E(^knora(o=ptHcn~EoKH-|t7HRHO*7Qc*)jOj z6vExU-2G!U)3Rrz2`Xo( zEAU035igKcbZ@ig9R?0Ce7}Q6#^J=3RI;86D|7szH}<)>Q|NKytE$EK0{lAz=}xI$*~W#}#)6MWuDf2-F~)+=Th<;0_x24{2tvHzBj zfTMI2uOeOO!1{=s4QkT~mCKWZnp%oA6{@VF4-=zzql&eXF315PYwfS{OiiAWjr)S{I$x@&CAWX z#sACQy%Ff>(B9%(5A<}nxuRQvx%S!M+1%#o0b*cA3_=CpH%XLcKX`Uq7$YxAp^9rp zX?-bde_KbyMS$Uonc^3ADc%$A5VZyODe4257CjX6vX(`g?^n>XFX9L#0*-v9$EB>`%5<^Qw0!KNGTnP-(>n&=YGjeU~y8J4? ze@suMPP2Rz$1JwHlEYCM7?9;9>B3@|a_7O>bAF-h&NN$ZS52v|Hc!oVx8X(SHfxq! zJL00bK!~Ex-1&?834RSMvhk-8XGZy9pM;0H3>7z0Qy=JvBJHE9`QyU{hX)f>K18H^ z1xqVBbubxU1o^(SHGDT~cQaPpdz>)Y{BITo$t4;&GC~P|A#DH|ui!@F360x=tOrNi zFixhC1_+^pHQR+`tU`<(g|ZB>2@CD?>;dJuyHy`}3-RcHvz1XO3r+*Ug7s&Kd=px0 z+id$X>lEAOp%6ncVajT}2=(ea!_8D?zvvfJ<}<(6G4Io;Ew4$Am36h%mzX-ItfRWP zpHCUiYTyt|_KbLZ%9?t%vLJch0fX_M`pKn&Q>`U{Jx|nVgQ@YxJy_j(oz7&d_#HMY zbf|ua2vxWV9fumdJlJ|=l@&X*@{6q$ucy!b$! z;WM}=jIcL~o7Zqt{?M~x8l*(I!B(7i8ZJva$YtvZz#;38Li8NQd139RL}?jQ-hHKp zuW8Hamzbr8aVrA`jactS;T@k(G-JuRen7wW3up?S^x;lMc<0{sPZHkxT4MNt;)&pz z-2m8cP@Mb*+CiJxTK|5dWg7J4vn{*o4hLlE_hO}=#KKNWU)Tst^XxfUNR#PfCogna z{Egiy?omp~JtN#kS2Tta;vEI{m_-Ow2yO{^A3-+>MGg}4ghJ5;(Nc*Mt3kdaTdZS& zp1(mmIzhEe@y;DK z6{I%Q9zH&@-YqSU=9+XL3>Pe03R?-CO0f4==+~1#9(1-OfMW5-8L;*Q&XP6yEm_Wm z8DcTvuh1`lgVQ3b9&?|clN6rZKR&ix%RRM#eEEV?A*CaJGyoFH-2I$M2k_%r<)#;` z;x>-G=w{O2H^$?J2>D<04-~9)WAUNbYwN95gE$JFSUD6wv*!sS@SB4d_+jKcgtm4a zP_PSN=YocH6lzwf$8->3lN*1j+CZ1^;pr|aIY#L_I^>F)G)qio&P{r&5+n$pwcydA zGw3=R9paV3Xw^uQLV z1S@r7{b2JxIF`dt`XVNkG3vIuEfGYgVPz3Ha&4Ov0&4eKFaRXtKq_DZ6=zUdwa#>O zoVnim$JBYIg87h`?0r=agWHrK&af!;d3f%wF?cE?mE%woah&iAktw+~j7>z~$~P$Y z$l}D6&*l|(c&s4b@RpN7ty<&2F(-BsNAhYL7kcc2173{|elaS@4oCXeMpu2~u9%rizdc{#Oof~_T&T}Ms}1{c#syvo8w5_SF(J!sAj(6tUr3ro-|BG!fX z-=_HsPA;8?W3dRTrdICdZG7$8-uHob z&_%~5cfaa1K>V)~v7P8&OkXl@^%od2|45**WKS(2@s*`Y$>@TH!>WBx8h zj9xGQ<@at9O|nC$%y?${!D#jt4(EVTi1KPH6(F z6EL=%>e+Px#E`A`s*-L@nR??s(I(wZjw*-JWmfZfnPYXOl$h$hs>RZLk96N_2z5Bs zDr6}&?aOTLOQ~_uH$c-|IeXNKSWAdveApWk1>iy5bd2%{%%vzF0~-L^7+YzRBFCqVZ)IC9cS&Lo6c4 zV=EuyuM~pSJrCBOGptlnaxN^0FPrEJW>sE{j*3%#g0%96aUw%~OzftpJ`D;jPE6iQNE|s6*%9Eh8_PJpWBAav-##6Ig31&v}fY3IM#^A)4bWXzoj3iuc&Mr(#53AW2x(lb z6jqJKM8Q`9>glE?W5G@16iUTfEAxQnSJq@gGY3T{YOWiIBpfr6QgccFVw}87GVrxp zGaB?6CE{GA%+exKKLaX&Ed1h_(zh+$p>MB>@BYBC4a_t-)hA@x$0gN=GmaNR?IN9} z<=-!13m>|uDCIlb2oi1OYuU)&@`!G(rta)(wM;3X46L_v2%X^)>HVBQubV`;uSEDa zv(nyV^`u(zTlZd~Yk?KIbua(@f=j|Zs8%C>h!Wr zD60XE#}u7D&7oVR-2FHRcvW^tw<>P^n)~b#Ji*eLB8RL;$>vp;c*9^ZsFu98ZzwTl=sqf@TCuL!d}t@qb!4+oS`1CP3L$u7l1=(;|Mx*EQTATN zOgU?w^07^mNn5b|eoQG7vkb{Bb<8TWuhXHMo-5(r_h@T#a`V)>1jkj1>9@0m{k-fk z0e#X-a<{TUEO)0>aS^+!TQAyfuu@=#a)5L%OFNpr^_guMkbSX*YOsZ_=~+$LLmJgg zZr567vx?_HJ-*x%m#SS?*-@S3{kwFVGoI%5#=7AB%evr=u3?5FiWRqFv2J_11#6;#$TTUy(f<&k_mRpYt^$NEv5X~@aqwR{$|O?Z4w z?{Hl~F%lr@cGl~qkzKTm!Vowct5P%KQ!uFlIsmlh&M4xglDOz#?t})Go*k{J^e(kI zFbhHO(#!@aq@k`@ZPp*T4yZ%am|~(m+N^S=Q<|^B#?iH(P1MpowULxlf5&70Eq}x( zIu2Ng@cF8|D}2d)ZE!^YK$x0TH7~hmA%?3_Z`UFKvLm+lkveAu?2)T0r{2<`e(LDW zXm9-?GJjG)zg*JA&ceg8&{Wd_t7;oi%79ScKFxzpe{-h{aKR*aW^aeR9XI3y`bR*S zmK3J^6POoq`pj7fkLH<~{#Bn(ge~ndUNG;- zPHGP?8WHH9Nth+YC8(;Xpn-qL)HFX}+D61Hh6A1{RZ48NvNI}v(W|-o7;i)jpmI6j zrfB0DzO&ATnW}tF1YRM1aL~iE#Yd8BMl*(MCX1^NsH zuyWn_w}EZ<4!(-|M?xG zj>fp3xZP4eu1*;NG&rn6GE0t>%o7|f@W}~u^e%G{lLF^@jRp~Wz&hKaj~gRQdR};% zC;JK~?oNcQQ|Uv3w0TmSdSfJT!7rqqgz*9-X9}Go7!Q1*E)dO`t>H;eyxH0hd_vwJ zb*XiNorr}voXo-@rCd584^>7o#XeP8cjKjGp*?-sJhs0r{X%y~pfZsCAK9Q1!UMFt zZp0aAf6ysv=58TgY8VP^CVm=7!_oSRmRB!e0Eu+>#_D#ZuIkf@(F?q951HDl$Lk-S zsjJ3!j&5BU60l=-y>R$^VaL386tFnLXpP5ksRrg$liBeRUQ z5JPqpr^oA^4iZ6RUc4^AZoc1ZzRAVC3}6vPl%yXQ7Zf(kveT`)zjTpdCzDpaV%5h7?Y{iXB|GGkJ)*Iw@$xB7tp+EDedVN4&p!w!3RSbX^2Z{j_9Jdk@Prm{FxaPy-f5h5N^gQUU+YBF)` z^v-|)5kj#3`!JP6-jfKc0ItnCH*jAugM&Uoiu}9YpNyTY4e_ezZcM=z>_`}LvC^I& zHYubU708Nc=r|!F#SVYVVU@E9hawnm3|_GzN!sm0engLaP(2!$PSfyY>PE~VaZYgQ zN$pXBht52sR0ztbkU?RYAC&`{$`Ht1kP~S1(Uy z%IdR&mg%Nj()#C_pn$b%c%U0M?U@|fMJ%TA+YcXVfHbBo)D`EQ25UystD}k!lQgxsjed zzvP%9dbWM=eS-K);HUF0u8)V1J!L8EcDZ{R6W9l;UwNtCv@I)ou{>&VS%*T++Ka!EUCUu;C}9VnRDc@n$8CaqB{Es>ntm$lO|P#dkW&lgwl zs;^cNNC_e7%LkNZFJ=LRyDSjyvfBp;la=@dRw&vtm$pD$Z^)L}YFv)!Ve@mBSl7Gw zz|e_t)wr)SN^@BBY`7AYFyAN?6XaE58pKSbRrzZRN_Fvsyn*sm; literal 0 HcmV?d00001 diff --git a/Solutions/SAP ETD Cloud/Package/createUiDefinition.json b/Solutions/SAP ETD Cloud/Package/createUiDefinition.json new file mode 100644 index 00000000000..6305e079ed3 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Package/createUiDefinition.json @@ -0,0 +1,127 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", + "handler": "Microsoft.Azure.CreateUIDef", + "version": "0.1.2-preview", + "parameters": { + "config": { + "isWizard": false, + "basics": { + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP%20ETD/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.\n\n**Data Connectors:** 1, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { + "resourceProviders": [ + "Microsoft.OperationsManagement/solutions", + "Microsoft.OperationalInsights/workspaces/providers/alertRules", + "Microsoft.Insights/workbooks", + "Microsoft.Logic/workflows" + ] + }, + "location": { + "metadata": { + "hidden": "Hiding location, we get it from the log analytics workspace" + }, + "visible": false + }, + "resourceGroup": { + "allowExisting": true + } + } + }, + "basics": [ + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "toolTip": "This filters by workspaces that exist in the Resource Group selected", + "condition": "[greater(length(resourceGroup().name),0)]", + "request": { + "method": "GET", + "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" + } + }, + { + "name": "workspace", + "type": "Microsoft.Common.DropDown", + "label": "Workspace", + "placeholder": "Select a workspace", + "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", + "constraints": { + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + } + ], + "steps": [ + { + "name": "dataconnectors", + "label": "Data Connectors", + "bladeTitle": "Data Connectors", + "elements": [ + { + "name": "dataconnectors1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for SAP ETD. You can get SAP ETD data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link2", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + } + ] + }, + { + "name": "analytics", + "label": "Analytics", + "subLabel": { + "preValidation": "Configure the analytics", + "postValidation": "Done" + }, + "bladeTitle": "Analytics", + "elements": [ + { + "name": "analytics-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view." + } + }, + { + "name": "analytics-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + }, + { + "name": "analytic1", + "type": "Microsoft.Common.Section", + "label": "SAP ETD - Synch alerts", + "elements": [ + { + "name": "analytic1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Synch alerts coming in from SAP® enterprise threat detection into Sentinel (one way)" + } + } + ] + } + ] + } + ], + "outputs": { + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "location": "[location()]", + "workspace": "[basics('workspace')]" + } + } +} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json new file mode 100644 index 00000000000..3de6ea7ff84 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -0,0 +1,1050 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "author": "SAP", + "comments": "Solution template for SAP ETD" + }, + "parameters": { + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + } + }, + "variables": { + "_solutionName": "SAP ETD", + "_solutionVersion": "3.0.0", + "solutionId": "sapetd.sapetd-alerts", + "_solutionId": "[variables('solutionId')]", + "analyticRuleObject1": { + "analyticRuleVersion1": "3.0.0", + "_analyticRulecontentId1": "7a830484-e349-4527-85f6-7850c468c238", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7a830484-e349-4527-85f6-7850c468c238')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7a830484-e349-4527-85f6-7850c468c238')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7a830484-e349-4527-85f6-7850c468c238','-', '3.0.0')))]" + }, + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "dataConnectorCCPVersion": "1.0.0", + "_dataConnectorContentIdConnectorDefinition1": "SAPETDAlerts", + "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", + "_dataConnectorContentIdConnections1": "SAPETDAlertsConnections", + "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", + "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "blanks": "[replace('b', 'b', '')]", + "TemplateEmptyObject": "[json('{}')]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SAP ETD - Synch alerts_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Synch alerts coming in from SAP® enterprise threat detection into Sentinel (one way)", + "displayName": "SAP ETD - Synch alerts", + "enabled": false, + "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nETDAlerts_CL\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId, Id\n| project-away TenantId, Type, Version, EventSourceId, Technical*\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(OriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent)\n by AlertId, Id\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", + "queryFrequency": "PT1H", + "queryPeriod": "P2D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "ETDAlerts_CL" + ], + "connectorId": "SAPETDAlerts" + } + ], + "entityMappings": [ + { + "entityType": "CloudApplication", + "fieldMappings": [ + { + "identifier": "Name", + "columnName": "SystemId" + }, + { + "identifier": "AppId", + "columnName": "ClienId" + }, + { + "identifier": "InstanceName", + "columnName": "Instance" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "identifier": "FullName", + "columnName": "Host" + } + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "IP" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "SAP_User": "User", + "ETD_AlertID": "AlertId" + }, + "alertDetailsOverride": { + "alertDescriptionFormat": "Alert synched from SAP® enterprise threat detection into Sentinel (one way).\n{{PatternDescription}}\n", + "alertDisplayNameFormat": "SAP ETD - {{PatternName}} " + } + } + }, + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Identifies logons from an unexpected network.\r\nSource Action: Logon to the backend system from an IP address which is not assigned to one of the networks.\r\networks can be maintained in the \"SAP - Networks\" watchlist of the Sentinel Solution for SAP package.\r\n*Data Sources: SAP Enterprise Thread Detection Solution - Alerts*", + "displayName": "SAP ETD - Login from unexpected network", + "enabled": false, + "query": "let regex_ip = @\"user_ip:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\";\nlet regex_user = @\"user_name:(\\w+)\";\nlet regex_sid = @\"sid:(\\w{3})\";\nlet regex_client = @\"client:(\\d{3})\";\nlet regex_instance_name = @\"instance_name:(\\w+)\";\nlet regex_instance_host = @\"instance_host:([\\w-]+)\";\nlet SAPNetworks = _GetWatchlist('SAP - Networks');\nETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n| extend Id_ = TriggeringEvents.Id\n| extend extracted_user_ip = extract(regex_ip, 1, sapOriginalEvent)\n| extend extracted_sap_user = extract(regex_user, 1, sapOriginalEvent)\n| extend extracted_sid = extract(regex_sid, 1, sapOriginalEvent)\n| extend extracted_client = extract(regex_client, 1, sapOriginalEvent)\n| extend extracted_instance_name = extract(regex_instance_name, 1, sapOriginalEvent)\n| extend extracted_instance_host = extract(regex_instance_host, 1, sapOriginalEvent)\n| evaluate ipv4_lookup(SAPNetworks, extracted_user_ip, Network, return_unmatched = true)\n| where isempty(Network)\n| project TimeGenerated, extracted_user_ip, extracted_sap_user, extracted_sid, extracted_client, extracted_instance_name, extracted_instance_host, AlertId, PatternName, PatternDescription, Status\n| extend GeoLocation= iff(ipv4_is_private( extracted_user_ip), dynamic({\"IsPrivate\": true}), geo_info_from_ip_address(extracted_user_ip))", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "ETDAlerts_CL" + ], + "connectorId": "SAPETDAlerts" + } + ], + "entityMappings": [ + { + "entityType": "CloudApplication", + "fieldMappings": [ + { + "identifier": "AppId", + "columnName": "extracted_sid" + }, + { + "identifier": "InstanceName", + "columnName": "extracted_instance_name" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "identifier": "FullName", + "columnName": "extracted_instance_host" + } + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "extracted_user_ip" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "SAP_User": "User", + "ETD_AlertID": "AlertId" + }, + "alertDetailsOverride": { + "alertDescriptionFormat": "{{PatternDescription}}\n", + "alertDisplayNameFormat": "SAP ETD - {{PatternName}} " + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", + "properties": { + "description": "SAP ETD Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "source": { + "kind": "Solution", + "name": "SAP ETD", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SAP" + }, + "support": { + "name": "SAP", + "tier": "Partner", + "link": "https://help.sap.com/docs/SAP_ENTERPRISE_THREAT_DETECTION_CLOUD_EDITION" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentKind": "AnalyticsRule", + "displayName": "SAP ETD - Synch alerts", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "displayName": "SAP ETD", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "title": "SAP ETD", + "logo": "SapLogo.svg", + "id": "SAPETDAlerts", + "publisher": "Microsoft", + "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Sentinel, supporting cross-correlation, alerting, and threat hunting.", + "graphQueriesTableName": "ETDAlerts_CL", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "ETD Events", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Get Sample of ETD Events", + "query": "{{graphQueriesTableName}}\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Client Id and Client Secret for ETD Retrieval API", + "description": "Enable API access in ETD." + } + ] + }, + "instructionSteps": [ + { + "description": "**Step 1 - Configuration steps for the SAP ETD Audit Retrieval API**\n\nFollow the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**.\n\n>**NOTE:** You can onboard one or more ETD subaccounts by following the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment/). Add a connection for each subaccount." + }, + { + "description": "Connect using OAuth client credentials", + "title": "Connect events from SAP ETD to Microsoft Sentinel", + "instructions": [ + { + "type": "ContextPane", + "parameters": { + "contextPaneType": "DataConnectorsContextPane", + "label": "Add account", + "isPrimary": true, + "title": "ETD connection", + "instructionSteps": [ + { + "title": "Account Details", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "SAP ETD Client ID", + "placeholder": "Client ID", + "type": "text", + "name": "clientId" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "SAP ETD Client Secret", + "placeholder": "Client Secret", + "type": "password", + "name": "clientSecret" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Authorization server URL (UAA server)", + "placeholder": "https://your-tenant.authentication.region.hana.ondemand.com/oauth/token", + "type": "text", + "name": "authServerUrl" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "ETD data retrieval API URL", + "placeholder": "https://your-etd-cloud-data-retrieval-service.cfapps.region.hana.ondemand.com", + "type": "text", + "name": "etdHost" + } + } + ] + } + ] + } + } + ] + }, + { + "title": "ETD accounts", + "description": "Each row represents a connected ETD account", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Data retrieval endpoint", + "columnValue": "properties.request.apiEndpoint" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SAP" + }, + "support": { + "name": "SAP", + "tier": "Partner", + "link": "https://help.sap.com/docs/SAP_ENTERPRISE_THREAT_DETECTION_CLOUD_EDITION" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "SAP-ETD-DCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "streamDeclarations": { + "Custom-ETDAlerts_CL": { + "columns": [ + { + "name": "Version", + "type": "string" + }, + { + "name": "AlertId", + "type": "int" + }, + { + "name": "PatternName", + "type": "string" + }, + { + "name": "PatternDescription", + "type": "string" + }, + { + "name": "Status", + "type": "string" + }, + { + "name": "CreationTimestamp", + "type": "datetime" + }, + { + "name": "MinTimestamp", + "type": "datetime" + }, + { + "name": "MaxTimestamp", + "type": "datetime" + }, + { + "name": "Score", + "type": "int" + }, + { + "name": "Threshold", + "type": "int" + }, + { + "name": "Measure", + "type": "int" + }, + { + "name": "TriggeringEvents", + "type": "dynamic" + } + ] + } + }, + "dataSources": "[variables('TemplateEmptyObject')]", + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-ETDAlerts_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source| extend TimeGenerated = now()", + "outputStream": "Custom-ETDAlerts_CL" + } + ], + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]" + } + }, + { + "name": "ETDAlerts_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "ETDAlerts_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "Version", + "type": "string" + }, + { + "name": "AlertId", + "type": "int" + }, + { + "name": "PatternName", + "type": "string" + }, + { + "name": "PatternDescription", + "type": "string" + }, + { + "name": "Status", + "type": "string" + }, + { + "name": "CreationTimestamp", + "type": "datetime" + }, + { + "name": "MinTimestamp", + "type": "datetime" + }, + { + "name": "MaxTimestamp", + "type": "datetime" + }, + { + "name": "Score", + "type": "int" + }, + { + "name": "Threshold", + "type": "int" + }, + { + "name": "Measure", + "type": "int" + }, + { + "name": "TriggeringEvents", + "type": "dynamic" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "title": "SAP ETD", + "logo": "SapLogo.svg", + "id": "SAPETDAlerts", + "publisher": "Microsoft", + "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Sentinel, supporting cross-correlation, alerting, and threat hunting.", + "graphQueriesTableName": "ETDAlerts_CL", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "ETD Events", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Get Sample of ETD Events", + "query": "{{graphQueriesTableName}}\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Client Id and Client Secret for ETD Retrieval API", + "description": "Enable API access in ETD." + } + ] + }, + "instructionSteps": [ + { + "description": "**Step 1 - Configuration steps for the SAP ETD Audit Retrieval API**\n\nFollow the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**.\n\n>**NOTE:** You can onboard one or more ETD subaccounts by following the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment/). Add a connection for each subaccount." + }, + { + "description": "Connect using OAuth client credentials", + "title": "Connect events from SAP ETD to Microsoft Sentinel", + "instructions": [ + { + "type": "ContextPane", + "parameters": { + "contextPaneType": "DataConnectorsContextPane", + "label": "Add account", + "isPrimary": true, + "title": "ETD connection", + "instructionSteps": [ + { + "title": "Account Details", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "SAP ETD Client ID", + "placeholder": "Client ID", + "type": "text", + "name": "clientId" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "SAP ETD Client Secret", + "placeholder": "Client Secret", + "type": "password", + "name": "clientSecret" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Authorization server URL (UAA server)", + "placeholder": "https://your-tenant.authentication.region.hana.ondemand.com/oauth/token", + "type": "text", + "name": "authServerUrl" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "ETD data retrieval API URL", + "placeholder": "https://your-etd-cloud-data-retrieval-service.cfapps.region.hana.ondemand.com", + "type": "text", + "name": "etdHost" + } + } + ] + } + ] + } + } + ] + }, + { + "title": "ETD accounts", + "description": "Each row represents a connected ETD account", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Data retrieval endpoint", + "columnValue": "properties.request.apiEndpoint" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SAP" + }, + "support": { + "name": "SAP", + "tier": "Partner", + "link": "https://help.sap.com/docs/SAP_ENTERPRISE_THREAT_DETECTION_CLOUD_EDITION" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "displayName": "SAP ETD", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "connectorDefinitionName": { + "defaultValue": "SAP ETD", + "type": "string", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "string" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "clientId": { + "defaultValue": "clientId", + "type": "string", + "minLength": 1 + }, + "clientSecret": { + "defaultValue": "clientSecret", + "type": "securestring", + "minLength": 1 + }, + "authServerUrl": { + "defaultValue": "authServerUrl", + "type": "string", + "minLength": 1 + }, + "etdHost": { + "defaultValue": "etdHost", + "type": "string", + "minLength": 1 + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "string" + } + }, + "variables": { + "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]", + "connectorName": "[[concat('ETD_', guid(parameters('etdHost')))]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SAP" + }, + "support": { + "name": "SAP", + "tier": "Partner", + "link": "https://help.sap.com/docs/SAP_ENTERPRISE_THREAT_DETECTION_CLOUD_EDITION" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/',variables('connectorName'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SAPETDAlerts", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-ETDAlerts_CL" + }, + "dataType": "ETDAlerts_CL", + "addOnAttributes": { + "SubaccountName": "[[parameters('etdHost')]" + }, + "auth": { + "type": "OAuth2", + "ClientSecret": "[[parameters('ClientSecret')]", + "ClientId": "[[parameters('ClientId')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(replace(parameters('authServerUrl'), '/oauth/token', ''), '/oauth/token?grant_type=client_credentials')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded" + } + }, + "request": { + "apiEndpoint": "[[concat(parameters('etdHost'), '/alerts/v1/Alerts')]", + "queryWindowInMin": 10, + "httpMethod": "Get", + "retryCount": 3, + "timeoutInSeconds": 60, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "queryParameters": { + "$expand": "TriggeringEvents", + "$filter": "CreationTimestamp gt {_QueryWindowStartTime} and CreationTimestamp le {_QueryWindowEndTime}" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Scuba" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ] + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.0", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "SAP ETD", + "publisherDisplayName": "SAP", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.

\n

Data Connectors: 1, Analytic Rules: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "SAP ETD", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SAP" + }, + "support": { + "name": "SAP", + "tier": "Partner", + "link": "https://help.sap.com/docs/SAP_ENTERPRISE_THREAT_DETECTION_CLOUD_EDITION" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "version": "[variables('dataConnectorCCPVersion')]" + } + ] + }, + "firstPublishDate": "2024-12-31", + "lastPublishDate": "2024-12-31", + "providers": [ + "SAP" + ], + "categories": { + "domains": [ + "Security - Threat Protection", + "Identity", + "Application Security", + "Cyber Security Alerts" + ] + } + }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + } + ], + "outputs": {} + } \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Package/testParameters.json b/Solutions/SAP ETD Cloud/Package/testParameters.json new file mode 100644 index 00000000000..0e79d6a7c29 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Package/testParameters.json @@ -0,0 +1,38 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + } +} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/ReleaseNotes.md b/Solutions/SAP ETD Cloud/ReleaseNotes.md new file mode 100644 index 00000000000..dca7ff9886a --- /dev/null +++ b/Solutions/SAP ETD Cloud/ReleaseNotes.md @@ -0,0 +1,3 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|---------------------------------------------| +| 1.0.0 | 31-12-2024 | Initial release | \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/SolutionMetadata.json b/Solutions/SAP ETD Cloud/SolutionMetadata.json new file mode 100644 index 00000000000..4ff1c7a0c2d --- /dev/null +++ b/Solutions/SAP ETD Cloud/SolutionMetadata.json @@ -0,0 +1,16 @@ +{ + "publisherId": "sapetd", + "offerId": "sapetd-alerts", + "firstPublishDate": "2024-12-31", + "lastPublishDate": "2024-12-31", + "providers": ["SAP"], + "categories": { + "domains" : ["Security - Threat Protection","Identity", "Application Security", "Cyber Security Alerts"], + "verticals": [] + }, + "support": { + "name": "SAP", + "tier": "Partner", + "link": "https://help.sap.com/docs/SAP_ENTERPRISE_THREAT_DETECTION_CLOUD_EDITION" + } +} \ No newline at end of file From 382bc1f8fbf3443ba61b6848fbdb81734485d867 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Tue, 28 Jan 2025 12:43:22 +0100 Subject: [PATCH 02/17] fix validations --- ...P ETD - Login from unexpected network.yaml | 63 --------------- .../SAP ETD - Synch alerts.yaml | 74 ------------------ Solutions/SAP ETD Cloud/Package/1.0.0.zip | Bin 9716 -> 0 bytes Solutions/SAP ETD Cloud/Package/3.0.0.zip | Bin 0 -> 9702 bytes .../SAP ETD Cloud/Package/mainTemplate.json | 7 +- 5 files changed, 3 insertions(+), 141 deletions(-) delete mode 100644 Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml delete mode 100644 Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml delete mode 100644 Solutions/SAP ETD Cloud/Package/1.0.0.zip create mode 100644 Solutions/SAP ETD Cloud/Package/3.0.0.zip diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml deleted file mode 100644 index b317a2dae5c..00000000000 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml +++ /dev/null @@ -1,63 +0,0 @@ -id: 7a830484-e349-4527-85f6-7850c468c238 -kind: Scheduled -name: "SAP ETD - Login from unexpected network" -description: "Identifies logons from an unexpected network.\r\nSource Action: Logon to the backend system from an IP address which is not assigned to one of the networks.\r\networks can be maintained in the \"SAP - Networks\" watchlist of the Sentinel Solution for SAP package.\r\n*Data Sources: SAP Enterprise Thread Detection Solution - Alerts*" -severity: Medium -status: Available -requiredDataConnectors: - - connectorId: SAPETDAlerts - dataTypes: - - ETDAlerts_CL -queryFrequency: 1h -queryPeriod: 2d -triggerOperator: gt -triggerThreshold: 0 -tactics: [] -relevantTechniques: [] -query: | - let regex_ip = @"user_ip:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"; - let regex_user = @"user_name:(\w+)"; - let regex_sid = @"sid:(\w{3})"; - let regex_client = @"client:(\d{3})"; - let regex_instance_name = @"instance_name:(\w+)"; - let regex_instance_host = @"instance_host:([\w-]+)"; - let SAPNetworks = _GetWatchlist('SAP - Networks'); - ETDAlerts_CL - | mv-expand TriggeringEvents - | extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent) - | extend Id_ = TriggeringEvents.Id - | extend extracted_user_ip = extract(regex_ip, 1, sapOriginalEvent) - | extend extracted_sap_user = extract(regex_user, 1, sapOriginalEvent) - | extend extracted_sid = extract(regex_sid, 1, sapOriginalEvent) - | extend extracted_client = extract(regex_client, 1, sapOriginalEvent) - | extend extracted_instance_name = extract(regex_instance_name, 1, sapOriginalEvent) - | extend extracted_instance_host = extract(regex_instance_host, 1, sapOriginalEvent) - | evaluate ipv4_lookup(SAPNetworks, extracted_user_ip, Network, return_unmatched = true) - | where isempty(Network) - | project TimeGenerated, extracted_user_ip, extracted_sap_user, extracted_sid, extracted_client, extracted_instance_name, extracted_instance_host, AlertId, PatternName, PatternDescription, Status - | extend GeoLocation= iff(ipv4_is_private( extracted_user_ip), dynamic({"IsPrivate": true}), geo_info_from_ip_address(extracted_user_ip)) -eventGroupingSettings: - aggregationKind: AlertPerResult -entityMappings: - - entityType: CloudApplication - fieldMappings: - - identifier: AppId - columnName: extracted_sid - - identifier: InstanceName - columnName: extracted_instance_name - - entityType: Host - fieldMappings: - - identifier: FullName - columnName: extracted_instance_host - - entityType: IP - fieldMappings: - - identifier: Address - columnName: extracted_user_ip -alertDetailsOverride: - alertDisplayNameFormat: 'SAP ETD - {{PatternName}} ' - alertDescriptionFormat: | - {{PatternDescription}} -customDetails: - SAP_User: extracted_sap_user - ETD_AlertID: AlertId -version: 1.0.0 diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml deleted file mode 100644 index db7963e388c..00000000000 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml +++ /dev/null @@ -1,74 +0,0 @@ -id: 7a830484-e349-4527-85f6-7850c468c238 -kind: Scheduled -name: SAP ETD - Synch alerts -description: Synch alerts coming in from SAP® enterprise threat detection into Sentinel - (one way) -severity: Medium -status: Available -requiredDataConnectors: - - connectorId: SAPETDAlerts - dataTypes: - - ETDAlerts_CL -queryFrequency: 1h -queryPeriod: 2d -triggerOperator: gt -triggerThreshold: 0 -tactics: [] -relevantTechniques: [] -query: | - let minThreshold= 1; - let minScore= 50; - let lookBack= 70d; - ETDAlerts_CL - // | where CreationTimestamp > ago(lookBack) - | where PatternName <> "Logon from external with SAP standard users" - | summarize arg_max(TimeGenerated, *) by AlertId, Id - | project-away TenantId, Type, Version, EventSourceId, Technical* - | where Threshold >= minThreshold and Score >= minScore - | order by Timestamp - | extend NewEvent= split(OriginalEvent, "\n") - | mv-expand NewEvent to typeof(string) - | parse NewEvent with Key: string ":" Value: string - | extend - Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value), - Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key) - | extend KV= bag_pack(Key, Value) - | summarize - KeyValues= make_bag(KV), - take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent) - by AlertId, Id - | extend - SystemId= KeyValues.sid, - ClienId= KeyValues.client, - Host= KeyValues.instance_host, - Instance= KeyValues.instance_name, - User= KeyValues.user_name, - IP= KeyValues.user_ip -eventGroupingSettings: - aggregationKind: AlertPerResult -entityMappings: - - entityType: CloudApplication - fieldMappings: - - identifier: Name - columnName: SystemId - - identifier: AppId - columnName: ClienId - - identifier: InstanceName - columnName: Instance - - entityType: Host - fieldMappings: - - identifier: FullName - columnName: Host - - entityType: IP - fieldMappings: - - identifier: Address - columnName: IP -alertDetailsOverride: - alertDisplayNameFormat: 'SAP ETD - {{PatternName}} ' - alertDescriptionFormat: | - Alert synched from SAP® enterprise threat detection into Sentinel (one way). - {{PatternDescription}} -customDetails: - SAP_User: User - ETD_AlertID: AlertId -version: 1.0.0 \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Package/1.0.0.zip b/Solutions/SAP ETD Cloud/Package/1.0.0.zip deleted file mode 100644 index c4a30d64440f038096601d9a4847a8f555ac9bdf..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 9716 zcma)?V{j&1v#y`m$;6)6HYc|2OgOP^b7I@JjVHEk+cx(5o~pCYw||_f-Cea%)z$0g z)wS+hK^hDk4FLU5$~y6A0sbQ}0fYb}hd%~Re^kvy{+O8Cm^+!<+R$4#+S)j~!2v+P z|E>K$i>e9&0LmyL#Z)sT#kBr!is_`rxy?E|+84k6wSXC}6;ypDI2Jp&G#m$2JLoA6 z>F)?4L|CnSI(oFS_{7adxLVUyunVFmO3(N#VO?6y`V6b{TK*8ppV{ZG^b4WW{3HYK zb3shfrLH2KD{BjQQDU!hu?muyv<7pK58lO^KgtU^SqeUP2s!bJ)9JXhqvTi%l0RQQ z5+~aZl4-CzM}iJ(;&)674luK?jR#f40?ZR1146a1*;;y6ZmaDn!%}2$^@9cw3`cxsD?qA+7B1(}5-20h3(lA+L+0kvKooxtXlQCW6vSnqxok#P$Z1`7d3j;cZ#qx9VtUpsj|d*mgy#- zR7?lanb&rLY$H(?CO_BQAK#nXYI0l&!x3uu9~rBw3oG`#M2M{XETp%`FJ$67#SPp#vVL@SJ$6Cfu+F`YyCOY2aF z+{6k9-%x?g6Co$65mK0}Wt`s#(6cp2n8N#UL@z{2jsCEEg<^aQF_}V1wR@Oe$_3JI z1K)$nOP!@po}xn&Uep85MK3Ri>5yLtUM+ zCOxT|6|exeD&13XpXaWqI;BX~M(?~XN}VkosM-^$CbgZKD5N27PUU@2dx+N&s2w;c zQdSx+xvsmsnxnw`5rJD z9QBSs@dO2;#d-4#wfuX2(Kb(Foj!H|wxjO(;?~U3zHHTmVjRjW)uVo|#k7DOYNisQ;<0Gj=J!#^jG}bfF2}XQ ztKX6ZaR;Ul`B^R^&&b%g14s->gAz< zbi!E=^?M%9_3=*w`WAzdu)^ojjj}jwuoM1*{d)Q-EZHpG)F1cemSU`7h@;K7ar7Y` zH%pcF{q?~~|3zU#6-EN$V}numgxgJe(;Cc0zs3$zl>`~rt!SQ@yvHnbv`Hcp6XnL~Wf(20C7nX0x{A9f-~y zs#g=h&30SSsE%eZF0OTA%ySdLBzeX>Lg9@Dq{#1m*OC0QeyN{VkFF6P5mJk>?+RTb zf42~|daZ+7n(Q~jT-ASVr_Scm6lpqM=>ow+nx1Q2*^bv%zP9mv^I{*qd!aA-HDF`5 z??N&Rq;D&l4x%(yCp(G|qBNH+HPqGWEnNhzrjMo@_3r_9o{2G$|BAZuRiYdGo!1J4STTBfoPgPy2VX zXE?4|EaOFQ$#4keYzDmUh4g2ya60)sVc*d(PiQ$66i0ur;TQSM9JpV+2%_v%V3>es zy>I<8s;q}VmInd;bG_CKw>H{t` zYkoo6C;#`@dv}ZmUSZtiZxKNp#3eC{N+eM?w)vDBLmmg=aNTR`*jQGRso2aSm|JYe zRN;8PAl7J@C=<1K9RS&0(8rw?qA|XF;DRIViN$A>CWHCG3W(GDACZyi$X1_B#xp{d zcp2>1L+UX4z1X!0rP42<>f-8OWHvH*7;Pzx2kvMSZuiSPq~|jkMm_~TU1>F1=(Sv3 z_GvR(XJY~U753psX7^Ed+^MnnIUdX5mczAEw1x*!mg0hVnG^?DE@|g1 zNGW_Kk~qyWl|2`>29bm6t@ZXl4hPwz0z}B6r6#;r(}qqpeIi9EPG>o>2l9^lz8!xU zw9{YQenFZRiymc$is_j4z9tVGlSS!x9M$DN@Tzu*)4R#TY#TI5UV*!1rhH2%t{(L4 zzRbsxO-XzhDaMErUReVEE?u)sKz_bv_+-2MqHg=3d|c^h0QO^SQPb&k2a7mWKq}+$ zZL9pWfkL$Xp!>YKJxaLF*0{J$;MbP#_Iap!++051*4XxWek}ex$hf``j{(y3j0MIs zGH>zQL4I0IiVaW5k#Mx}-59wt%kD+tlfpeI58G@&6*Kkb>KRt>qQI`$k67u` zh!y?t%KzO=zv}MiRiK&C_fu%J0r!Q^Dw}X^^A|0R(<{D~RmGFUlW|N|M|Vc)FGyxE zks&$v985pTA(7&RUh_lc@w)NMWIYkbO6kgFW`h%Cb@Fu2WrHc~Qtd1nf+Ak=+5UvL z>F(ld$^e?g+wgoe&&nCtFIt^Y|2X@(OZ@LmqN4Q;KNgDXH>w)VJ-o=-U=L?bv z>=L$=+dz-Q+_Y$fJN%XQ-4nG5sY^KST{|aQ`2vZt=2EIOJn^jE@YRwoxaWFFja3Li8$xCeyPw3;glcjc^K5-10Nz)1fFS z{!ayeod^4kL_JKWm$CIVgi0U2B!UGSGcdZQNS09JZW^{V*I+a}t1M%;!Z>)%61e4K z!&fY|6@S6ZHMI!a*H=UH7O|zmPEiNkKmcaI4n;MC4qC1E*RwCQLZGO@fkUX=fSC|p z&p1YMZVtHPy6umbTF;Y5Eqoi!Mz~_CF8WpHqRq0?aW5U=!ac4>L$z(_sp=CPK~GvD z#w64pj%>*6`$((L^_3L)m`g&#>5=7(yEsg6OkXhnhe)rE)1C&I9PUl;Ur!wDBeruJ zn}e(Ujq)4VC;Uzr@y9`O0sf%1>`$um!s&p;Rv77QK8pRVbA1$v`urc!euqK1g46)U z?L6e?bkW<^P`f=RcCe|>BxD>}In#%IK&W@GSK|0dowgo{>2i>f2f+6y=L#GaV0A6O z7XAP{?C3s)qP8kTg!wA=La#3#U%Cv*HtpA=B3|`0MQmI&udf;*8HfrDMV?o`?{Ksr zI26rZ;w)6o9mz0}?J7FKBR29?xN97by+8EF?hk0zpYQuWOLi{i3<-qO&x5Mj65)Ga z1x~U$@vV?|Mk^6Yj%ZxEWJPfO+J0RjU*RcEA3;ZXA7FjmVcSnnL-lNzx*`DjaB>Q8 z-vx=Y%b0fTl!1t%+f8`@@Gfru-EUC&u;AVyF0HP&Q*5q+1m%@GOlXNHRs9GnoiF;3 zB7p8ST06q;&%#=vN2J2_$K1X);kzNa4^jT3FKWZ*kXfv$(mcbnt~PM&BW!PpXw>w= zTe~Sw8NFFMO~rMEz-#1l+-Dl9I;rwh4yr##=?=Z6N#}={L&f>_W@x zDcbK5cBnf|YaU(>;|>A?j-&ORe})o%&dN?_|6?|kNVt+~63Fj2_7tU13T=iA9D@20 zgqL3X7c=>JMw8s!p4$;5*`wA|nPo`S#nyG^nzAX zcYm+p`~<2+MNyYAPDl@Hi<#YtU&WDr-W z>P_Q_WSR?9E7j<7noqeAYP44OvR$o-momMGr0;X)v-g>MR@ty(7k?rTXQyZTB`0Dw z*=FjMU6RN-F{7g9E}sx#ACokSB-~_>rxSDdO3-+p`rN{PA1>kz2}a59&%I>^qiMN) z($vd3aKyG^!QEI+Q3MF_{cj72h|u}6nU*K!3D!BWK$MmVQn71+?J#}oj1i)AQ?0#c zLDm9EcJ}bu4ds?EINY>?y6;nERkE(OS#y1C6Gs-O=+zCZNk7BD3|uAo(zE`t0%|4# z-k*bNIfMK5xd%${$^2M{bvwdm2@6mis1o3nrw!otSWyLa4Df&I``hd@prwD(%~64| zOm+(-&>g*rLZ0r#DiGZq)zRxiqQI^_3}7;`j|}&6g%XQLyxQHl8iHlAh|LT`<0A32 z@!9@5ny~PvqSgwC^Att(JZrPhCp1|ni!fC(kjb;_y31Qq6ec(Hxor+}NVgSP7%dZi zs*g(Ttq)_|*?X+c{z;g9N3UAe#k`CJZS;g}#dH_>;k=O$vihXY>%wP^K(HM-TyUhf zJoM`n7bW(G5F&;RYmm!h&0&as$zPWnINRGYSeev{{InNceKl*%T1nB+z5)+CSPa`T zOun_BouM{Mp*rFk1cNd&yAKf3K5Fo6CzxqfK(*W0!(Z$aeVKvx@wgxMQx(YbwL9>B zaq$AbNs>FF#%u!N$NU{(@o6saZNNV$@<%jE98U8>z1S5hnMk$!VWlja1ag!1{D{%K zRv-{fqluxNtWt&lse%^a7MR#g#I6v@44^RvDUH8nRcIp-Lwbz&pxWwa-91cDeyA+o zB^=J_KRZK2cSJORA~iqADgJ_gO(E(^knora(o=ptHcn~EoKH-|t7HRHO*7Qc*)jOj z6vExU-2G!U)3Rrz2`Xo( zEAU035igKcbZ@ig9R?0Ce7}Q6#^J=3RI;86D|7szH}<)>Q|NKytE$EK0{lAz=}xI$*~W#}#)6MWuDf2-F~)+=Th<;0_x24{2tvHzBj zfTMI2uOeOO!1{=s4QkT~mCKWZnp%oA6{@VF4-=zzql&eXF315PYwfS{OiiAWjr)S{I$x@&CAWX z#sACQy%Ff>(B9%(5A<}nxuRQvx%S!M+1%#o0b*cA3_=CpH%XLcKX`Uq7$YxAp^9rp zX?-bde_KbyMS$Uonc^3ADc%$A5VZyODe4257CjX6vX(`g?^n>XFX9L#0*-v9$EB>`%5<^Qw0!KNGTnP-(>n&=YGjeU~y8J4? ze@suMPP2Rz$1JwHlEYCM7?9;9>B3@|a_7O>bAF-h&NN$ZS52v|Hc!oVx8X(SHfxq! zJL00bK!~Ex-1&?834RSMvhk-8XGZy9pM;0H3>7z0Qy=JvBJHE9`QyU{hX)f>K18H^ z1xqVBbubxU1o^(SHGDT~cQaPpdz>)Y{BITo$t4;&GC~P|A#DH|ui!@F360x=tOrNi zFixhC1_+^pHQR+`tU`<(g|ZB>2@CD?>;dJuyHy`}3-RcHvz1XO3r+*Ug7s&Kd=px0 z+id$X>lEAOp%6ncVajT}2=(ea!_8D?zvvfJ<}<(6G4Io;Ew4$Am36h%mzX-ItfRWP zpHCUiYTyt|_KbLZ%9?t%vLJch0fX_M`pKn&Q>`U{Jx|nVgQ@YxJy_j(oz7&d_#HMY zbf|ua2vxWV9fumdJlJ|=l@&X*@{6q$ucy!b$! z;WM}=jIcL~o7Zqt{?M~x8l*(I!B(7i8ZJva$YtvZz#;38Li8NQd139RL}?jQ-hHKp zuW8Hamzbr8aVrA`jactS;T@k(G-JuRen7wW3up?S^x;lMc<0{sPZHkxT4MNt;)&pz z-2m8cP@Mb*+CiJxTK|5dWg7J4vn{*o4hLlE_hO}=#KKNWU)Tst^XxfUNR#PfCogna z{Egiy?omp~JtN#kS2Tta;vEI{m_-Ow2yO{^A3-+>MGg}4ghJ5;(Nc*Mt3kdaTdZS& zp1(mmIzhEe@y;DK z6{I%Q9zH&@-YqSU=9+XL3>Pe03R?-CO0f4==+~1#9(1-OfMW5-8L;*Q&XP6yEm_Wm z8DcTvuh1`lgVQ3b9&?|clN6rZKR&ix%RRM#eEEV?A*CaJGyoFH-2I$M2k_%r<)#;` z;x>-G=w{O2H^$?J2>D<04-~9)WAUNbYwN95gE$JFSUD6wv*!sS@SB4d_+jKcgtm4a zP_PSN=YocH6lzwf$8->3lN*1j+CZ1^;pr|aIY#L_I^>F)G)qio&P{r&5+n$pwcydA zGw3=R9paV3Xw^uQLV z1S@r7{b2JxIF`dt`XVNkG3vIuEfGYgVPz3Ha&4Ov0&4eKFaRXtKq_DZ6=zUdwa#>O zoVnim$JBYIg87h`?0r=agWHrK&af!;d3f%wF?cE?mE%woah&iAktw+~j7>z~$~P$Y z$l}D6&*l|(c&s4b@RpN7ty<&2F(-BsNAhYL7kcc2173{|elaS@4oCXeMpu2~u9%rizdc{#Oof~_T&T}Ms}1{c#syvo8w5_SF(J!sAj(6tUr3ro-|BG!fX z-=_HsPA;8?W3dRTrdICdZG7$8-uHob z&_%~5cfaa1K>V)~v7P8&OkXl@^%od2|45**WKS(2@s*`Y$>@TH!>WBx8h zj9xGQ<@at9O|nC$%y?${!D#jt4(EVTi1KPH6(F z6EL=%>e+Px#E`A`s*-L@nR??s(I(wZjw*-JWmfZfnPYXOl$h$hs>RZLk96N_2z5Bs zDr6}&?aOTLOQ~_uH$c-|IeXNKSWAdveApWk1>iy5bd2%{%%vzF0~-L^7+YzRBFCqVZ)IC9cS&Lo6c4 zV=EuyuM~pSJrCBOGptlnaxN^0FPrEJW>sE{j*3%#g0%96aUw%~OzftpJ`D;jPE6iQNE|s6*%9Eh8_PJpWBAav-##6Ig31&v}fY3IM#^A)4bWXzoj3iuc&Mr(#53AW2x(lb z6jqJKM8Q`9>glE?W5G@16iUTfEAxQnSJq@gGY3T{YOWiIBpfr6QgccFVw}87GVrxp zGaB?6CE{GA%+exKKLaX&Ed1h_(zh+$p>MB>@BYBC4a_t-)hA@x$0gN=GmaNR?IN9} z<=-!13m>|uDCIlb2oi1OYuU)&@`!G(rta)(wM;3X46L_v2%X^)>HVBQubV`;uSEDa zv(nyV^`u(zTlZd~Yk?KIbua(@f=j|Zs8%C>h!Wr zD60XE#}u7D&7oVR-2FHRcvW^tw<>P^n)~b#Ji*eLB8RL;$>vp;c*9^ZsFu98ZzwTl=sqf@TCuL!d}t@qb!4+oS`1CP3L$u7l1=(;|Mx*EQTATN zOgU?w^07^mNn5b|eoQG7vkb{Bb<8TWuhXHMo-5(r_h@T#a`V)>1jkj1>9@0m{k-fk z0e#X-a<{TUEO)0>aS^+!TQAyfuu@=#a)5L%OFNpr^_guMkbSX*YOsZ_=~+$LLmJgg zZr567vx?_HJ-*x%m#SS?*-@S3{kwFVGoI%5#=7AB%evr=u3?5FiWRqFv2J_11#6;#$TTUy(f<&k_mRpYt^$NEv5X~@aqwR{$|O?Z4w z?{Hl~F%lr@cGl~qkzKTm!Vowct5P%KQ!uFlIsmlh&M4xglDOz#?t})Go*k{J^e(kI zFbhHO(#!@aq@k`@ZPp*T4yZ%am|~(m+N^S=Q<|^B#?iH(P1MpowULxlf5&70Eq}x( zIu2Ng@cF8|D}2d)ZE!^YK$x0TH7~hmA%?3_Z`UFKvLm+lkveAu?2)T0r{2<`e(LDW zXm9-?GJjG)zg*JA&ceg8&{Wd_t7;oi%79ScKFxzpe{-h{aKR*aW^aeR9XI3y`bR*S zmK3J^6POoq`pj7fkLH<~{#Bn(ge~ndUNG;- zPHGP?8WHH9Nth+YC8(;Xpn-qL)HFX}+D61Hh6A1{RZ48NvNI}v(W|-o7;i)jpmI6j zrfB0DzO&ATnW}tF1YRM1aL~iE#Yd8BMl*(MCX1^NsH zuyWn_w}EZ<4!(-|M?xG zj>fp3xZP4eu1*;NG&rn6GE0t>%o7|f@W}~u^e%G{lLF^@jRp~Wz&hKaj~gRQdR};% zC;JK~?oNcQQ|Uv3w0TmSdSfJT!7rqqgz*9-X9}Go7!Q1*E)dO`t>H;eyxH0hd_vwJ zb*XiNorr}voXo-@rCd584^>7o#XeP8cjKjGp*?-sJhs0r{X%y~pfZsCAK9Q1!UMFt zZp0aAf6ysv=58TgY8VP^CVm=7!_oSRmRB!e0Eu+>#_D#ZuIkf@(F?q951HDl$Lk-S zsjJ3!j&5BU60l=-y>R$^VaL386tFnLXpP5ksRrg$liBeRUQ z5JPqpr^oA^4iZ6RUc4^AZoc1ZzRAVC3}6vPl%yXQ7Zf(kveT`)zjTpdCzDpaV%5h7?Y{iXB|GGkJ)*Iw@$xB7tp+EDedVN4&p!w!3RSbX^2Z{j_9Jdk@Prm{FxaPy-f5h5N^gQUU+YBF)` z^v-|)5kj#3`!JP6-jfKc0ItnCH*jAugM&Uoiu}9YpNyTY4e_ezZcM=z>_`}LvC^I& zHYubU708Nc=r|!F#SVYVVU@E9hawnm3|_GzN!sm0engLaP(2!$PSfyY>PE~VaZYgQ zN$pXBht52sR0ztbkU?RYAC&`{$`Ht1kP~S1(Uy z%IdR&mg%Nj()#C_pn$b%c%U0M?U@|fMJ%TA+YcXVfHbBo)D`EQ25UystD}k!lQgxsjed zzvP%9dbWM=eS-K);HUF0u8)V1J!L8EcDZ{R6W9l;UwNtCv@I)ou{>&VS%*T++Ka!EUCUu;C}9VnRDc@n$8CaqB{Es>ntm$lO|P#dkW&lgwl zs;^cNNC_e7%LkNZFJ=LRyDSjyvfBp;la=@dRw&vtm$pD$Z^)L}YFv)!Ve@mBSl7Gw zz|e_t)wr)SN^@BBY`7AYFyAN?6XaE58pKSbRrzZRN_Fvsyn*sm; diff --git a/Solutions/SAP ETD Cloud/Package/3.0.0.zip b/Solutions/SAP ETD Cloud/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..542b86365f810cc3d076d32768c2d30f3428dcb6 GIT binary patch literal 9702 zcma)?V{j%+x2|J*V%xTD+jwG3Y}?5bPi%XVOl&6;+qP})_dRuLpKt#-RePbjNXz#-5_w@c zFCQtBZ3n4zIGv-Rhrg3{EQ=1Xa<9#X)Fp$hQyzmOba6OZ`c`ghov0(z5!!PFM)b>IJ7*+F^^ETPWPETWxTY$6^^rj+H2ngLD{6 z33YBqhkIYLe$RW<#o`zZHtPyyj#X@|zl-R&H?~MkK^BFhP9DkssEP#QWYCc;M2|ye z)VIyWI$G0XfO*_(P$w3UNI`ggzMeZA^n2AgN!K!JPvJ>qocmi_+V8s$R9jRxUNr!Y z=s(UJzfTWb)$82!L&$OSksyAh4%{I;SoVNUNPz2DtT`5 z24VD_;iM5ZIp9EApd6@GgE~#F2fR@KjHgizvSwm0AaSPG3(BAu$Il5 z*P}MEgG6np!xe~AlKd7`o~&b@-v~BxFixJrM>%2?C8x!B*u6qCyM>%gqo&zC%q-^t z9k55}{lQP01E5UPr;94-h2UXS62WpVEQY9+#S1+NQhItCPKwqW7jsU8O?B80t74OE zg1GN}cP(XI-_6o|Fj%A^VJ7ZL;7o(_>|oM*iBjjj`Oxjovei_2(WMC#1LU(3G`Q5H z@{h?)YUBhjz^}^n7Tp(ksc1~8P_!|+txM46%7tk3#%juLr>BT&OIg$S9n>A-cZBGL z49Qny84N0?dY(`pgUIbK!v0>4>1ZDhg|jZ}$j4V3JUIf@^e2><&{(+k3az8hcrhCq z4c6&r$oToIb&Y%h43Gg18>ro0Sg>g@K<)4sF%MQ#^Od184b-nxBenU#qvG{}AmSil zMZ9|IEOxACC@<-@JzjmLoC_V+0PYeBZ+iGQo!Xi1>Us)?j|t>CpgP%UjAXW2v(QV9 zhGo|(>{zxx8~!3Z{p06NAYTD5OC#*v7SD6x4XBf1U?B-{n9jluq5;F6IdZ3N>sIx9 z@ZT`tJ0jH+G^j53%`^0};ryaQf%H0K!XR8n{qx0Xag_YYDW^M{h+uD#k&+_HAX$&r zc=$WzjA`bbF^d8|(G}4Z@^cTt714w6ZtcliM`3HbC5VzbSP4J(BCSAJ++sea>o7!; zM-d4|-48m{!;ra>7~}%8m=i>FablMKxb{6!lprT9)dgY|u~08!^4P^0`Ft+ zT*lExpu@!m-XNpBiAvk1%eH10&PBi>SUtw6x+;#91j=NdPYsZ@jU0B+>nAy4);J2U z>fK~2e_#lAFjhgk9zPTffmhjRbFAC5+qoV<&C1V2Dzv(-T@;7Tba3{po^rx_w^%@n zjc=`L_N-~QjbyhUbJir{3vEcQ$1~0 z+_@#tuvMWOVaa!?r;M?$5xKI)F{q>EN(t|&(`dU(Mgo71{jgaTLQH$jVf?waVY8J z@}c*u9*f$ppo+W;xwtcw(kFj9wBx@U9p3gNS8#^#4pm?uDJ>VcG1;*pu$gMyy*!dj z_jB>{3TojNvQ^Xj?RTqnRs<+}EBgzLenLM#f0%!L*&CGOYd;l|v~~V6*7udMnspfO zKyvHQxSHtMYmy@jOPXBXDe?lD5>MZ}%)?|D`OnR(>u;wlP6;FSx_R{tauPg@*qsCif z`UV98;(-YQqWs_TYHP~>KjanlA9=MiwzgL{w{x`pM`ZuM!iwLMZdv?)h4oV4QguT* z>6>Y9tDw+>v3*w;aV0nY(Du5acO|iY~T-qgXvCH&(`k0FG<4l$- zQP~cEn284{ka0GIWcXq^@ULyW{b_m~T-#W4)INb+UbzaL6pg2}eR$@+`Ch;qBf02R z+PPGskKXJZNoEvG^j- z=zp*IfRD(TUy$=JG#q>Hj@QO7PMkCp7r{kZlC-Htmhj}5PrEVUa~6v-xVB43V7Hh` z$S#4s#c@d&O9~8SkAnqTXeQ}{Q0#?%-032j5h#T$xX_>2d;)cttPfT|UEj^cN2g<3 z{j-_Rh}Dziab6E;BN_J+)+SWTzeHi{8}QK zdbOU>x_Hyn4nI(SS0)b~EBFMQzF=#XOcRD#_$Zj!lz@XSv8 zmR4Ck=-qvpPoS8R{xDUEmmt3S2@<_@%{Bq``I_aQ>n=ds_Cfu)(($Kf0CS6$LBBgp z+_efy4PS6uozNZ{$>D?H^Xm2}`8rqo;x<`GPpRAgq2_UO`FLA<+yD8o^z$I=`a&wc zhpu-lB#D`IOUM!G({@sFWI~aQt4;96)Pq%F4@f``|D-lzzX4s!(wA>!QpJx3x8gKv zt3OxMc`+f^DIfc|9R3M};(s4#-ogY{e=$F91{BL*WCiW=kKq;DTO$?q%GfoD+R(yw z0YdQivyXTzUmht77m1#%7mj;Sf;Q`W75iu0j}6%RqFZ68E&iZ^Kk@8G(QxLFO5wDq zr(32njCCYPeE1d`HZ!hz1^O20Wc3q@{{4gZB50dSytXMoPv`ndple(8B>iL-pVQHu zRW1O<3NAjZ=#_^RNIfiGy3l8Rs5V|do}FqW?ousRz07KSf~rNC>9cG+g;TDVLq}A? zFEu-m{5IWv9U63=_N);=7VxrjHBFWtFmfolo6XcxOO4(shYgv=SYGI)cw#1R5O0c8 z7dJ4?e`Yl3Oayvp$9a;sYk2TYmrHG9_hf18%n*mZg=&{4@;$Fm??y>9CTb0uf$jr8 zPHxTw3j(y0+0<)0Ok`uNPoaUyctddU{%v7chSz1CBDcCX*jAEiHvW$mzhboW=sZ~6 z&zc%%>KYF+8n|m%UC0Sg{N`A&g8pn$*{|2;_i*M^xb|Zx({X{{6_cSu$haQ7{@`DH z$$GvZo4_gKNV^U3KFrUEL%btcY2Q83oRGbQ=iPO5rB|!-7CbnH{s}WmVXxwlqQ+!Z zqv}GA$QV?9GN?ymcdriX5-< z4E1yvC@b`-9Hjr?w2@+j<@z$VzJ^%sFZhdS!QKj-p(&Ov!mOK)W6dKB9p5&`%(FNV zL8lCU`Pk$YTXQ8yBzsLW#^LqV#JWXtskl?Z87~9`D|m;hmPsGI&hP6v07f}P!uY^B zLUGVa6u);IGc`XC!cB9B_{NxM_PmLg9u*cVR^8j6;YRjdeLn5AHB)-pUgr0mFHU|P65@2^xRT{w#`sQSs%I~K*+_l_Co&X`~gb#WT zn;4=F0_YYayAq1ob3)!7Jhg@5|DYpd&&-}W839Fl4}PUCnDuDsmYk}E9eDux;&-gW zssm$fl`zH`g+-Y>W>Nx#AV!((lC1WGQt+kT5pA*hoD~7|^OT6m2)w?kg=N9Y(G*2r z!@uJQLSW*w2Wg6s1rHdvkQ~6eqPVyt5)XL0o(`$Tk!Tb0<-8-$z+K4%zl{^N<7QRlxB; zLOBGbxSm49`PEE&S<3tgqPu^Jfx>vZfem~^=Ayud09_irALrSeC8^5lUYSr5aI1PT zS6e>}5ad90w`pAQI^SfB!=i~t+s;M8Tq5cM-~(pk+j^o`x{TSw=WWWt@*RrrW4SYycF^^%-26M@r_1=e}k|5Sv`=fKOd#J^k%$|VY2g08GU97;r`nr zKF$7U=gu33)i4?4tGSM(gtB@iwE}$QY~{PZMntUpS9 z-o1<1&0REMU)60^>0-k?cV5tW{{$Z;-60S>aNl=G1Lm^4GXzm{$o5JhRaByb+pBEF zxfRqH$wotf!CAF*6VzVz&aE`>Y$dcP^_l~}8fQBNUS)1u;MgzE+tBjNN&Oo65DDoz z*Pbsf#8QT`do|JR9;pP|nTkB0Y_($YWg;vkY zANnA%T5Dx)azz!fzS)-^+_}A7SK5b~E(A7U<81yQ16$NA-wYS2_By3= zC=$Yi(hKEqL_B-H6nf-=e5(Jd1I1r5&oaS+RiYjmWKCxTQe=GF1e!vs8=O>*WM zMh}IrP0&H$Xu>8)g;qDX%}3&g&sm#OA+g0eMU0bbfkJ`f$X&sbiWa4b|7~-mZ>EFH z!c>LWQv*XrUqdAG;of7dAQ5ry9k)hB7b_J?r1=wSHS1mMhucOn<=PW~-(AoSk!U-1 zr0B?Kd060-0xbbW6baLwJ=Fd2_hC4oKHB{T-r=?aP9D3qFyqAlplPR5rzjE8U*wGs z*X&S%CAdb|8DYN^p)aLPG$cQ>`v58DuZh5Mf|XIzqj~%5(2t9%zb+&>IqS=5st0wx zZU-|kF-h2vA+-ZIh7^i07UTj)KzDhM1o=T#II3Odd|D9U%c)$=LasLeC;PKWIRDpP zASt@<3M7(c94U;eQ@YqcT`=P9q7%C*I91}=!D?op{f%58Fz$d5_hG+RThyNAhY z5A~(H#3OkFXJ<$lE=b1EjyTE{f7(fB|Lh%Y zg3cT63VBg(#1CPY*xT%VhlK|jx!*yj;Bw{pRkofFC+~q+mqJ$EXYjZKTh-`$6N*s~ z;FVi`-l^Jvaf(JgP3mN008xGR2^4SC56Cc9V7IfXBcvl z?Flg~;F@CKnUAOGs)I`}568gg$pNTFOLZM=zl&Vet)FX^I8G^>$TY3JbtlkINq?&w z7TP26EVTDZm{LTdiS@R>Qr?B~7pv@XjoM8=GTjx#sU3x-I}VuQ<@CmJ-N38_{PPue z^>lUY4Di0YvkEvqaCP`L3wS=*+0?81vGv*N(ca?`7{I`Y8G{UW{4-Hm;Plydag?<3 z7iDt;?%$7s?(cP6Enkvlne{)vmZQ54rUZ_5i{B6`eAgFcVIUthIs&!H(dxADZo5&g z?&Wju&^Ppg+QC@3BeasGJOfPk)A(-gRrYe6JwY0qulaY&lQ3UV{CcDxx-`>WWkYDM zGrVDE>7C#VYqzaux>L1;JYv71pC0@A!vM6Zt)1j~%l6))B~MPsyC$2YMtQtkd9g9=gI z!BU&W9?3q{eLUeBprp&11Gx~ek1!srL*yo$14#r5aSgd6l=6;rN%Hz5obKF3Ebk(l zO95}{azR;mH9iXa`tt^i4<>NV84NPTNnPJy*AqPY2Sfv2-$iayrge80 zT*KzsJ=`Ep(kc@Ltg?4t{m8v4{0@0A%y?zLL^Vq{Z3QxG%@I*r=F|CoB!>lrP&x?Y zR$_g~^W;JtVUA=|=B$^TO%GW)>n7L6Fok7_p3%f77)No^nG9SR7I2=DhD*k~G>qkj zHVeip#&oq&9R|n`J1d!OANEasiP`hoNQcIq6AZ%K5ysV!jrwQ@r6dM@ zRQa#_AX3oNCTv_gG437Qk4^g@26{LPe0(8R&i*qs`gI#@vvz;I?xI!BUXx}Xs zpwzu0jX_Yz0B|M|Xz6M?WxbH97o|QND0*ENzhyW265m_2y%ZxCk2Dk+DHEZ4J!pFC2< zwsWI;r|Tr}mxpqoW)O?SXZOI$#tAR@Tck7=sZL)$UgZO0y8N=mnU4RX(5;Igfil6F(vUIxU3kb8Uk_!1$TG)?We|Cy+G&?Q1YRB9ruthJaOTeuRd>{8s zRp??>F=TH|gclwX^Z4A<-(nJ&ff;{>@}M-TXC_cGwhv|DKkXr_x5MM9vEKLx2R}7_;UCFjl$+)UUS5p$=v~yYDoQ9S+swEnNamja+A>fX z%AJcM(_{!0DwL#xuIq44T=eze>UJg3^qE7{NF(~^RKZ6u;Ev)GpL>Nl2-u*;7!?Z} zBzstE`^Gv&JBEUs-H2Lvh%=noon{3ZbqnqYexb*h`sVqG7x7w0hX{qc6TKI{6rR96IC}8d^)+W>Yu6meIWl1FFU=Ag!IH$MCaf zR=Daw*SJL-T!g~-wYop%TF*RA zuYR2VWF9=hdV+NcYNn&7z+C3Fks3OW+i#EUw1v51Pw1&HmO#(hu4&Id*u;dhY$&9H zDmUiaA%eb>s?8bkO#HJe=s+{>pW%B0(*m&1Xo276T=q}3<)JB3=Kya}G6^JJp{Vhh4wb%S<_ z<3_k`zV&-PVOq7ecYggb%Lm<5NydgV2mU)`<2u_vY{wp}DD~9RN7WEw?`x=p1O94 z%iw?J6{AZ{%TYIZ4M?dl1tg^(0MK7LcxuPgZ?!LKOGEt3DyJADB7+RfT-%u3oOc+Vq$2PrpY`T(5?hVFjDm|;wF{`EWbY}`%#3i>)W)VPh(9`5#v- zdOLvr9AH)z>JYqwe|aeh(k}_fxwTYcm@ox`9oUK9^7YkGsl}l1`o@q~!na`IW=OTaryN61C;Hh^ z{?gDl&0X&Bs}R$_ZQ)`%H>v9-GpiKPQsX{<9_~81IH;jXq}h(=e=@?Z;XOn%N2kI$ zsaBxirdYIaY%ydDSusT?=VVwcm~Tw`#|iF!?6v(se(F2J$AinGtR=^0gJ#Hcv0_Mp zD<_~;eNXRAF-+v_rXeGBO??+qEfh-@(Owaj5pw!OHL$6or{rr*eY+HWyLn+tPvMk7 zA)hC#g~hGqD#1vm^2)CG#9d+10C@3TWD-p!RX-BGyJULHl*V)UE|lWC8ZMh1z5UJ*k|~|BuiCWDI?lx@)ans(BW*6iOUoOQ6HAN-<@AWFUgJkloV6#B7FyPs==asH=o+3-W3zqUyt38eiT+_{Zxb0 zJ0ANBgK<+W{zKGU5%9-tJaZe>2%|ICKzX6V{Mf3n*qlzh`J|FP)V<#qbWkSghekdqjEI@||26a)M?oXGnZ-vkpTcaEaQ> zh*%h^s)w`kx(Ext<|+DAxuo_DRpJpzf_8ok9nno(omGU8D%OdIHH)6WU{SqV{L6M^Nfo{N#ckvpJO`XN2Odnsn`BmulQ?+_U3D%6BC-! z!Kj_Syy81HfiUrk=@jc_T@Syg`^{_zNS$W6s$WIt`O?(~s2$tJ+wQT83} zhfu+-JHa;MW0ccjND4kNW{x*XPLih>kgoR54SES>v>lo7AqyRk!3TnTbHtlF&zK3i zf4#y9pUgU5gxqA@j*Vu230Q&>BDF)QqgzFGf}s>iUSjA^_$H|1EB@Qal92zrc#`yv zbB5x)x*Fet@?OE%Ox?W^hnCo}C&M_R+@$wq3lTX2zb_o!8Dxca zn2&vFqKZ)PMYrXup;%OY;RA{@s=kJcIn!4ppa|owsa%O=ZjY&)@5Tnhm=u0+xfOoBOicvVPxX zNvPiT*6`VnAy!4icc@$HMfR6n*^2IsP9;(mYLStUs4B})PI|rFpTtn$Nx-UL)sHuT6J?XQb!6qs^ z%`7?vt6g=3dvxE@)XM+an4^1FeZ&k`W{>Ko?mm=T2*YYsR5bswUwy6Fb*xc@za%y# z^h}r3fzo;aC$4E^RjIkbcsx-i0eVS*)P%GHQiJ-6l_4FTQ%DLkItV?x_C+yI3ID z|Lv7(4*K`_zx7H%f`I<(mHN-&|FYr#d>HkA3^#%X`CpLYf5!exik0Oc|3S|nAYlJw M<3Bq-#lN@z0_QN8WB>pF literal 0 HcmV?d00001 diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index 3de6ea7ff84..8ea42111347 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -90,7 +90,7 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Synch alerts coming in from SAP® enterprise threat detection into Sentinel (one way)", + "description": "Synch alerts coming in from SAP® enterprise threat detection into Microsoft Sentinel (one way)", "displayName": "SAP ETD - Synch alerts", "enabled": false, "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nETDAlerts_CL\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId, Id\n| project-away TenantId, Type, Version, EventSourceId, Technical*\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(OriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent)\n by AlertId, Id\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", @@ -155,7 +155,7 @@ "ETD_AlertID": "AlertId" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Alert synched from SAP® enterprise threat detection into Sentinel (one way).\n{{PatternDescription}}\n", + "alertDescriptionFormat": "Alert synched from SAP® enterprise threat detection into Microsoft Sentinel (one way).\n{{PatternDescription}}\n", "alertDisplayNameFormat": "SAP ETD - {{PatternName}} " } } @@ -1038,8 +1038,7 @@ "domains": [ "Security - Threat Protection", "Identity", - "Application Security", - "Cyber Security Alerts" + "Application" ] } }, From 98a2cfce4bd40042e1c8f4c27b55ee2b3a32534b Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Tue, 28 Jan 2025 14:24:43 +0100 Subject: [PATCH 03/17] brand name fix --- Solutions/SAP ETD Cloud/Package/createUiDefinition.json | 4 ++-- Solutions/SAP ETD Cloud/Package/mainTemplate.json | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Solutions/SAP ETD Cloud/Package/createUiDefinition.json b/Solutions/SAP ETD Cloud/Package/createUiDefinition.json index 6305e079ed3..f54516d6d86 100644 --- a/Solutions/SAP ETD Cloud/Package/createUiDefinition.json +++ b/Solutions/SAP ETD Cloud/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP%20ETD/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.\n\n**Data Connectors:** 1, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP%20ETD/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.\n\n**Data Connectors:** 1, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -110,7 +110,7 @@ "name": "analytic1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Synch alerts coming in from SAP® enterprise threat detection into Sentinel (one way)" + "text": "Synch alerts coming in from SAP enterprise threat detection into Microsoft Sentinel (one way)" } } ] diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index 8ea42111347..b6ff3697642 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -167,7 +167,7 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Identifies logons from an unexpected network.\r\nSource Action: Logon to the backend system from an IP address which is not assigned to one of the networks.\r\networks can be maintained in the \"SAP - Networks\" watchlist of the Sentinel Solution for SAP package.\r\n*Data Sources: SAP Enterprise Thread Detection Solution - Alerts*", + "description": "Identifies logons from an unexpected network.\r\nSource Action: Logon to the backend system from an IP address which is not assigned to one of the networks.\r\networks can be maintained in the \"SAP - Networks\" watchlist of the Microsoft Sentinel Solution for SAP package.\r\n*Data Sources: SAP Enterprise Thread Detection Solution - Alerts*", "displayName": "SAP ETD - Login from unexpected network", "enabled": false, "query": "let regex_ip = @\"user_ip:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\";\nlet regex_user = @\"user_name:(\\w+)\";\nlet regex_sid = @\"sid:(\\w{3})\";\nlet regex_client = @\"client:(\\d{3})\";\nlet regex_instance_name = @\"instance_name:(\\w+)\";\nlet regex_instance_host = @\"instance_host:([\\w-]+)\";\nlet SAPNetworks = _GetWatchlist('SAP - Networks');\nETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n| extend Id_ = TriggeringEvents.Id\n| extend extracted_user_ip = extract(regex_ip, 1, sapOriginalEvent)\n| extend extracted_sap_user = extract(regex_user, 1, sapOriginalEvent)\n| extend extracted_sid = extract(regex_sid, 1, sapOriginalEvent)\n| extend extracted_client = extract(regex_client, 1, sapOriginalEvent)\n| extend extracted_instance_name = extract(regex_instance_name, 1, sapOriginalEvent)\n| extend extracted_instance_host = extract(regex_instance_host, 1, sapOriginalEvent)\n| evaluate ipv4_lookup(SAPNetworks, extracted_user_ip, Network, return_unmatched = true)\n| where isempty(Network)\n| project TimeGenerated, extracted_user_ip, extracted_sap_user, extracted_sid, extracted_client, extracted_instance_name, extracted_instance_host, AlertId, PatternName, PatternDescription, Status\n| extend GeoLocation= iff(ipv4_is_private( extracted_user_ip), dynamic({\"IsPrivate\": true}), geo_info_from_ip_address(extracted_user_ip))", @@ -303,7 +303,7 @@ "logo": "SapLogo.svg", "id": "SAPETDAlerts", "publisher": "Microsoft", - "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Sentinel, supporting cross-correlation, alerting, and threat hunting.", + "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.", "graphQueriesTableName": "ETDAlerts_CL", "graphQueries": [ { @@ -655,7 +655,7 @@ "logo": "SapLogo.svg", "id": "SAPETDAlerts", "publisher": "Microsoft", - "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Sentinel, supporting cross-correlation, alerting, and threat hunting.", + "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.", "graphQueriesTableName": "ETDAlerts_CL", "graphQueries": [ { @@ -994,7 +994,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "SAP ETD", "publisherDisplayName": "SAP", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.

\n

Data Connectors: 1, Analytic Rules: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Microsoft Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.

\n

Data Connectors: 1, Analytic Rules: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", From de3005f13003e3a3033d3429f500b5a8bcb2e3d5 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Tue, 28 Jan 2025 14:45:56 +0100 Subject: [PATCH 04/17] logo adjust --- Logos/SAPETD_cloud.svg | 1 + Solutions/SAP ETD Cloud/Package/3.0.0.zip | Bin 9702 -> 9692 bytes .../Package/createUiDefinition.json | 2 +- .../SAP ETD Cloud/Package/mainTemplate.json | 2 +- 4 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 Logos/SAPETD_cloud.svg diff --git a/Logos/SAPETD_cloud.svg b/Logos/SAPETD_cloud.svg new file mode 100644 index 00000000000..6409c6f7382 --- /dev/null +++ b/Logos/SAPETD_cloud.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Package/3.0.0.zip b/Solutions/SAP ETD Cloud/Package/3.0.0.zip index 542b86365f810cc3d076d32768c2d30f3428dcb6..8682f3cbfe687678fd591422e62bc67c7cf51208 100644 GIT binary patch delta 8685 zcmYkCRZtv&vTbn3`uuE7$N8D5u_9Kc^$<=e>P&xYJMIOP))!uEx!Ml-5hKHZMw zXnXX!q$GxWQ4M=S^s#^iY8jk?iJJgTh9)!vJ}As~8Sv7QW(_M2PELqr+R!G z3A+g#l6dnxP_ubb(_ky>^R)yz5FfH<+3~7PR`tn3 zc?vjxO#MlJ=ioQ*w$3CU5FjXS5-z@Ty)C!tzG5ZdJHwE(04+E96erm4xBp=FuAK^2 z$`Ne}^XAeU7qZQCkW<|1rl-&6a*RAy8i2U3Q#jw%{|dhvI+LkY&3u~qnGuQA4}^_F z8pSWu3>WnI8S_K*HeffP^~{rnkl{)YvOdgv5fSQ&7TUp%x;M?Ha?tA;-TR0`l27xI^A74M| z)6RF5hBV}IrLyvsF46_a6jS@brh@|TYA99ydB^K;4<4Z{W=ldc0+(*xSU=u#N8n29 zh7|BMW>!5SLI91des1%-bg^KB^_VFPUh1Q##N++L3Fs*sb(Rc4S@}v@Qt;cpy+t`I ze&Ij4JQ{gjh~)vYSXyB2UovXRe3EP-F(J0EYn&Pj|G1`u#h{60W>{p@sXvXy9?J5> zp%8}6ax77s;O0>6IOj5lg*qJXq*`UI+zOaARYTE+&*fC?lxE?|M=SLngWL% zsTyxk;~t29p7(axP&URIR3Xa}0ewbIy-AlHCDO9=iuzI7eib+D{02V{zWb+mCGOXK zTz~iEdoFd@-$aD5duA5leoJ2{+sA$_ya2k?`^o#^bKXn9f3=2raNrbYQj-&@E7ph_ zNwSw0{A?d})~rN%0o9Ll-qtQi(*2}&5HgGA!8%o&kR!Lzb@nn+6Sc`aoqd1(BFk0N z6W4PN)Lwh|I3kWmEd9Wev!oi;4noKf++Z_~HLs<2otkpFVt00!>NXo}@|bf?u3

{j$>W@Pp^xxoV=F!f7f6hmFedvw7WX_q}5;#=_1LE5S1%|+L@h@Hj zcAzPBxrcT>E4t5_VFXAY95A^=L!$(~=|(XN*6Zn{Kp~bx z(ESKa&iLrWpNiUq}1-o=9sJ;ik_a(Et^VlGU)kq z&|=lM=~GjNbE%;~EGHCrtQUEw0U!f)n5SY*rb4Zr3R~RJr)NYUntgS0)F@^1ZTq|1 zjCy!)z_z*ZKMSSrxUi)5t3wGnsK7dD3!|G~shEMJHoi&@VV$#Ss zHKr)hdww{|ytif2lb{eUJI}EQ-<~k~Oglh~^UJ{>-Xwz3St8Z9CDmI5cgw;%3X&Nasm6j3Cwmkmy}7_z4>0CydKp~s{mA2KbVZ7~XL3#MECt5HF}5zE zRaOEX!Z1AIJ+qG?yURH-dZ3kZ&HN831fNm3PtxxUi~tb4QtnV@NxD-7SkA1=>`Ft2`22(_gm!*YV{zIL8l*7{~1ZTRDqtR?KqEOx>%i+p28fahO z;$0V%c1JFYrG6&JWZ_-&1I|3{O zb9;*>+V%@$ir-g&a3+Hh(%M%GKv97yAN77k6|JlJk>jmGT7L2^!ANiFg2PK$K}_hS zh&Eam>}=q)9smqq8@;#dVY>Xx*pOBkwappt)M-z)f3C|z8Ay}EHV*GN-6)m)^I7b% z{>hQeT=BGgQskGfkvLsmtGb1aoY1uHC5>W=hh@2hQLEdH@m0Q_r&fsFG6eh#qsJ?%E-yv%9RWj)Dy@&pII*U4G}N;gRj!Js?BapzBPCMaR~9ldUv{g2Pv zA2bpegpnze6v8;gsO~VF#s*;_xC@4%;r-FUGWE-64Ke@|F0E7V@d4ILZB_H5{jap5 zzblEFU*z0kWtUObtWiT1b778d`EDTgHs{+Ty+Hv^$T)#=y<2HX-P9d_S!2rV57t$Y z^K7#hPeE7bjeU)h?=%?OrX}#$J43ml3^MjK{%R)xVkQ_zYjb|l64cowvgU(RPoAqD zOomVZSL{AYrg{u{2^`El1*!XoA%0RI3Zt4m@6PTvapBy7mz+4J+X~T?JZeI37nI+_ zM^&f{`Q|t@yyqK1@-KF@NeQ)Y4q_mGI5H;%002#(}* z?A{(x3s>TY8}5YQtM3J|jN1^c8cFaCvv?5sUApP5WD$G!c{YLRC zceEJ}_DAlLpK2#I(j+(#tO%ru^I9*B}^3BIybYbLe|L5dfv^Yc@9 zg@KXNpwMp%28eBABZt>k257S{YK7}Ni@(uWbr2+HOtDxXpCjIk|Hg$(z3C2JVH9&i z^rVLu0zD0Rrg&eH$ruAcBV+60n&|H@@%H^cl!F%A( z5a~f|nH?!FY;3iX?6z~n%4WPU5P3#bT!_^%$35gRg-rhVTYnHdISlzRYn_yX{2_%? z1B;!fYZE@p+VJ@2;q*Za6i?WE!W5Rw6JGqE*C->$q%l9Q&i=w81o=AxZ>vTXWVK(X$=)?xM5j7*S zzGQARQjmN{o=vUiWw_paBrkVFk!#%=mE1!$e1OJ1mJ}^<XeDJXtE-nh9<5gI!prk6B;F~af<6uJ0vCvcv?%P?BBt&_w{1P#P0ts3Rt$g~J zK?m}LU`rk_#Z1P!%*um9jv5KE(<36OEB7)Vj{dppHgjq$W6b!8 zhGHkeU#DfJ__heSHSVXs2MBwQnY96V4G3}MOuM%h|H0en^p>-1>K|dk!A^^X1v7U+Z9elZC^T8v8ZC9z9$4-nxP9q(6rlvdb=}8;Xjj z$A{O4K2^nz?o)LF((uzslKzFp0UeNE4}Y4Sen~z@IWJy86NdC!jC01eBE8YBLzh|1 zn!AaPWitKTqC6NSAopHFd~8A}7A1h>jQB&B;wDy_aE~2`)Tq+GZb#UU?@T;Pl_miv zH2E0#j-SSt8p8eIyOAIEka}W)6|qo ziplcBRQe)7{uovBMr63hq+A}CzslXOsm1WwN2yg)`~+`82H^T{MTBI>F-+ACfr1rq z^QI_lhq#VzCZd0bSlFq8tYlBj^VDm)wkxSiubQ6}>DaGRln;Fm;{QOno?D=#cxEs(V(HQ09x}4GIEUC-APgDMnXw?N@0)O6N^P?KbWbHRK3gY_ltFNVju=UZIR z?0%X*h^B1ohDn~WVIM;T?r}Tsf{KEYg8Vu^uUlko8wlK77hl~L1^PV^UPSncU*=w2 zQ|y?>#SQO;4?G(Ibktu&&H0;RzLtJ(su|$}Ra}3xjWC;!1^jt*I&8J#{OOtGZ&4|x z&$8{)iYp}3#ni>MtM4?ZhoMaA$mnf6k{QwkMk3&L$NR0oIl}4% z+DeS_;}(nMWL#@=SuCw~BrUVgBU6vW%&rBu`OlyQN*ALucI?TBXYuIHgzrqG#3RU< z(2ov5B>{KU7dw!lRCC=#gudL7nQV(Rnv@9vq`dvfm8NheD@p=i9`aA!WOtcvBzrun zjrTSsxl@3m-G|XM*@jHUm{Qy@#O+Ry;x&W3VR+6bRz#V)+9**}+%udjmsrIirzl&I zY!f@tB-P9vV?bUaVyWW zV@xsX{yp#FuuW)TjCQ?BKGZMgH5ERLN^zjYabn$cDwZ# zQkqjgv2R*`M)~Zm;YX2On{?qF>6sQki;|xtK`~f{d2fK!URnEiWt&w!ExTe%mp5=G zT)zTMg@BKVX5|qKJYe1YRj5YZY>Np=V!OrdisUlzR+vedizo>sZizt&K|F&~VgZCD zikJve?_3&>*uwX6_eInWNbcbZuiM#(1!%}~NZDfFFuD;as2l4fLNV(0#1ZX@ha9H) z&6gW37!A0h7}QFn?s2=wX73Y)a@Vv_4Wj71>$9!sJ2V>>yeovqd}T#eL$THGIJvfI zXTK)5Yvco^YO#x(#%4gflIS$b6Dcv-zd|C`1fqsJ#RkYXf4%W0`NwPZ%8jC;>zCft z*3uRqR!8)K^Gs`er9gN>#=#M+Z0ooLtEF@D_t8A zp%g;fNxJHvTUNgzFBy`Cd&7+=gfaKRW;!e{1sT&)TKKBfDC~l)LJ6FIDLd{V+W#$g zMz$y!B6Kn!qchpDJ^MV@I{d0Eh!%uTP3B1F5f;EaJa)vE<{vDY&<*wGsmS7dK0Sf1 zVdrQFr%vB!WnRR<0!( zfCH80j>&>y)8nCpS*x`Co=SpGM!_nWmD?UIIK+(sS)>}VPjZsVD2|n$?u&;fSghukLPRejD?@LpKWMp;k zYT#KCYEJc(r+x{33SOj%I*pNwNN%};f z-o51O0X61~4AYJ)56tbzy){?Xu`TNKVr-%JRZY4nFHP=AHl5>>N85pEo)ez%9Z(7s@ab>0~ygPCXY9nGQ~pT{Ce_9NmeaE=l~IbOW9+3)%RZ z21BRt&LRgeF&Q1GYWdz{xt$_C)7(t+J>l~ygJ z7bM;rhMd)A%}IX-!R`k}>er>+1rNk6pY}4QTAHmLgzV7iDw}NMIZgbiQTeHWfARB@ z7C{(;z$MX%X>JH3A;|89Fw85ZV(uYoCNjywMvT3P!G8p%uPUWC?es$!W{#O6GVXH=ElLZIxx zo@${*{;Pl~%#u5Tvj}CtY8cBXj&fnO8=Vly#o^N6pc#HQr<3RCcpKI^&Y@Xju}X{R zeE)?_ZWeS<%+n1e5Jh^@9Mm zqxIke5&WK@UC>o3mIHVq13=pu@0U;S`1|$RYih?|uoPcf`2^Hv`q&elR0jmP(W_@( zjsX7xdX3$+-gw3z7D?J-48i0o@QC{~!1wj33^!&}vVX$ro z)%whzM-5Fc${6TT>2;EYypHmH2^b##!>TDT4K7mkRx1Xa*bO@&D*k3w_Ax8bDzMaQ zcIUaDc#9m>>0oKL`ve`HUTr%N_G*!kwi+k zE^3$@k#i@hp{slzchE|cMRLC+3DBdS2*Aa8hF7QEjGtQ)pDd=<-s#p*VR8GvSd{{xW(Al*2}}9 z!q(88zvakE*_qHJxIEg!;q17Oe9biIX8nX^h%@f_6^VlqlKaOI?KtLnS&_;(C+X_! zyrkXi6}?2d39mD{LN{{xPPsfORWDv394oTTki95jiOJubS^}xMPoV0$mqDpxnr2kr^g^N19yJ(qF3vpt3L^jrDlUo z1-DaE!ilScm#KNES84tC*ZO6iy9_p;Q`|Xm)omu7Oqb~_ z?Z;?#o`zR~%1$lg*C?;=tfNt^KPT<7_2M6gGe%E3IVP9EI<$X4R_u{q_f(OR?eQ!9 z{AbBm5t_TKZ&BXk2gV|I)nqUtL@k2d1L;}W9nje{TE|AOeH6o>WH^SJt(FQlTICh> zT!)ob-Jjs8((~=OipcCyc4MaUwWuEdcCQVtwlX1y4npo_=@X^gP=YxdrG{h{y}qT` z)xD6-uUl9VasPw^rMm}!6+dieoWDJ)P$Klb~e9H0nA&P}!B zFl#?i{Uk|?uCS-ib9CN48a3~uCtMe1P#evW(^gRBHX9^X-gWbrwu^yi)JCcBx)hU` zw>=)NyicMCP7f)nVM>?>i{$BWR2s1XcBC?Tx9@Jsp#dexb_1T$BbE8v$K&}8-7C=6 zkHZ!uE||FED4c@63}2SpLgPDqtUUK&WXw1+TfA8yDJHYbFTadvGQW#|cG+E9C$W6; zx%I%1-wI!IllG$GB34w^-)2@#zWjOAaJx1@y++QkCK>`_X@%5Qd0QXp3BIe$)FKdb z6w^%_X0Lqos=1@fvk14#XPUC=HX8ytj4 zt`LY{bR7$x7D|yC({SNv#pez?9x*!xIe*sqxAOWLK4iyaHLJM*wX}#<88tNkY0zBY z;os_<59I$+q#yDALxvPEFw?XDrAV-F`0)5JIRDRhVf6nI6PTY~g8RQ7jQ?Hv??#5V xh|&K&$AKY+`QK;@HA02~2O-l@Ai}`@7e;9)BmRd~!N9=%CtLnAaq0i7{s%o*uulL0 delta 8665 zcmYkCWlSAf(}i*O;_k&M?(Q7i-MzT`!Tn%|;toZMQ`{YjYjJmXx9{G(pUv9IWG8F? zoUENZvj#W-psE0%VXz?({*j`)KoY7T&^$KHx}`7Ox;`e&dP3*aag`hUL&W4#)P~3& zzCIfUpBn~%%tPM>bxcTY6ib1Iq*utyf?b}RvfhAPYrPD8M)5%Bmz*PE$fR4JWq(>L z5+O&Ld+Nn9A2}sLHSjtc#s(|Jg%yG!{)Cirk7o)`Ya5t3%| zv)N0Jhh>&FCBBg;;|?5MdF%NAW#%+%x40**GE51n_3kiUhIErZ(O6Bv09xrSCKXrr z65P=^mf=HX+QVR7mJ(9k>ye?Jr>vSeui7{Q~}=z`69@WV?vu|z!?3r2ZoPDSq#q=SXc~GEl(776s-L4 zFq9mlKPKUtgqZ5I8(zU7-3W8r^Xgv0zPg>Ib!WIhPw|bsJCQpL$-A9Z`zcz3_v%fr zE6ZL>`ALsHNWvtaouuBaDphb4Frk?fGLO6r=qb7_@KM#ARHbQU@mQ5&$OVLI_QYw) zZ>Fb+>&V#B2kg}X_les>^+N|0%CigyR8qZ<=nf$Oy9H|jy zkXnJHQsbKQmp);&Oc_rWgCiljeaso(f3&Pn&qJAHKqCg}v=tVt8}`#V{Xxw`)Y5up z{*?w9P@`T*$Jwr#=><@>Uc&mz*_zF!3i6!5b(Al_{7Jr-U;x+nz| zQjmx1&TpX_GVfTTcj&cjRKAA%2?xERetm$4)Z@K+gkLn8TW~6nU1doeKx(ghJUcFq zRyaE5_QVnc3ilKlD=T3PP<3mMMZD5Zn`hpbvMCaiU65U%KX#K`kll%HS0BB!7q+xn zLnv!N{S@R~U=RwAU&zOGAA(8tDx$!t{lbX3A3FOp7QMhC_6QYQlANtCzHLVwBiKb- zZJu0JBFu-JI&NXwvFccf7`L+!O8f#UeYznJx<0QIDAT>D5VS$AL)of~)CS2HDCwLD zg<0aXK;S$-NFW)w1$M3Z0)!?%avQ@MhL4cwe}RqhB`ay2D&3fwKNW+9VfPyQ+F5?6 zEL1A@cx;HSW9+nrT{poMyTVm?QRgA|>kE!(J4*$;`{7;DAasSD4%ez9r-S<*+>F9> zlwykqaOJExY`UGhd-<3f*|*sWUSe!xS*v?Flk7`=AXL>>iHForpGEsdEQ?5X`5x_C zJ+^s*NE?k<4c`Up)}Xgyb}Y5yHYL6-KHrfDeNnApn|h_ZptwU`We0-BfMgLd_G}fC zT32)YG3zr6W^WMh+mEOue-tJ z+@bt~<@g86iv=F64jd>P=9)K8_tdg|Jc9hf+JuE1l}rJKowt=K#`Gm_{YaL z%a0F7!!lx>heC?hjvuB5{&F@mPGjw8K#z9Ki}CLDHYX`idlNJt-zp{Esg>9dDbhMR zcEdz8KGu419j+{WY!U+t67N2H5zhK`kPY*AAl>DO_MfOA-No-Z-?Ug> zP?PT~U~Kt|ewr0+2l{wosEJ*FP64#J=CS#gnj$V`ktliZhRA~oyl_(r1GP`g{ciM5FDhG7rGaa z7Zew&7ji7Wh38)w%IDWjhM>Q&!Id*G{#zW39QVh0pV2+amlaF7^#tb*;0;c>K5svB z2|K=jkXwba5~?*hAM)z${v*x-$wvrD}-?i2=F27x42_ zRP|}M)dzJ(-)q$ya%9fjJRq>pX!Nx!L5H|FX~IZSj1cXwv|S~-lsDI0+Lf7rt3iE`+?8`F{9J4lz+c5eyN z{nb(uI5HL25}5t%gj^$8f#7+cA&O-uab;Ys>_fb|q*{o^QGpn@HSOD;5B9kC?V2#KPU{PRaMvWd$EnnxDg<+KUWiYDgme^;MBJVJaq%%u2&X@9qm}twSbc$|rnQeQV z*{daU?vKA@lh3x(+Ly22zmqA@t5S;YGG(>Q023iZDqNz`ZEis~{OO4#dA^I$--l}_ znauV;-(|#zv%l`)duE(+pr;92$q_awRQ8-XnZ^xjx752}><@B-LL_MsG(tr$n59$i<1U1`bSiF@H zft#j{au+b(*=e7$s>^#l+fQ?eG?TJ#=Bf!&d=dqzW(zp-zKIK#c$11F@1$CapfT7|F7z1S6ZKqS=259-5?Yw#s( zz4^vw6@pkuOD-e!2D4QiXXAhlg}D30h<6a2;A?-=1}>=b7KT5f$YI{{;(S(c)hMisc+iz(2%1yrUiixX!RQl z`hjmZnw~p{Qih;eBi%Zcd9*!I>dn8;0S{LgQqCt>?s@|ATVCPw#X z5m;H0@CnNCkY_x|pI$2M+H`Z)dYMSJPp40Ptbc zSjq}rl#VPE3=_-=YUBH-1W$|yT*)B!9k`G3wvF~a8FT6E93HGqU76#tH!vOY#6IT~ z>pW=5M#XI*GqC-T$EYn?5g|Yha_jo7`$-(^bt&`+880YqzBN`xr9_=T+Z4d^&OqzW zREx2Hg7z7wjZgQ^=61&1G*i!XfW^>L)8-5yL{q~xZv+3{sJdIHBk1MIt#}#0T&nAa zye%Qeh>~$RaQP;<@Rapbswx5s!L9vedSHq%|&oj?BO9?9QZK>npr> z2>%^ngvL?TDMg*trb-RyMvcqY_0YS6?YmjdFH;_gjCqKH`<7+U`p4bz!x%}J9H$Dk z(fZ`Yj%2K5E&3}p(XSKC;~|i|$h%6g!JW%miZP!1)9C67YGt7C53+ej8))XnIF3k* zE=H~uuW)Q)`y31J;v^K^Qsl)$vuAv*rC_n_6|GpO=Vvq9X6e7c;tnZSqEHCDkgc!P ztOnS%0UwV*1eH)J(>>Qnr2!jp;+`?w)ciac53McoD^s$W(?)(KOhmjm4PV3hEBRNA zxwPk&OxY>7lflX^%xtq6u8;>EaTB$#K|X@0f`O>f67h=d;#H3IS2$L=estb|W9T)WNfn$3(!8b-K&dlt|qhUz2*N|tr zf*G&oF6qf?#Nj)L4?*Wzyjm#s7AaGL5k!oMLsn&zP}FFk#WuxqcNmR8>J8ZjyWdHX zi9wz+ITeY|N2RDdR2i0%_;bW(JV_`*yv_i95xVexWP-#-J)`gm2PHAiC8gI66y{Su z1%{2_!?2K2@AA(<;Rwz}#2kA%s*u~@X;B}6C8nMnT_U9k?K9u3C~gQhzcs2g#lqYP zOv2X@wzqvC$4+h@deEFIG!aA?m#_@aL#U*nx_J*1YZxR{!iFk4CGLd zTZ8ZY9EYp)*V5W&R*Xc#iXPnMmN!Eb0Hod~y*p9Ii=1hA4EadwsaUvMWGxUGIFr!Y z9kbMF${8_dSC;PU!~%%$ktR#t4WqRc%;uO%#QqEPQOwu0Tz$(VHXatOfnNH(yeD0E zIzoT$%W@mb>foO;^2i#>`=?uSiu2yVlRq4hO@ zxa9+a+3h=ijq2_0n)o@t{pask$xtMdD|BEOvGB?qXB3yM08V_P z65(iPmq6*i(|8oW|G>Of_p@-7wSn8AwK*DJ-A{WkKx^Xw$|@Dv9o?y7mrD4(ra=FSPb?j8|iq&o#c2krU~ zY9gGMb%dg74ccEQrix3o^ZJx7xwb%>qS;iXnmmFS&$>L#4s*>-2R ztLjAI05#0y4={5?&j?KOQ0lDGx<(yjq&@{;OxPrY6wNpv=ifh(#wTW$KJUtZWpAt< zx!0i#w~Fx(yEvv=iPrT_pq78ty*CB!tNy4&H%c_CnA(BmQ^8`OCCxmn+mby2&%+~Q z%fcv}{DyJC2Nl(^Dp=L`Kf7ijWRW_|(L;w$bcyaVA7o0y9d9M7P`n&mvzlOFA^F}9 z;JNUO4EORyQp&_WJKuPjL1%MFPhTSFV+gbgI|&_(+XbsK=!LZUNqzA|b>l3T6P z#JZ>zC>A&m-xT~+)uuHIyl#r}&vcTTpDdSnsAtaTt&jS)zjI$LOh%r2!>d`|$^I21 z%JKoTlKm#`&0`HryYgTn=qc=gO12p{Ty$W(I3#pTgO!LOj)v>V8RmIkvmaqn7vp(_ z>~vj@q<~*tnDJz2qUE4lt0V=C>?`smMrv{@#}i&5?TB>z8)+b;LpG=|y?qA@2-HI1 zI>O7S>ejmcu^+(mwXZf549@y+ne4`#tKGs4N=g zEgaD)bv-VK^ygNoWTV#aN0R^ED4PFcCx{Z;e+d@NI-U~2-6dV(9~TfovQ2z^JB6S^ zGCM@w0`T8f*s{G3R==w&*(M*(>pwX`!*N41g{QXN%PaXnc}}C~ z1k1imhefLUoLHnaX1}JS7*ugVYi5|~7;KqZHb(HbEp}lH{CTs0717V3QhM5O9lH*J zW$;yRqfLr;^haWU#{wR3l_`C9kj?(yGtvm3H`E#Wq|!hf$|<$8-t&rx3^9DWg-yfb z&iA8qH6KaA3$-?ds<6_vYCV|@7A|Q zW%gmzq4p#6qF3(TlCQi=!8q9^${>~4WDjcRBM%o(9?g{9{MovhD;`WT5)0c;q zT}3e!ucL2h0y4N#b6!rB7J-&`j?{mgX3haSlHyn)HO3-;JDg&y3@JI^ABCQyHo-Lh zTiec2Q{=8;`&g~abxhkxrDf}@H;#QwS)*Z8=!nKQ-_|2#P7{SC(bM)!dlM#Dth&Q9 z;xKj3dQ%XuegF(lckVYQ%IS&cxk6Y1{_{n5_jY&g0Q%nC*Z>dr+?_rxfRB4y>-x1{ zHr`vj+Pb}hfXpnovFJ#L-;-2?jvxIOMks&%plzxr{PR}O^|?x@?N6~NxBC0XVoc}W zq|m{3@e4}1|LTG~0_?qJdyoz_R;@PCbr;6PtwQb%_8L$>xDASpH&Poc;|(<5O%u4f zRo%&P^@eC@x)j_lOU8Z12(okjmk(vQ%1b@rwJ1dARGd zb&b%THA#4Dogmc}m&R4erP2YSc835Qehy!_`mMfe9-eZsX|gY#B(NxKujO!-MMYs8nmj643=QYL3Ei%FGq_LN=QK>XX)O^E8uIqye0@RO00P#b zwBs$P$#)p|XsgjFlZ-9l52;h%ez8+MopX8~P|%&w2FMo2fW!`>bnTbLu-Ot~vhX(u zHc)-uno+DXN|t=sXO&E`W}IInMk#grz6>ZvcL76W){DKsewDp^5t@*ci(37;Fo^dE zUhIR^X59VBB#QC%xx=&y&Wy^U8@ebbI{W>MZq(@NL|10dF3358+r*Zk*Q2pN2VaGBnzmILa=L=_Vr z519%fLV4ax9IoBUH*vt@5?Y@U3ARzB)hU&q;WjZ16=&ZemCA5!dB0$4uY+Ahr;F}^ zxErSDa#U$;+a#lBC-vdpGi(C}WU2v#0qLJew!q~wsR+u;gp9J`eHhP}lISuaSfGla zG*#aCx7dVSSleXi;6xFW6r3=Yj+qV!1VWKD6s*r?D@eK?v4&tcbQ5S+F?iWZMiu?g ziYMh>0yri;w}3?trX@t&xPoZ3^68F&3%I)uDy7mU4X9L8x%G+?1Vl$9CJ)44Xg7wK zQl8`k;5X#BCWHpUJ?44qcooJ09UxP^oA7Ez- zZ>qY-SNsPS9s?8j$w%{rZZrq(tzeJTA(NaSwqz52Cy0pUMy}1&D0rQ$FF;1M79A4- z{j1qb?_Por+f_(>`Z`#mze6p!-We}S?hb69vmhuk*pZ=?sO)?rdA1lnWPKxJWh$qD z92C0)K%k&+C-(qtO1uR}2NJD-ndqdS0DaK)7XoQ$L3~4TWSdS}5M2c3T=2Q;yK)bf zsz>$jE@AN)VPj+9>xBi72)OkrlX#PV+#`bgttt~<>j?VFLG0z~mxSRqIqI zu`S9Cm{lHa@GtDLiwQL2s+N>Dhn=$9mxW8d_qruhec5;LR`J(85|*z?Y`@4Ay~kni zGph>6_w!BUR@E(|olh36LO4Sv{siM@EK_p1$@4sF1}LDFZ@M;Ubl|#AfPQ$X1Zf4c zNxgUVFRdN%L%&4Hf>8;mAqT+h1XRR^{`b4)s*G`JIP%wKqVso2c>*39FR_W=KpDTm zE(Ca@oG8*_fGxXnH|%% zc!0!F#sU`$--EBk%TW+};TbP!)fdULk-~~nDey;(I~z=34INfGQ-WQYCbEw1^Ud?b zebiytpmSJQHA5>nkPr`O0`_aZ{FsoOEzp7az)z=FI;wFY}gP#beuQ@pX`!pH_^s4uEj4V8u+I_SWdnD~k<{BjB9V!^ zP0LYmpplhe(MUuU6EN!EE{468s>2>)A{AFzt7{+HRw(MvVLu4QCL#keEZoliZ6=9J zH#Sl|35?DZ%s1iSUo~%%8KhVkxTQpyWe6MK8jM5GbffY5X;+u&BnrqopJ_G}#22F| zR->N4u+#dPHcXqg?hTaHnAq(QX^HkFd4$iCk2aB*7yYOma8MdECT#Vu+wlw6uC~7k z=!;$4>-w5(YBaqUxJ3mV)7|`HKYCxG&?=j9+&5w%X9>2>JP@IoG?>{N+1kH!< zd)b`(V)X4#G9uoBr^jaNXo1mOu_8x~v7DiBTTHW7QOt?$M<<>EvqqydovuTp-$?@_ zGu|=uynMw9ry0>Yp|l+3$uPdc?Frf2FL5Sat@mH}-#+4=dKdDAw|`aO70ad54reQM zp0hL@sr{CCJg)Gisyz6jd(U?O$YgLJp!H}P{aeynHM>IwkW5`UCu9yh@rl)=W8eZi z5nBWCqIKV1^Qd1T%FJ2cAg4p%yIydnS<+m8)P$Xkd1zd~U*>BmJ$_I2c}&$~e*9G| zUaE%FY$$G;p~mDu^F_}tqv40F4Kv6@4XZaFJH!+*Y}4g9bWonOA(g-Ew>ut_gNebc z$&4D@K6JU@;@@Og53pgOWN-aX#Fc|NosfLsAE}x0y&gObyL?c72@PzfU072ZhE0EA zm4+xFI!NB7Ff|z>;wJ+7Dp#;9+A>NOi+KgZQqQRh^(Qbsq}!q){oI{ij{hc)gGAQA`F<^)QLn-7sZ zCRxt1HCrr3pVi6_a=v`Dm8LdZkTvdyZk*z&84AboBekH$^6sA>D;k?6*qcrB8$f-p7hl%(^sw}fyaNogxK9^(c<8xCPPH7WZJP}-9GCum!MF)Tf~F1g+{&$ zj%+wSQy4;HNal8XZUy^iE`8Lyw1iqGDWH?rkK3$a`cMwt?*aYcXe3( z!_hwoI9HWmUouYM^Y2mcPUykZq~;Y5FOT-moXM#urVgWHyMVV9-XkRNya!TDmVu(_ zP_x3FTY#98Pg;2KvV>-XzL%xDt4W!qt_y0z0T#dk*C3!YlG5hnumEAj(0^_9h+%*= z_W2Etg)}=S*$(M2>N!o8Og}5(;sj9KY;=QMEK&cZEwT(XeDMZQik_$y#~qpw0_G?_b<9u4WC{t(H`3}&Guft&>^P|gBxkdUx~QBbC+)KqWsS?duG+=q8C-w48! zkVCVhM&bQ>u68EnwKTT|v41TK>hOxOoL{#aCYw}AOR8$v;A3Ts(*I&m@Cm_Z?dpl# zx5ke<8X^$qrMxYjkIWIOIdk@8mKWLjcIZzZU4%g_z6q#=V^jS>Y*L(2@iA1)oxTK= zQm776HONEH2DHW;TBxH;Kz}_%iy?M$LXEa79`(gCY8KqILQ@_le(Te7L2&Lrb=|Q4 zF_|qFICrZLX))xkWU?4M)zq8anpJa?C8c)VQzhUyidqqw(5_*vAJtcSVK2TjGMV(X zP@9T^LQO@EhOV_BJkBgShN@n6M!NUh(9+KT-jJhrQ+eq{t7w39W@pHn$=oAj+W@6jItu^ga`C!lBNM zCk8B0(0d-eM6Y3&r=y=xIsEgasiQ2;c2yy(`o_SrIgk!fC`bsg&{xX~3g!M6*NEQ< zR;Z5rJA`T8k*l5`{913C!D7csMmwFa;=s5rRWmU`dF&pTjt*;-VKUqGZDHaQ`d?xs zCy3ipF diff --git a/Solutions/SAP ETD Cloud/Package/createUiDefinition.json b/Solutions/SAP ETD Cloud/Package/createUiDefinition.json index f54516d6d86..04939d82a00 100644 --- a/Solutions/SAP ETD Cloud/Package/createUiDefinition.json +++ b/Solutions/SAP ETD Cloud/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP%20ETD/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.\n\n**Data Connectors:** 1, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP%20ETD/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.\n\n**Data Connectors:** 1, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index b6ff3697642..fd2ce88f585 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -998,7 +998,7 @@ "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", - "icon": "", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { From 5d46fabfd9b9b15cc34af735396da4a46e1b12ab Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Tue, 28 Jan 2025 14:55:14 +0100 Subject: [PATCH 05/17] logo fix --- Logos/SAPETD_cloud.svg | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Logos/SAPETD_cloud.svg b/Logos/SAPETD_cloud.svg index 6409c6f7382..9908905ba24 100644 --- a/Logos/SAPETD_cloud.svg +++ b/Logos/SAPETD_cloud.svg @@ -1 +1,8 @@ - \ No newline at end of file + + + + + + + + \ No newline at end of file From 8f6140e7b5a43c3b36b7eb106d231c3056c8b823 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 6 Feb 2025 13:42:09 +0100 Subject: [PATCH 06/17] bring back requested structure --- .../SAP ETD - Synch alerts.yaml | 73 ++++ .../Data Connectors/createUIDef.json | 406 ++++++++++++++++++ .../SAP ETD Cloud/Data/Solution_SAPETD.json | 24 ++ 3 files changed, 503 insertions(+) create mode 100644 Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml create mode 100644 Solutions/SAP ETD Cloud/Data Connectors/createUIDef.json create mode 100644 Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml new file mode 100644 index 00000000000..3e24a70cbc0 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml @@ -0,0 +1,73 @@ +id: 7a830484-e349-4527-85f6-7850c468c238 +kind: Scheduled +name: SAP ETD - Synch alerts +description: Synch alerts coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way) +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: SAPETDAlerts + dataTypes: + - ETDAlerts_CL +queryFrequency: 1h +queryPeriod: 2d +triggerOperator: gt +triggerThreshold: 0 +tactics: [] +relevantTechniques: [] +query: | + let minThreshold= 1; + let minScore= 50; + let lookBack= 70d; + ETDAlerts_CL + // | where CreationTimestamp > ago(lookBack) + | where PatternName <> "Logon from external with SAP standard users" + | summarize arg_max(TimeGenerated, *) by AlertId, Id + | project-away TenantId, Type, Version, EventSourceId, Technical* + | where Threshold >= minThreshold and Score >= minScore + | order by Timestamp + | extend NewEvent= split(OriginalEvent, "\n") + | mv-expand NewEvent to typeof(string) + | parse NewEvent with Key: string ":" Value: string + | extend + Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value), + Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key) + | extend KV= bag_pack(Key, Value) + | summarize + KeyValues= make_bag(KV), + take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent) + by AlertId, Id + | extend + SystemId= KeyValues.sid, + ClienId= KeyValues.client, + Host= KeyValues.instance_host, + Instance= KeyValues.instance_name, + User= KeyValues.user_name, + IP= KeyValues.user_ip +eventGroupingSettings: + aggregationKind: AlertPerResult +entityMappings: + - entityType: CloudApplication + fieldMappings: + - identifier: Name + columnName: SystemId + - identifier: AppId + columnName: ClienId + - identifier: InstanceName + columnName: Instance + - entityType: Host + fieldMappings: + - identifier: FullName + columnName: Host + - entityType: IP + fieldMappings: + - identifier: Address + columnName: IP +alertDetailsOverride: + alertDisplayNameFormat: 'SAP ETD - {{PatternName}} ' + alertDescriptionFormat: | + Alert synched from SAP Enterprise Threat Detection, cloud edition into Microsoft Sentinel (one way). + {{PatternDescription}} +customDetails: + SAP_User: User + ETD_AlertID: AlertId +version: 1.0.0 \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data Connectors/createUIDef.json b/Solutions/SAP ETD Cloud/Data Connectors/createUIDef.json new file mode 100644 index 00000000000..7ed008dbc6d --- /dev/null +++ b/Solutions/SAP ETD Cloud/Data Connectors/createUIDef.json @@ -0,0 +1,406 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2021-09-09/uiFormDefinition.schema.json", + "view": { + "kind": "Form", + "properties": { + "title": "Microsoft Sentinel: SAP ETD Data Connector", + "steps": [ + { + "name": "basics", + "label": "Basics", + "elements": [ + { + "name": "resourceScope", + "type": "Microsoft.Common.ResourceScope" + }, + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "[concat('resources | where type =~ \"microsoft.operationalinsights/workspaces\" and subscriptionId == \"', steps('basics').resourceScope.subscription.subscriptionId, '\" | project label = name, description = location, value = pack(\"name\", name, \"location\", location, \"resourceGroup\", resourceGroup, \"id\", id) | order by label asc')]" + } + } + }, + { + "name": "getKeyVaults", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "[concat('resources | where type =~ \"microsoft.keyvault/vaults\" and subscriptionId == \"', steps('basics').resourceScope.subscription.subscriptionId, '\" | project label = name, description = resourceGroup, value = name | order by label asc')]" + } + } + }, + { + "name": "sentinelWorkspace", + "type": "Microsoft.Common.DropDown", + "label": "Sentinel workspace", + "defaultValue": "[parse('[]')]", + "toolTip": "", + "multiselect": false, + "selectAll": true, + "filter": true, + "filterPlaceholder": "Filter items ...", + "multiLine": true, + "visible": true, + "constraints": { + "allowedValues": "[steps('basics').getLAWorkspace.data]", + "required": true + } + } + ] + }, + { + "name": "identity", + "label": "Identity", + "elements": [ + { + "name": "keyVaultNameApi", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "[concat(steps('basics').resourceScope.subscription.id, '/providers/Microsoft.KeyVault/checknameavailability?api-version=2022-07-01')]", + "body": { + "name": "[steps('identity').keyvault.newKeyVaultName]", + "type": "Microsoft.KeyVault/vaults" + } + } + }, + { + "name": "announcement", + "type": "Microsoft.Common.TextBlock", + "visible": true, + "options": { + "text": "The SAP ETD data connector collects data using a Client ID and Client Secret to connect to ETD.", + "link": { + "label": "Learn more", + "uri": "https://learn.microsoft.com/azure/sentinel/business-applications" + } + } + }, + { + "name": "spn", + "type": "Microsoft.Common.Section", + "label": "Client credentials", + "elements": [ + { + "name": "clientId", + "type": "Microsoft.Common.TextBox", + "label": "Client (App) ID", + "placeholder": "example: sb-101464cb-6d15-4abd-9dbd-gx233d401e22!b312711|etdcloudprod-004-prod-etd-cloud-service-broker!b274464", + "constraints": { + "required": true + } + } + ], + "visible": true + }, + { + "name": "keyvault", + "type": "Microsoft.Common.Section", + "label": "Key Vault", + "elements": [ + { + "name": "useExistingKeyVault", + "type": "Microsoft.Common.OptionsGroup", + "label": "Create new, or existing Key Vault", + "defaultValue": "New", + "toolTip": "", + "constraints": { + "allowedValues": [ + { + "label": "New", + "value": false + }, + { + "label": "Existing", + "value": true + } + ], + "required": true + }, + "visible": true + }, + { + "name": "newKeyVaultName", + "type": "Microsoft.Common.TextBox", + "label": "Key Vault name", + "defaultValue": "[toLower(concat('SAPETDkv', first(split(steps('basics').resourceScope.subscription.subscriptionId, '-'))))]", + "toolTip": "Name of the Key Vault", + "constraints": { + "required": true, + "validations": [ + { + "isValid": "[steps('identity').keyVaultNameApi.nameAvailable]", + "message": "[steps('identity').keyVaultNameApi.message]" + } + ] + }, + "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]" + }, + { + "name": "existingKeyVaultName", + "type": "Microsoft.Common.DropDown", + "label": "Azure Key Vault", + "defaultValue": "[parse('[]')]", + "toolTip": "", + "multiselect": false, + "selectAll": true, + "filter": true, + "filterPlaceholder": "Filter items ...", + "multiLine": true, + "constraints": { + "allowedValues": "[steps('basics').getKeyVaults.data]", + "required": true + }, + "visible": "[steps('identity').keyvault.useExistingKeyVault]" + }, + { + "name": "secretName", + "type": "Microsoft.Common.TextBox", + "label": "Secret name", + "placeholder": "example: secret1", + "toolTip": "Name of the secret in Key Vault (not the actual client secret)", + "constraints": { + "required": true + }, + "visible": true + }, + { + "name": "secretValue", + "type": "Microsoft.Common.PasswordBox", + "label": { + "password": "Client Secret", + "confirmPassword": "Confirm secret" + }, + "toolTip": "The client secret value from SAP ETD", + "constraints": { + "required": true + }, + "options": { + "hideConfirmation": true + }, + "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]" + } + ], + "visible": true + } + ] + }, + { + "name": "etd", + "label": "API Connection", + "elements": [ + { + "name": "uaaUrl", + "type": "Microsoft.Common.TextBox", + "label": "Authentication Server URL", + "placeholder": "example: https://etd-cloud-wv245d01.authentication.eu10.hana.ondemand.com", + "toolTip": "UAA URL", + "constraints": { + "required": true, + "regex": "^https:\/\/[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", + "validationMessage": "Please enter a valid URL starting with https:// and without a trailing \"/\"." + }, + "visible": true + }, + { + "name": "apiHost", + "type": "Microsoft.Common.TextBox", + "label": "SAP ETD API Host URL", + "placeholder": "example: https://etdcloud-data-retrieval-service.cfapps.eu10-004.hana.ondemand.com", + "toolTip": "UAA URL", + "constraints": { + "required": true, + "regex": "^https:\/\/[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", + "validationMessage": "Please enter a valid URL starting with https:// and without a trailing \"/\"." + }, + "visible": true + } + ] + }, + { + "name": "roles", + "label": "Role Assignments", + "elements": [ + { + "name": "roleAssignment", + "type": "Microsoft.Common.Section", + "label": "Storage and DCR Role Assignment", + "elements": [ + { + "name": "storageOverview", + "type": "Microsoft.Common.TextBlock", + "visible": true, + "options": { + "text": "As part of the deployment, the Funcion App uses identity based connection to host storage. The Function App managed identity must be assigned the Storage Blob Data Owner role on the Storage Account.", + "link": { + "label": "Learn more", + "uri": "https://learn.microsoft.com/azure/azure-functions/functions-reference?tabs=azurewebjobsstorage&pivots=programming-language-csharp#grant-permission-to-the-identity" + } + } + }, + { + "name": "dcrOverview", + "type": "Microsoft.Common.TextBlock", + "visible": true, + "options": { + "text": "As part of the deployment, Data Collection Rule (DCR) and Data Collection Endpoint (DCE) resources will be created. To ingest data, the Function App managed identity must be assigned the Monitoring Metrics Publisher role on the DCR.", + "link": { + "label": "Learn more", + "uri": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview" + } + } + }, + { + "name": "dcrInfo", + "type": "Microsoft.Common.InfoBox", + "visible": true, + "options": { + "text": "Role assignment typically requires Owner or User Access Administrator privileges on the target resource.", + "uri": "https://learn.microsoft.com/azure/role-based-access-control/role-assignments-portal", + "style": "Info" + } + }, + { + "name": "hasPermissions", + "type": "Microsoft.Common.OptionsGroup", + "label": "Role assignment", + "defaultValue": "none", + "toolTip": "", + "constraints": { + "allowedValues": [ + { + "label": "Yes (I have sufficient privileges for role assignment)", + "value": true + }, + { + "label": "No (I will assign roles after deployment)", + "value": false + } + ], + "required": true + }, + "visible": true + } + ], + "visible": true + }, + { + "name": "ketVaultRoleAssignment", + "type": "Microsoft.Common.Section", + "label": "Key Vault Role Assignment", + "elements": [ + { + "name": "kvOverview", + "type": "Microsoft.Common.TextBlock", + "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]", + "options": { + "text": "As part of the deployment, a Key Vault resource will be created to store the client secret of the Microsoft Entra Service Principal. To ingest data, the Function App managed identity must be assigned the Key Vault Secrets User role on the Key Vault.", + "link": { + "label": "Learn more", + "uri": "https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide" + } + } + }, + { + "name": "kvInfo", + "type": "Microsoft.Common.InfoBox", + "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]", + "options": { + "text": "Role assignment to the Key Vault typically requires Owner or User Access Administrator privileges on the target resource.", + "uri": "https://learn.microsoft.com/azure/role-based-access-control/role-assignments-portal", + "style": "Info" + } + }, + { + "name": "hasPermissions", + "type": "Microsoft.Common.OptionsGroup", + "label": "Role assignment", + "defaultValue": "none", + "toolTip": "", + "constraints": { + "allowedValues": [ + { + "label": "Yes (I have sufficient privileges for role assignment)", + "value": true + }, + { + "label": "No (I will assign roles after deployment)", + "value": false + } + ], + "required": true + }, + "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]" + }, + { + "name": "noKvPermissions", + "type": "Microsoft.Common.InfoBox", + "options": { + "text": "To complete the deployment, you will need to assign the Key Vault Secrets User role to the Function App managed identity on the Key Vault resource created during deployment. For more information, see the deployment guide.", + "uri": "https://learn.microsoft.com/azure/sentinel/business-applications", + "style": "Warning" + }, + "visible": "[or(steps('identity').keyvault.useExistingKeyVault, equals(steps('roles').ketVaultRoleAssignment.hasPermissions, false))]" + } + ], + "visible": true + } + ] + }, + { + "name": "tags", + "label": "Tags", + "elements": [ + { + "name": "tagsByResource", + "type": "Microsoft.Common.TagsByResource", + "resources": [ + "Microsoft.Resources/deployments", + "Microsoft.Insights/components", + "Microsoft.Web/serverfarms", + "Microsoft.Storage/storageAccounts", + "Microsoft.Web/sites", + "Microsoft.Insights/dataCollectionRules", + "Microsoft.Insights/dataCollectionEndpoints", + "Microsoft.Authorization/roleAssignments", + "Microsoft.OperationalInsights/workspaces/tables" + ] + } + ] + } + ] + }, + "outputs": { + "kind": "ResourceGroup", + "location": "[steps('basics').resourceScope.location.name]", + "resourceGroupId": "[steps('basics').resourceScope.resourceGroup.id]", + "parameters": { + "functionAppName": "[steps('function').newFunctionAppName]", + "storageAccountName": "[steps('function').newStorageAccountName]", + "appInsightsWorkspaceResourceId": "[steps('function').appInsightsWorkspace.id]", + "roleAssignmentDcr": "[steps('roles').roleAssignment.hasPermissions]", + "roleAssignmentStorage": "[steps('roles').roleAssignment.hasPermissions]", + "roleAssignmentKv": "[steps('roles').ketVaultRoleAssignment.hasPermissions]", + "sentinelWorkspace": "[steps('basics').sentinelWorkspace]", + "etdUaaUrl": "[steps('etd').uaaUrl]", + "etdApiHost": "[steps('etd').apiHost]", + "tagsByResource": "[steps('tags').tagsByResource]", + "keyVault": { + "useExistingKeyVault": "[steps('identity').keyvault.useExistingKeyVault]", + "keyVaultName": "[coalesce(steps('identity').keyvault.existingKeyVaultName, steps('identity').keyvault.newKeyVaultName)]", + "secretName": "[steps('identity').keyvault.secretName]" + }, + "secretValue": "[coalesce(steps('identity').keyvault.secretValue, 'empty')]", + "identity": { + "clientId": "[steps('identity').spn.clientId]" + } + } + } + } +} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json b/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json new file mode 100644 index 00000000000..0ce0c01ddf4 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json @@ -0,0 +1,24 @@ +{ + "Name": "SAP Enterprise Threat Detection, cloud edition", + "Author": "SAP", + "Logo": "", + "Description": "The Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.", + "WorkbookDescription": [], + "Workbooks": [], + "Analytic Rules": [ + "/Analytic Rules/SAP ETD - Synch alerts.yaml" + ], + "Playbooks": [], + "PlaybookDescription": [], + "Parsers": [], + "SavedSearches": [], + "Hunting Queries": [], + "Data Connectors": [], + "Watchlists": [], + "WatchlistDescription": [], + "BasePath": "C:\\GitHub\\Azure-Sentinel", + "Version": "3.0.1", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} \ No newline at end of file From 491aa98e684bde205378a358f4a7855aec191d86 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 6 Feb 2025 15:04:09 +0100 Subject: [PATCH 07/17] etd connector register --- .../detectionTemplateSchemaValidation/ValidConnectorIds.json | 1 + 1 file changed, 1 insertion(+) diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index 67d38fd39a8..f4942eb50a0 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -154,6 +154,7 @@ "SalesforceServiceCloud", "SAP", "SAPBTPAuditEvents", + "ETDAlerts", "SecurityEvents", "SemperisDSP", "SenservaPro", From 924a88db6abb5f4040002443518ecf319fe982d9 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 6 Feb 2025 15:18:55 +0100 Subject: [PATCH 08/17] etd table test add --- .../CustomTables/SAPETDAlerts_CL.json | 53 +++++++++++++++++++ .../ValidConnectorIds.json | 2 +- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json diff --git a/.script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json new file mode 100644 index 00000000000..e8cd077e51a --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json @@ -0,0 +1,53 @@ +{ + "Name": "SAPBTPAuditLog_CL", + "Properties": [ + { + "name": "Version", + "type": "string" + }, + { + "name": "AlertId", + "type": "int" + }, + { + "name": "PatternName", + "type": "string" + }, + { + "name": "PatternDescription", + "type": "string" + }, + { + "name": "Status", + "type": "string" + }, + { + "name": "CreationTimestamp", + "type": "datetime" + }, + { + "name": "MinTimestamp", + "type": "datetime" + }, + { + "name": "MaxTimestamp", + "type": "datetime" + }, + { + "name": "Score", + "type": "int" + }, + { + "name": "Threshold", + "type": "int" + }, + { + "name": "Measure", + "type": "int" + }, + { + "name": "TriggeringEvents", + "type": "dynamic" + } + ] +} \ No newline at end of file diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index f4942eb50a0..6416f1fec01 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -154,7 +154,7 @@ "SalesforceServiceCloud", "SAP", "SAPBTPAuditEvents", - "ETDAlerts", + "SAPETDAlerts", "SecurityEvents", "SemperisDSP", "SenservaPro", From 4e1d1a75ef573e4b0ab2052dfb1d078f4c91a9fc Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 6 Feb 2025 15:26:21 +0100 Subject: [PATCH 09/17] structure fix --- .../CustomTables/SAPETDAlerts_CL.json | 102 +++++++++--------- .../SAP ETD - Synch alerts.yaml | 4 +- Solutions/SAP ETD Cloud/Package/3.0.0.zip | Bin 9692 -> 9694 bytes .../SAP ETD Cloud/Package/mainTemplate.json | 26 ++--- 4 files changed, 68 insertions(+), 64 deletions(-) diff --git a/.script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json index e8cd077e51a..a84f34dc7a1 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/SAPETDAlerts_CL.json @@ -1,53 +1,57 @@ { - "Name": "SAPBTPAuditLog_CL", + "Name": "SAPETDAlerts_CL", "Properties": [ - { - "name": "Version", - "type": "string" - }, - { - "name": "AlertId", - "type": "int" - }, - { - "name": "PatternName", - "type": "string" - }, - { - "name": "PatternDescription", - "type": "string" - }, - { - "name": "Status", - "type": "string" - }, - { - "name": "CreationTimestamp", - "type": "datetime" - }, - { - "name": "MinTimestamp", - "type": "datetime" - }, - { - "name": "MaxTimestamp", - "type": "datetime" - }, - { - "name": "Score", - "type": "int" - }, - { - "name": "Threshold", - "type": "int" - }, - { - "name": "Measure", - "type": "int" - }, - { - "name": "TriggeringEvents", - "type": "dynamic" - } + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "Version", + "type": "string" + }, + { + "name": "AlertId", + "type": "int" + }, + { + "name": "PatternName", + "type": "string" + }, + { + "name": "PatternDescription", + "type": "string" + }, + { + "name": "Status", + "type": "string" + }, + { + "name": "CreationTimestamp", + "type": "datetime" + }, + { + "name": "MinTimestamp", + "type": "datetime" + }, + { + "name": "MaxTimestamp", + "type": "datetime" + }, + { + "name": "Score", + "type": "int" + }, + { + "name": "Threshold", + "type": "int" + }, + { + "name": "Measure", + "type": "int" + }, + { + "name": "TriggeringEvents", + "type": "dynamic" + } ] } \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml index 3e24a70cbc0..c522a9522bc 100644 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml @@ -7,7 +7,7 @@ status: Available requiredDataConnectors: - connectorId: SAPETDAlerts dataTypes: - - ETDAlerts_CL + - SAPETDAlerts_CL queryFrequency: 1h queryPeriod: 2d triggerOperator: gt @@ -18,7 +18,7 @@ query: | let minThreshold= 1; let minScore= 50; let lookBack= 70d; - ETDAlerts_CL + SAPETDAlerts_CL // | where CreationTimestamp > ago(lookBack) | where PatternName <> "Logon from external with SAP standard users" | summarize arg_max(TimeGenerated, *) by AlertId, Id diff --git a/Solutions/SAP ETD Cloud/Package/3.0.0.zip b/Solutions/SAP ETD Cloud/Package/3.0.0.zip index 8682f3cbfe687678fd591422e62bc67c7cf51208..70d2afb81813d60122dd2e10b512b6b490daa14b 100644 GIT binary patch delta 6152 zcmV+j829JgOWsS6O#?;7q_I#G2LmE|Mw4d;HU~h)q-R9Nq_d<4=>>n~m8;X;*JFQU zgZx9A-8AA)8}N|dmT&yNn@1A5%8ao zI!Fir<~uavF0?2f_Yh8;&St>IzcE6i$?1%K9N@4on2$ml-FNG2+=a@)FaQI6{tx7Rl=z# z-|*kDV-Ue9i#TQU!KeKEamZVC#YcTcgsRd-U2hZ724HTFdxU#R)U!E4V;_H+hQEA9-1GARFgq$? z1Awr`=jg_Mkcek$3^?i3uS3yyZ72XiuTEh2zrYh>VX$$IRlo;D0NXa3+$eS(Ii+3CWq$FcjgJ!f{$&s+ z`IqRNroPQir|?3yIgrn4+ue_zz)z9GM|+xvF#~M{&PslQGRIA4x`t^8=T(1<0$?wVvQwu4hg^?+69Ei6 zY%*byP$R{q%M0W?7M)C~jw-TK#xc-qQ-cm?E`+*sNnH;S(!fL-yAgBt^44jsJ|cc< zPfZR9EkWD_4V`(r(y7tYHT_VFFb82PM1?t5@MhF^x~Y3yKSB>r>E!wi4MUKE3z0%V zIFZWQt`~o#&Q1uTTq-d7iJiO5bJ|C49GwFKBMxu?aGbTcBB33Xcd)^>n9Y64Qm$wh zC+`|t4mTjoL9N24MNW#fJHSl|zs~ei9h-2}^1X(GHRGFdAqxAu=e!?M&+AM*j_UoP z+`-}9({0Cb@Hpwlbcd@XS{H$d`U>|M0uhc`l1P7AXeQjFlS#xTTo%5PrXLsHaE2eT zIQ8lmzkV5eb{Z$aY>y>y&NU4Rhr}r=DL5McS3}w!93`hh<=V?I(?}Z)O58q^7`+3P zBZ9SUB8O<6DT+S?(Tpb9*d#`yPelQ&z~~%}{ZF5&`svM$P94i|oSUU{9OuSq1{53I z+>n2Il2sp89#zTu;0r0X`YgVX10|ti;-Q5e3y!2dNqsOvfkeQhK1&dX(Ks6W!fGZv zoG-VDFzeAgoiec5>ou}C~~xz4<~;o zHo!S!1ig>21+kOs^VVa|tQOd%q9s_oS2TaIr=A-p3S!O1$zq;Vs8cB1vwYBXRGf*J zX}m2Wq2`+tRdwo+y=-%4uq-0%x_G^-4+zMpJWy4-ugoa~0-AjU6OBA0e;N0ry|z6V zkDX6j!^bz{@u>ONwQ)~+jRYiwkb{L=4xwHBYq=qquc96N!drZ*0uxrOXeNFam{osU z7ED#qq4204hk_wo>V=QC2k)Vq^&!_0)<>}wbU1y%l3x^S4f;j4>#x=M&hoyT6JhAV zG0I&5an9cn)3D$sfWeYL-ZqxIjmi#%49bCX3LPu$^9~05C!)w(r*ie7hkQ0r+%Y6u z!wO1kwLqYiVuB(ReAopJ=Z_)?ba{W6L&&(N2t>L@%;A)It3;fFlVky?lJ_)Fxr;^* z^^$riUeCDU<&#tNxu)SD$D+gP>JAlu4q+1{Y2=@#{tQ`|A-$7G`qYHSQ+e)Wm$jTb zm6TksH3LG;|_CK5uJjf4xFta&zV?TUAT>0@KVUx zmPSPbN^l2U_kb>)({3IsW(u{7OEBl(E3AU1?d8hD)g)jMb=I)EGcTlcS84aIPc=y> zwIfz(dRojM=_0RGwxVthIn=tqMSCTP5<|ec`6lv&Jfuw0F9{cYuE_E*6Uq z3g>H)P(A7WeAUPzs+A_w6^a&4XKhW z`4E%8NKC#~m~={xD({(k3DGQZ3XZPdX(+#zS3h^;{)+bW!pU=nSJYsSeBWk|EFmKc zD9;hBzm{LYCAZRJce%ao{-$&HnwTn?YxO4=rf}{~8dSu@O+0@iy%;ajc{>{7_4p{h zoM_v+RhO==X_%gQZaft_Xtqw;<~b|u4UI0G;EEIdWXe=&4}vR4G7=DRp&S#}2a(7x zw1aaJOMX@P68w%DJ8MExhD0jc7=ey2W6KVrh>)FN*XEbI%stf#2pK6J4bEEaOX*_MZn}%LYK}fSDiBvNFU*I)5hl|W)IPbr= z&Ux&UfAHvjvbDLg`5Rs7G|gR|2l}OIWDgoAcw8SzUTS||c}@kHu9Cl?m1#L!kEUx` z1H|n#CeNOcanBFL*2gM0;~vT9+8`W)xfG>zo3-3nxr`2Mv$nDYkfO-F1bMRyLI>tc z7hMZ=puMDV>9TKC*iv!V=z8LgRqxYx<3oA!ifiL;cLhB-!)7kOYi;l<=hT-&c``3^ zB@oVG7^{B-EjI?aX-L2D377#mz!8R1;c4&-t~tpyBox?9-PvkShZ4?vMKw9A(9qI7 zwu7)!2Zh(6+4{&{S2#z>2#xUh2-Gob>M)OGaGTm{uV0qA-CTrSHsUF)uJejrFUdK1 zegTz4fF&0Imk0M@0AMz1k)g=@Vw^nE&{Cvc?tm`Ap(H&et^WeuQSvK^US3Z;&l6lu7=KK94{4}s?eSG=w0Df!*O>`CnXK8C%^tr*yW^Zi(L zwnLi@cwn8SF&HRdk0hAx8-SH|ZOykO;sJlA=fsK>E*2Ql7QD13UT}tg+I9eTN^HS~ zwK2#AUZ%biU0ck*bfdsW0kW|+A}6SqQVem#lAn%VuMM#Yr6bu4 z?}f>Z7?AVcP6}ZBM8?zr4@Q^J0$Q(0JBndAbzr+({}Zr8l%4CWuaA(T&)3)AzB_-} z-v;>q5u`k#I`Gc|OuOdM*O3r+NYXexQ?o^KpYydqgYI)LM;e3t)bBft&5f=zppOW9A(9mg zx}i$%g2{Akrk>?j4_9fRD2WbR~4wj=C(Sj;Big+dE(Ukgh6!;FCfj-Bzr2rdlB*6tUI3;o@ zEG;!~T%ln86nPH}RMRnIpzMDZB`Rz5E8`k0-Yc|Q94My`BYV0w8`D!GEFs0LjgtfWVvi5u2A3cvexp(_cbJ3bEs#J;+QK7_-bmbq;V}CgLoEe$gIHmbKMHcA5uqNjRa5(o5eP$D{9C$!&cm= z1YI%Wp>x2)-JF5I9u}yX*52-s@!9hYoIQqTj;5GBuYP^ok%{@`71i*UDA)rEHlwpW zW_wf|QcXNBVj`__R9sWoh|o4ya$Ty{tN9YN^l=}3+r{G%6heP0Wzr0xW^H%s2@lPtM#QH59c zHLM)!HBH)-)A@g`)a9eAcxyGTP!k zF|>K^3ZGV6=MHwbk&SZ)co^6=cR`H~HjS}GvvP-S@xkx8fXw1w3?=cKKC zLTlLslX3|LWfBa_BYY8M5f(0o&{_te&iGxh?16E)gGI|6luxJfTwBW-)J=AY@&(J5 zEohrhV|jumuSKVF1Yb}Yf;NJhmK$g)CfZ(JpbdYEwlV@O+Je+&iYXo2RvRPiOC##@-wmvRK-B$8`1fJfhB-hn+JHmrO@rDh<7JGGO<# z^Onq{wp`JBy+Y>M-%F>DFO)XESi1NZwPGtv|Ne|=-;3|kZfV|M)WR>9w*A@DwHIG= z)Aa1N)oyy-kjlB5fXnK`N_WFA0-2^!uQ-2wdL_!Hd78AT&S{hu-K?0cAPstD>CcPQ z4m3=2HcoF|IbWBY$@xEX@9yRz^|sTHJEb45I_p2HceX+m`lwtLeU_2{fnoHm3E~9r7zlo~~#@sLTm$wr*MT zJL0Q?*RuD_yORpCt!fVUoH|L2;9-Da`nmiGHq6?Je)JkTiR!n09~bu8d9& z47DsPu8-DSeyPoZtMBwsAWi)|6iB;^uYem}h4^JLpWnd6gR@hHP2n6d|77W7YxB`v zeX{h{%YlJ(NOnT^5Vi1He(Ch3(u&b$@b%C(t3|ZY8YS-w1ju0Z*GBby^kSjaUNIf2 z)Kx#CDC?m})uCQRLyZv?k!62W!=OhU=bgWkfJS(hCXE#fkF)T)xz<&yVbztkXcVUn zgQ{)BgYO<`>9||8mr9uB-!>f!yK|$k7DDrh^dh2uqKGf7u~UPu=k!i6n4-wgQp!b) z-{lviUBPfdk6}L_lL1Oezw+?U6U6KkN%^dbSJRXVsJ&#=X}hGA8j63V$Uwu;lQAV5 zAFZpaD-8FXS!v`k-wqt63&QGB%Shh4HZW2CMpk!>r_&$j)ILr?$HCV(A~3(w!DGb^zyrLwj_0(CX2AG6w#~w%%<||-ZI~_w zhFd$ByTRqP4FYy0`ymd&Flf@fMKJQe19pcrnKp(K^u8Kha&Lb_eSEzZ$*o|0TflaO8vKh`{=qgULiqEk5|8*BXeHC^k@U zjdrX$pzh25u+;{ZzbI7~Ym48LE^+bLa4~n;Ow)?#zWDMOUD{=d`+JqvWpMK-yqC$0 zM{+(5pFaf^Kk$Di&))_K+kUzs|00JTqcLU;p0fz^Krk0)o|$vT&M|uj1M#TmWw|z;J^Jk z{0M(e8JZ^2*5~NPg@-T0Q8d&C2S2Mdq!HoNLx=^9RL9IlZYic8bHRR aXHZK81^@s600IC40JH!A02Czv0002n&gk0! delta 6150 zcmV+h82RVkOWaG4O#@@!n6Xe42LqRNJd>mfn$_v<>#@JF zLH;2P-(92w5a7g}fhI&}A$d;dBp4_FYhzzEJ){ZHj~lb(>2osfy$&XUBruBO2$)ZZ z9HasO^Bo#-|5+4|dk7~^XEWg8-x#6M;eMY)B*v56S)|EZMP?|L~UCQy&H6`g{Tz>B#eE1yT|~m2eWu zH~e?(7({TyB2F27@F_oh9P*Z3@ll@<;iz~Qxf2(Nz#k5QK;yAL?r{pvE-m&kq`6M$ zWJ4JdoDYNs%G<$a0q)G&aB99{*V{z20hrt49^q~h^=yvN*hhbk;V+*N_xyYSoQ@jU z03fXKIl8eQB;uJG1CBZM>rnJv8wx*sc*B>DZG$v4&<}ic6frwc0a*x%(ubanSXz9Sb6IL&ub(Y7fwG!4F2_PE~O4n zwq7ji(QvlD_Gm#T|?V&^XNoc56$N9TaRd;=T+9Oo;pLTE?j9c-{FW^-?{6e`-q z$vefC!wm>?P^;=`k&`m*4scVFuQUBr$0i)Le6QhP&G@EVh?4&9Iq!$m^Ey+Hqk4ZR zcW`+3blY(pJWIMU-Qg;U)CnmxZsS(Z_{19NTn8Zkb7p-hsXm z!P+*FLp0B{#2@4bnM|bF(x9iVbdV zNIieast+rVs$_lef)rbQ7B9$wl29@6&^(U?M^c}pK3JeYB4ARVC5Xdl9F2WpGLs$7 zm)k_x^k|z-85nH#1sZQL*EBLn2Zw|T(KnBO0fUfG(5olDh`T{P4$e6gIaoI3m3yf0H63pEzn%I9+&y5oWv1a3B(M~GJDHM)bKIl4X%|y&J z-WD-X^UaBRI(5iiwmCCc77<2Wyx!IO17uXbrz+i7<_-b@%|3#CMxK$sjC;~p+a8R^ z&Zn*6C^FWmTzcpspA8gi49V88 zg3?+o5NM@1pa=yYc7em0qX+_>9p--!GS(>qkxmhFIAz8v5vSlDSpceJJPlOtoY6zQ zq+W`*GH!VJx8xrRlFmmm|r*ZEfJ`^p-AWe~YH}HPK0>JS+I7P_~T~6gWH>d*BT?j1Y5^Hc= zJ@~{bEgyVhMd)9iPprG&sUW59v-e3OE$@*_<#*(a(ws2&h?u_@|5W9mdvI5MS?;PY z)2n10ESIGT7&(KuC#c04lsSKX_WX4a@%wLi+q333qE=rb^~o{mF$XoV$|-6)|xW&q#kS#w&E*j)r(KK8i0V z+O}@hrK@Wire~fTPlXPet&_HS&I)@&qYEdv;zU20GF8rl;L4GV1VmgV$HetPB=W25 z;GD#gUsa9-zn#X;nqZV6k;*m(p5x2dvV$mM9u;>o91Of0@|bWL;xbLK^JJu*%p{`W z^v9G%u$U)^r4oOF1>d?!?Jjd4ib=$5hGjgOTxLCwO_<xExBv91mI607T1T74&8E9%=*1KyG+UBLCCmQ>-kx)~$VrCt{(I}3 z$3FQ7kLV{`n=6~Y(Pd84+|^;AU#dp-pmBm{^^xSI_LYC=_yN{6Oq`ENe6Fk$ip)!XcPHQA)8{%Z-)G;=nd*D_a05huljLHoG8kV7_$G zwNR(oOB$E1`BsH36}OD8CvI2u4t+O1l*g{PFz$9y(1QbP=JH$C2A6V9cR7^D@-p`U z;T(psKG1)1U67lGbPAt<4S)k2VH6b}1;5~$lUzeWf!)+?t@dar;k;MWk+YHvE!|@~ z2s?F9cpaLpkL-1YbCitG2%nEY9mA#$^H>JAsjc?zWtpqZMc8E{p2F%nuh{jHoRjAl z&_@JVashC8OdrPmWuq1uio8E&qDGe!*eMz*q8@)0K=Bxjd@{q#K6)0UNe%=;{xDGX z5IXZl^P(VV262N({NI`dpb7`k2AV#A4ZH*$AhE7Mfeo(WKLuwP#AwYmU)QlbOafhU@ENf9(GdcwTVD+lro&-yO`D#NO{?*t^_>fgL#Ck5x}Q zwAp|M)>#^Zbppmnf+@ZMm}uA5d|M(OV0V8`tVrQvffa4ROKai zBV6ER>O0Z3#r#V*3VakG8*3wSf_f>%$mT4Rd3`;Ny!CZ5sF^SM>FD*^5SvgslFjf^ znCyrFIq&VH0LD*bKn?I^_n!I7)DVCw#)TD0ZYW!xz76f2r2q}ef{mbll^~f zfd3ys$^)qb|17{%YaVnR32}!cjngwVTO{{6UkkM6KKF8@G00E8C^-~c7i7nQ4XmtO z73h%zQfqu=sE-Xh?o~5S;3$i zs`M_HOxI@WS$_3!mFBEyGFAscJ^yK?WDzSRYgFt?D_UjL4AC-1O`s=N81=og;G-E< zyk|GA%5}^bLhUG}18ALn_2XlqD~wkaO7UVq)bx>`J9Sk0i;ysl*|f!<233Eo(995- z-{ndR{cZ)Ty#OFZ2CO~|MnOvmYpHW_)#d09D_`w67y3Nd#QjZ`A?8XIsAHgj?d-_E zTkNnhPDM^oYS49%Mxf|m37QctsB)u-mrfo{sZU3N@30x@b6i^ru;E4$Trh)EB8S4# zQUk{o3g%Cd_rO3k9Ww^Xu26rXvPQo$uEA=(Lc7I*a{4f`r)#s3eNMwL*7DKa@(y6z zlHgzbG36SQW*Q5)6Py+pjr|*5YQZjMTojZ^Wd=2B`DM=o8b1-(*Ac@M9&Sfu77`eB zIkEUJ#~*)7k|Fuknh4yDVLXBxbAWe z--Y7ZZ!5^&AeN&LIR4oq%ydyP%Pdsq==Np8%`)g0?V)5@TTNJ}c?6e)(;Ccf7<=9p z;%**-Ttkp7O1f5VJVbxEFB#!pKT#1?%6z*)6yTOvGJ;@5jI6L(Y=gR@XnZql#f?hP z6(b%x2Rz)(83^oQftqRU?H(DQJ>S6DV|eChs@L;!*S8&(m|tE|{(gx%J)mGSI@@Em zN5vu4#PcE`(kg_+HN}hwRdXeGrE0O7Z$L|*^3k_lJQzVCq>_In%@ArIjnjktmd;> z_1Wf2nksD>CUv&T)~30w(&8UWM84YX8ZCb6d5c;oDoKB^&F^58sbgT0nB-s-_`5l- z%2e@K?5?JRePpW6E{BMLU1W5+FNcMpJ#;rD>1GGr4NmR$&)wkB$?mzU&17ot+!;QG zcFtYl(`w(`!45aFYwiFK1AFE!sL{cWF}7k>?!hfS_&t}4S^S%zB>O0+V=w$s(1HiP z`eo2AmvVoVFNf+2cU0~N@1SZ<_iK`Q_m-+H_o}!;r=kkCT})w_qAYF26I!a8v=vKe zEs|hT9KoO{f?+X)FQN#-V#NVA&!C zZS!d?M$qJ}=u~{*3o1I$Mo`n@0!?*8+lvXbVbOn9G@zweK&4<&OK||hq5zs`s+AQ1 zxV7Z}1(W`bQ=q%0KAR->8zl9&C-c|o@-@I#x2&zn`VUF^wKO(P&c7{=Y)!&9F$=5C z`sO72dcIq6QvEW?^wk-*h*^^yOaleuAvyjbIsVH?jyJnNTUiqPij&`s@>aA(0L_!! z4HJJ;R+QA5e3y1h>i(h@ez_#=&z_vU_?nw0 zW4En#)9Z%B&DBI$Rv%Wn8-D!9G--Op$ zVN$bkGV{v$y5vmG|CxJtH@B#_opjtO*?84S#!Yvgf4HRLTl#i|K@#z@IhWd`;RTb0 z7fKRtP7W@G(dd$awMoFG{@SG9rexo?B;Q+2?k!EAIhnUHiMQ^MUrEyLZ6xbbJ~7-#OB3tYV)p{)0zlIWiB~njg-Rto0uIbDDZdrjIv# z=%yTgUe{#i`mdQkNv6=BL=!?~PGGZj%bMR2 zUlqKbT~O4!W#?$3q-85aw&gS;x+Fg9`+vqC9FN^v71}+|)oziOx=ZN{&NgrFAkM8R0 zq_+r;n0Wj5dQ0g|=BOqK(!ld0!wv2CKg|s_&y03$6Bw=}@Jv z`VmDP4@D}|8Wjx{MN~Led+C3I9(9~|{!RkA;8~h9Rwg{o0_*1bR;_MTSIeSNkTwje zHV_ZHd!(h{ZqZUIVU~Z}bRg``&B0m-&1cbzi28}5ys*Pg4Zf1oJHarDA}dSz7BPN{ zUyySJlL>u={d_bAs3ZN#!#__Dvr{DHvnpOqQ!1eLl2NDadRFQtmLh)x4MR^xlWcsn zuCA^y&~s*`k;i;HaF{Oqs!Q1-dE?r^MESc|-T9GmFA`5=%WYh4ZHVpDL?fP2^$QQW zKk(nUD2%r@b&c_$eZxR?;5_z1A3D{;E9vW9emlQS9_tVK84J?nzz60Id5} z?O@ghKO$`quq)XQaR??slh!T5kpCU9JEY09F_575)##G@8R~x7tF$hIo5$b1OlCZW z^J)0}DJb`WKY4%tHb~g^(+&9-IrJEfF<<_M?Ejg(vedJ zFyZsD55WKLzy6yX@r5ZgAWtco0_bPs%(9=j$uvFVcKr^|A>{wJRJzFqSRia;Mq^mO z4MkdR{r}6OO-%1OVjN+dMLe20OVJ#Fa-aLh(B=z%*Vu}Moti9A#)?Ern|0O$Lx> z6sdT5&>YzWv%6#Q2>y)1$c5ofL=A*JV103WB`Ymx3oKBz$j9$?NrLqo5m`~SVMt_B zr>L(m<*9#SybJ>$mY-%Yq8n!j;fTziQXlsCyxPOrwI~OH!<_R)C5}RH2z@WHLc~PX zbbyg&uKF9(+hAfBF}VVkaeY2;F8L~+6Hu`>522j9Dso)DH6*H$D)mWtE%SVvIXoSk z@T+UZE5H}8%Nev)I&*gUho18aAT#!J0=o`;wjqD!Y~FmS-z=PpM{nK1Q*Ky2hTNq( z+d?Qlb!QV2M|O@p5xp7-S&@QrDnaSRhLjjs5QR$%ym#S|LUCPpn2+tcRR`Dz%)gs&!-LRyY1k z&aDI(E~6vMS(@8s=WY}yheD&<6R}jN#918x0L_z%B{~{U-(^b02^xMRR910 diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index fd2ce88f585..96dc6e2d3a2 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -93,7 +93,7 @@ "description": "Synch alerts coming in from SAP® enterprise threat detection into Microsoft Sentinel (one way)", "displayName": "SAP ETD - Synch alerts", "enabled": false, - "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nETDAlerts_CL\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId, Id\n| project-away TenantId, Type, Version, EventSourceId, Technical*\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(OriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent)\n by AlertId, Id\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", + "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nSAPETDAlerts_CL\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId, Id\n| project-away TenantId, Type, Version, EventSourceId, Technical*\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(OriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent)\n by AlertId, Id\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", "queryFrequency": "PT1H", "queryPeriod": "P2D", "severity": "Medium", @@ -105,7 +105,7 @@ "requiredDataConnectors": [ { "dataTypes": [ - "ETDAlerts_CL" + "SAPETDAlerts_CL" ], "connectorId": "SAPETDAlerts" } @@ -170,7 +170,7 @@ "description": "Identifies logons from an unexpected network.\r\nSource Action: Logon to the backend system from an IP address which is not assigned to one of the networks.\r\networks can be maintained in the \"SAP - Networks\" watchlist of the Microsoft Sentinel Solution for SAP package.\r\n*Data Sources: SAP Enterprise Thread Detection Solution - Alerts*", "displayName": "SAP ETD - Login from unexpected network", "enabled": false, - "query": "let regex_ip = @\"user_ip:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\";\nlet regex_user = @\"user_name:(\\w+)\";\nlet regex_sid = @\"sid:(\\w{3})\";\nlet regex_client = @\"client:(\\d{3})\";\nlet regex_instance_name = @\"instance_name:(\\w+)\";\nlet regex_instance_host = @\"instance_host:([\\w-]+)\";\nlet SAPNetworks = _GetWatchlist('SAP - Networks');\nETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n| extend Id_ = TriggeringEvents.Id\n| extend extracted_user_ip = extract(regex_ip, 1, sapOriginalEvent)\n| extend extracted_sap_user = extract(regex_user, 1, sapOriginalEvent)\n| extend extracted_sid = extract(regex_sid, 1, sapOriginalEvent)\n| extend extracted_client = extract(regex_client, 1, sapOriginalEvent)\n| extend extracted_instance_name = extract(regex_instance_name, 1, sapOriginalEvent)\n| extend extracted_instance_host = extract(regex_instance_host, 1, sapOriginalEvent)\n| evaluate ipv4_lookup(SAPNetworks, extracted_user_ip, Network, return_unmatched = true)\n| where isempty(Network)\n| project TimeGenerated, extracted_user_ip, extracted_sap_user, extracted_sid, extracted_client, extracted_instance_name, extracted_instance_host, AlertId, PatternName, PatternDescription, Status\n| extend GeoLocation= iff(ipv4_is_private( extracted_user_ip), dynamic({\"IsPrivate\": true}), geo_info_from_ip_address(extracted_user_ip))", + "query": "let regex_ip = @\"user_ip:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\";\nlet regex_user = @\"user_name:(\\w+)\";\nlet regex_sid = @\"sid:(\\w{3})\";\nlet regex_client = @\"client:(\\d{3})\";\nlet regex_instance_name = @\"instance_name:(\\w+)\";\nlet regex_instance_host = @\"instance_host:([\\w-]+)\";\nlet SAPNetworks = _GetWatchlist('SAP - Networks');\nSAPETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n| extend Id_ = TriggeringEvents.Id\n| extend extracted_user_ip = extract(regex_ip, 1, sapOriginalEvent)\n| extend extracted_sap_user = extract(regex_user, 1, sapOriginalEvent)\n| extend extracted_sid = extract(regex_sid, 1, sapOriginalEvent)\n| extend extracted_client = extract(regex_client, 1, sapOriginalEvent)\n| extend extracted_instance_name = extract(regex_instance_name, 1, sapOriginalEvent)\n| extend extracted_instance_host = extract(regex_instance_host, 1, sapOriginalEvent)\n| evaluate ipv4_lookup(SAPNetworks, extracted_user_ip, Network, return_unmatched = true)\n| where isempty(Network)\n| project TimeGenerated, extracted_user_ip, extracted_sap_user, extracted_sid, extracted_client, extracted_instance_name, extracted_instance_host, AlertId, PatternName, PatternDescription, Status\n| extend GeoLocation= iff(ipv4_is_private( extracted_user_ip), dynamic({\"IsPrivate\": true}), geo_info_from_ip_address(extracted_user_ip))", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -182,7 +182,7 @@ "requiredDataConnectors": [ { "dataTypes": [ - "ETDAlerts_CL" + "SAPETDAlerts_CL" ], "connectorId": "SAPETDAlerts" } @@ -304,7 +304,7 @@ "id": "SAPETDAlerts", "publisher": "Microsoft", "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.", - "graphQueriesTableName": "ETDAlerts_CL", + "graphQueriesTableName": "SAPETDAlerts_CL", "graphQueries": [ { "metricName": "Total events received", @@ -489,7 +489,7 @@ "kind": "[variables('blanks')]", "properties": { "streamDeclarations": { - "Custom-ETDAlerts_CL": { + "Custom-SAPETDAlerts_CL": { "columns": [ { "name": "Version", @@ -554,27 +554,27 @@ "dataFlows": [ { "streams": [ - "Custom-ETDAlerts_CL" + "Custom-SAPETDAlerts_CL" ], "destinations": [ "clv2ws1" ], "transformKql": "source| extend TimeGenerated = now()", - "outputStream": "Custom-ETDAlerts_CL" + "outputStream": "Custom-SAPETDAlerts_CL" } ], "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]" } }, { - "name": "ETDAlerts_CL", + "name": "SAPETDAlerts_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ETDAlerts_CL", + "name": "SAPETDAlerts_CL", "columns": [ { "name": "TimeGenerated", @@ -656,7 +656,7 @@ "id": "SAPETDAlerts", "publisher": "Microsoft", "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.", - "graphQueriesTableName": "ETDAlerts_CL", + "graphQueriesTableName": "SAPETDAlerts_CL", "graphQueries": [ { "metricName": "Total events received", @@ -930,9 +930,9 @@ "dcrConfig": { "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", - "streamName": "Custom-ETDAlerts_CL" + "streamName": "Custom-SAPETDAlerts_CL" }, - "dataType": "ETDAlerts_CL", + "dataType": "SAPETDAlerts_CL", "addOnAttributes": { "SubaccountName": "[[parameters('etdHost')]" }, From 951b668718d57ee7faffbeb8a38c622832427842 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 6 Feb 2025 15:53:25 +0100 Subject: [PATCH 10/17] kql fix --- .../SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml index c522a9522bc..11ed09d1533 100644 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml @@ -21,7 +21,7 @@ query: | SAPETDAlerts_CL // | where CreationTimestamp > ago(lookBack) | where PatternName <> "Logon from external with SAP standard users" - | summarize arg_max(TimeGenerated, *) by AlertId, Id + | summarize arg_max(TimeGenerated, *) by AlertId | project-away TenantId, Type, Version, EventSourceId, Technical* | where Threshold >= minThreshold and Score >= minScore | order by Timestamp @@ -35,7 +35,7 @@ query: | | summarize KeyValues= make_bag(KV), take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent) - by AlertId, Id + by AlertId | extend SystemId= KeyValues.sid, ClienId= KeyValues.client, From 52cd58780f30343e33f834c85a9167009f4ff499 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 6 Feb 2025 16:14:20 +0100 Subject: [PATCH 11/17] kql fix --- .../Analytic Rules/SAP ETD - Synch alerts.yaml | 8 +++++--- Solutions/SAP ETD Cloud/Package/mainTemplate.json | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml index 11ed09d1533..e7e613c51fe 100644 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml @@ -19,22 +19,24 @@ query: | let minScore= 50; let lookBack= 70d; SAPETDAlerts_CL + | mv-expand TriggeringEvents + | extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent) // | where CreationTimestamp > ago(lookBack) | where PatternName <> "Logon from external with SAP standard users" | summarize arg_max(TimeGenerated, *) by AlertId | project-away TenantId, Type, Version, EventSourceId, Technical* | where Threshold >= minThreshold and Score >= minScore | order by Timestamp - | extend NewEvent= split(OriginalEvent, "\n") + | extend NewEvent= split(sapOriginalEvent, "\n") | mv-expand NewEvent to typeof(string) | parse NewEvent with Key: string ":" Value: string | extend Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value), - Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key) + Key= iff(isempty(Key) and isnotempty(NewEvent), TriggeringEvents.EventLogType, Key) | extend KV= bag_pack(Key, Value) | summarize KeyValues= make_bag(KV), - take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent) + take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, TriggeringEvents.EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, TriggeringEvents.OriginalEvent) by AlertId | extend SystemId= KeyValues.sid, diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index 96dc6e2d3a2..6b099a894b8 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -93,7 +93,7 @@ "description": "Synch alerts coming in from SAP® enterprise threat detection into Microsoft Sentinel (one way)", "displayName": "SAP ETD - Synch alerts", "enabled": false, - "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nSAPETDAlerts_CL\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId, Id\n| project-away TenantId, Type, Version, EventSourceId, Technical*\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(OriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, OriginalEvent)\n by AlertId, Id\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", + "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nSAPETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId\n| project-away TenantId, Type, Version\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(sapOriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), TriggeringEvents.EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, TriggeringEvents.EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, TriggeringEvents.OriginalEvent)\n by AlertId\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", "queryFrequency": "PT1H", "queryPeriod": "P2D", "severity": "Medium", From 9494118cef5a5fc9dd37884994dd5a7faabb422f Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 6 Feb 2025 16:23:19 +0100 Subject: [PATCH 12/17] kql fix --- .../SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml | 1 - Solutions/SAP ETD Cloud/Package/mainTemplate.json | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml index e7e613c51fe..41d221d9f49 100644 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml @@ -24,7 +24,6 @@ query: | // | where CreationTimestamp > ago(lookBack) | where PatternName <> "Logon from external with SAP standard users" | summarize arg_max(TimeGenerated, *) by AlertId - | project-away TenantId, Type, Version, EventSourceId, Technical* | where Threshold >= minThreshold and Score >= minScore | order by Timestamp | extend NewEvent= split(sapOriginalEvent, "\n") diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index 6b099a894b8..5eeae28eb00 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -93,7 +93,7 @@ "description": "Synch alerts coming in from SAP® enterprise threat detection into Microsoft Sentinel (one way)", "displayName": "SAP ETD - Synch alerts", "enabled": false, - "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nSAPETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId\n| project-away TenantId, Type, Version\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(sapOriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), TriggeringEvents.EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, TriggeringEvents.EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, TriggeringEvents.OriginalEvent)\n by AlertId\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", + "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nSAPETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(sapOriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), TriggeringEvents.EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, TriggeringEvents.EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, TriggeringEvents.OriginalEvent)\n by AlertId\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", "queryFrequency": "PT1H", "queryPeriod": "P2D", "severity": "Medium", From eda5a11793859b883d718ea6f74aa5bb3ab833ca Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 6 Feb 2025 16:37:36 +0100 Subject: [PATCH 13/17] kql fix --- .../SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml | 1 - Solutions/SAP ETD Cloud/Package/mainTemplate.json | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml index 41d221d9f49..2de121389e9 100644 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Synch alerts.yaml @@ -25,7 +25,6 @@ query: | | where PatternName <> "Logon from external with SAP standard users" | summarize arg_max(TimeGenerated, *) by AlertId | where Threshold >= minThreshold and Score >= minScore - | order by Timestamp | extend NewEvent= split(sapOriginalEvent, "\n") | mv-expand NewEvent to typeof(string) | parse NewEvent with Key: string ":" Value: string diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index 5eeae28eb00..613c78683d9 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -93,7 +93,7 @@ "description": "Synch alerts coming in from SAP® enterprise threat detection into Microsoft Sentinel (one way)", "displayName": "SAP ETD - Synch alerts", "enabled": false, - "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nSAPETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId\n| where Threshold >= minThreshold and Score >= minScore\n| order by Timestamp\n| extend NewEvent= split(sapOriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), TriggeringEvents.EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, TriggeringEvents.EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, TriggeringEvents.OriginalEvent)\n by AlertId\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", + "query": "let minThreshold= 1;\nlet minScore= 50;\nlet lookBack= 70d;\nSAPETDAlerts_CL\n| mv-expand TriggeringEvents\n| extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent)\n// | where CreationTimestamp > ago(lookBack)\n| where PatternName <> \"Logon from external with SAP standard users\"\n| summarize arg_max(TimeGenerated, *) by AlertId\n| where Threshold >= minThreshold and Score >= minScore\n| extend NewEvent= split(sapOriginalEvent, \"\\n\")\n| mv-expand NewEvent to typeof(string)\n| parse NewEvent with Key: string \":\" Value: string\n| extend\n Value= iff(isempty(Key) and isnotempty(NewEvent), NewEvent, Value),\n Key= iff(isempty(Key) and isnotempty(NewEvent), TriggeringEvents.EventLogType, Key)\n| extend KV= bag_pack(Key, Value)\n| summarize\n KeyValues= make_bag(KV),\n take_any(CreationTimestamp, MinTimestamp, MaxTimestamp, TriggeringEvents.EventLogType, Measure, PatternDescription, PatternName, Status, Threshold, TriggeringEvents.OriginalEvent)\n by AlertId\n| extend\n SystemId= KeyValues.sid,\n ClienId= KeyValues.client,\n Host= KeyValues.instance_host,\n Instance= KeyValues.instance_name,\n User= KeyValues.user_name,\n IP= KeyValues.user_ip\n", "queryFrequency": "PT1H", "queryPeriod": "P2D", "severity": "Medium", From dc00da7b6e70a38fe79733615d1f8929c12da64d Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 13 Feb 2025 10:04:54 +0100 Subject: [PATCH 14/17] ccp folder structure adjust --- ...P ETD - Login from unexpected network.yaml | 68 +++ .../SAP ETD Cloud/Data Connectors/SAPETD.json | 157 +++++++ .../Data Connectors/SAPETD_ccp/DCR.json | 85 ++++ .../SAPETD_ccp/connectorDefinition.json | 175 ++++++++ .../SAPETD_ccp/dataConnector.json | 54 +++ .../SAPETD_ccp/solutionMetadata.json | 11 + .../Data Connectors/createUIDef.json | 406 ------------------ .../SAP ETD Cloud/Data/Solution_SAPETD.json | 10 +- Solutions/SAP ETD Cloud/Package/3.0.0.zip | Bin 9694 -> 9656 bytes .../SAP ETD Cloud/Package/mainTemplate.json | 10 +- 10 files changed, 562 insertions(+), 414 deletions(-) create mode 100644 Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml create mode 100644 Solutions/SAP ETD Cloud/Data Connectors/SAPETD.json create mode 100644 Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/DCR.json create mode 100644 Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/connectorDefinition.json create mode 100644 Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/dataConnector.json create mode 100644 Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/solutionMetadata.json delete mode 100644 Solutions/SAP ETD Cloud/Data Connectors/createUIDef.json diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml new file mode 100644 index 00000000000..e75d84b9893 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml @@ -0,0 +1,68 @@ +id: 7a830484-e349-4527-85f6-7850c468c238 +kind: Scheduled +name: SAP ETD - Login from unexpected network +description: | + Identifies logons from an unexpected network. + Source Action: Logon to the backend system from an IP address which is not assigned to one of the networks. + networks can be maintained in the "SAP - Networks" watchlist of the Microsoft Sentinel Solution for SAP package. + + *Data Sources: SAP Enterprise Thread Detection Solution - Alerts* +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: SAPETDAlerts + dataTypes: + - SAPETDAlerts_CL +queryFrequency: 1h +queryPeriod: 2d +triggerOperator: gt +triggerThreshold: 0 +tactics: [] +relevantTechniques: [] +query: | + let regex_ip = @"user_ip:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"; + let regex_user = @"user_name:(\w+)"; + let regex_sid = @"sid:(\w{3})"; + let regex_client = @"client:(\d{3})"; + let regex_instance_name = @"instance_name:(\w+)"; + let regex_instance_host = @"instance_host:([\w-]+)"; + let SAPNetworks = _GetWatchlist('SAP - Networks'); + ETDAlerts_CL + | mv-expand TriggeringEvents + | extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent) + | extend Id_ = TriggeringEvents.Id + | extend extracted_user_ip = extract(regex_ip, 1, sapOriginalEvent) + | extend extracted_sap_user = extract(regex_user, 1, sapOriginalEvent) + | extend extracted_sid = extract(regex_sid, 1, sapOriginalEvent) + | extend extracted_client = extract(regex_client, 1, sapOriginalEvent) + | extend extracted_instance_name = extract(regex_instance_name, 1, sapOriginalEvent) + | extend extracted_instance_host = extract(regex_instance_host, 1, sapOriginalEvent) + | evaluate ipv4_lookup(SAPNetworks, extracted_user_ip, Network, return_unmatched = true) + | where isempty(Network) + | project TimeGenerated, extracted_user_ip, extracted_sap_user, extracted_sid, extracted_client, extracted_instance_name, extracted_instance_host, AlertId, PatternName, PatternDescription, Status + | extend GeoLocation= iff(ipv4_is_private( extracted_user_ip), dynamic({"IsPrivate": true}), geo_info_from_ip_address(extracted_user_ip)) +eventGroupingSettings: + aggregationKind: AlertPerResult +entityMappings: + - entityType: CloudApplication + fieldMappings: + - identifier: AppId + columnName: extracted_sid + - identifier: InstanceName + columnName: extracted_instance_name + - entityType: Host + fieldMappings: + - identifier: FullName + columnName: extracted_instance_host + - entityType: IP + fieldMappings: + - identifier: Address + columnName: extracted_user_ip +alertDetailsOverride: + alertDisplayNameFormat: 'SAP ETD - {{PatternName}} ' + alertDescriptionFormat: | + {{PatternDescription}} +customDetails: + SAP_User: User + ETD_AlertID: AlertId +version: 1.0.0 \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data Connectors/SAPETD.json b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD.json new file mode 100644 index 00000000000..23338c1b5af --- /dev/null +++ b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD.json @@ -0,0 +1,157 @@ +{ + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "title": "SAP ETD", + "logo": "SapLogo.svg", + "id": "SAPETDAlerts", + "publisher": "SAP", + "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.", + "graphQueriesTableName": "SAPETDAlerts_CL", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "ETD Events", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Get Sample of ETD Events", + "query": "{{graphQueriesTableName}}\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Client Id and Client Secret for ETD Retrieval API", + "description": "Enable API access in ETD." + } + ] + }, + "instructionSteps": [ + { + "description": "**Step 1 - Configuration steps for the SAP ETD Audit Retrieval API**\n\nFollow the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**.\n\n>**NOTE:** You can onboard one or more ETD subaccounts by following the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment/). Add a connection for each subaccount." + }, + { + "description": "Connect using OAuth client credentials", + "title": "Connect events from SAP ETD to Microsoft Sentinel", + "instructions": [ + { + "type": "ContextPane", + "parameters": { + "contextPaneType": "DataConnectorsContextPane", + "label": "Add account", + "isPrimary": true, + "title": "ETD connection", + "instructionSteps": [ + { + "title": "Account Details", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "SAP ETD Client ID", + "placeholder": "Client ID", + "type": "text", + "name": "clientId" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "SAP ETD Client Secret", + "placeholder": "Client Secret", + "type": "password", + "name": "clientSecret" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Authorization server URL (UAA server)", + "placeholder": "https://your-tenant.authentication.region.hana.ondemand.com/oauth/token", + "type": "text", + "name": "authServerUrl" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "ETD data retrieval API URL", + "placeholder": "https://your-etd-cloud-data-retrieval-service.cfapps.region.hana.ondemand.com", + "type": "text", + "name": "etdHost" + } + } + ] + } + ] + } + } + ] + }, + { + "title": "ETD accounts", + "description": "Each row represents a connected ETD account", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Data retrieval endpoint", + "columnValue": "properties.request.apiEndpoint" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/DCR.json b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/DCR.json new file mode 100644 index 00000000000..4f4f53434f6 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/DCR.json @@ -0,0 +1,85 @@ +{ + "name": "SAP-ETD-DCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "streamDeclarations": { + "Custom-SAPETDAlerts_CL": { + "columns": [ + { + "name": "Version", + "type": "string" + }, + { + "name": "AlertId", + "type": "int" + }, + { + "name": "PatternName", + "type": "string" + }, + { + "name": "PatternDescription", + "type": "string" + }, + { + "name": "Status", + "type": "string" + }, + { + "name": "CreationTimestamp", + "type": "datetime" + }, + { + "name": "MinTimestamp", + "type": "datetime" + }, + { + "name": "MaxTimestamp", + "type": "datetime" + }, + { + "name": "Score", + "type": "int" + }, + { + "name": "Threshold", + "type": "int" + }, + { + "name": "Measure", + "type": "int" + }, + { + "name": "TriggeringEvents", + "type": "dynamic" + } + ] + } + }, + "dataSources": "[variables('TemplateEmptyObject')]", + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-SAPETDAlerts_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source| extend TimeGenerated = now()", + "outputStream": "Custom-SAPETDAlerts_CL" + } + ], + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]" + } +} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/connectorDefinition.json b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/connectorDefinition.json new file mode 100644 index 00000000000..76ee314d527 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/connectorDefinition.json @@ -0,0 +1,175 @@ +{ + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "title": "SAP ETD", + "logo": "SapLogo.svg", + "id": "SAPETDAlerts", + "publisher": "SAP", + "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.", + "graphQueriesTableName": "SAPETDAlerts_CL", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "ETD Events", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Get Sample of ETD Events", + "query": "{{graphQueriesTableName}}\n | take 10" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Client Id and Client Secret for ETD Retrieval API", + "description": "Enable API access in ETD." + } + ] + }, + "instructionSteps": [ + { + "description": "**Step 1 - Configuration steps for the SAP ETD Audit Retrieval API**\n\nFollow the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-for-global-accounts-in-cloud-foundry-environment/). Take a note of the **url** (Audit Retrieval API URL), **uaa.url** (User Account and Authentication Server url) and the associated **uaa.clientid**.\n\n>**NOTE:** You can onboard one or more ETD subaccounts by following the steps provided by SAP [see ETD docs](https://help.sap.com/docs/ETD/sap-business-technology-platform/audit-log-retrieval-api-usage-for-subaccounts-in-cloud-foundry-environment/). Add a connection for each subaccount." + }, + { + "description": "Connect using OAuth client credentials", + "title": "Connect events from SAP ETD to Microsoft Sentinel", + "instructions": [ + { + "type": "ContextPane", + "parameters": { + "contextPaneType": "DataConnectorsContextPane", + "label": "Add account", + "isPrimary": true, + "title": "ETD connection", + "instructionSteps": [ + { + "title": "Account Details", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "SAP ETD Client ID", + "placeholder": "Client ID", + "type": "text", + "name": "clientId" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "SAP ETD Client Secret", + "placeholder": "Client Secret", + "type": "password", + "name": "clientSecret" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Authorization server URL (UAA server)", + "placeholder": "https://your-tenant.authentication.region.hana.ondemand.com/oauth/token", + "type": "text", + "name": "authServerUrl" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "ETD data retrieval API URL", + "placeholder": "https://your-etd-cloud-data-retrieval-service.cfapps.region.hana.ondemand.com", + "type": "text", + "name": "etdHost" + } + } + ] + } + ] + } + } + ] + }, + { + "title": "ETD accounts", + "description": "Each row represents a connected ETD account", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Data retrieval endpoint", + "columnValue": "properties.request.apiEndpoint" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + } + ] + } + ] + } + },"metadata": { + "id": "SAPETDAlerts", + "version": "3.1.0", + "kind": "dataConnector", + "source": { + "kind": "solution", + "name": "SAP Enterprise Threat Detection, cloud edition integration with Microsoft Sentinel" + }, + "author": { + "name": "Michael Schmitt", + "email": "m.schmitt@sap.com" + }, + "support": { + "tier": "Partner", + "name": "SAP SE", + "email": "support@sap.com", + "link": "https://me.sap.com/" + } + } +} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/dataConnector.json b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/dataConnector.json new file mode 100644 index 00000000000..6e908b3534f --- /dev/null +++ b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/dataConnector.json @@ -0,0 +1,54 @@ +{ + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/',variables('connectorName'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SAPETDAlerts", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-SAPETDAlerts_CL" + }, + "dataType": "SAPETDAlerts_CL", + "addOnAttributes": { + "SubaccountName": "[[parameters('etdHost')]" + }, + "auth": { + "type": "OAuth2", + "ClientSecret": "[[parameters('ClientSecret')]", + "ClientId": "[[parameters('ClientId')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(replace(parameters('authServerUrl'), '/oauth/token', ''), '/oauth/token?grant_type=client_credentials')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded" + } + }, + "request": { + "apiEndpoint": "[[concat(parameters('etdHost'), '/alerts/v1/Alerts')]", + "queryWindowInMin": 10, + "httpMethod": "Get", + "retryCount": 3, + "timeoutInSeconds": 60, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "queryParameters": { + "$expand": "TriggeringEvents", + "$filter": "CreationTimestamp gt {_QueryWindowStartTime} and CreationTimestamp le {_QueryWindowEndTime}" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Scuba" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ] + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']" + } + } +} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/solutionMetadata.json b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/solutionMetadata.json new file mode 100644 index 00000000000..c196c0ca487 --- /dev/null +++ b/Solutions/SAP ETD Cloud/Data Connectors/SAPETD_ccp/solutionMetadata.json @@ -0,0 +1,11 @@ +{ + "SolutionName":"SAP Enterprise Threat Detection, cloud edition", + "SolutionAuthor": "SAP", + "SolutionVersion":"3.0.0", + "PackageId": "azuresentinel.azure-sentinel-solution-SAPLogServPushV1", + "TemplateName": "SAPETDPushV1", + "ConnectorDefinitionTemplateVersion": "1.0.0", + "DataConnectorsTemplateVersion": "1.0.0", + "PackageIcon":"SAP", + "SolutionTier": "Partner" +} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data Connectors/createUIDef.json b/Solutions/SAP ETD Cloud/Data Connectors/createUIDef.json deleted file mode 100644 index 7ed008dbc6d..00000000000 --- a/Solutions/SAP ETD Cloud/Data Connectors/createUIDef.json +++ /dev/null @@ -1,406 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2021-09-09/uiFormDefinition.schema.json", - "view": { - "kind": "Form", - "properties": { - "title": "Microsoft Sentinel: SAP ETD Data Connector", - "steps": [ - { - "name": "basics", - "label": "Basics", - "elements": [ - { - "name": "resourceScope", - "type": "Microsoft.Common.ResourceScope" - }, - { - "name": "getLAWorkspace", - "type": "Microsoft.Solutions.ArmApiControl", - "request": { - "method": "POST", - "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", - "body": { - "query": "[concat('resources | where type =~ \"microsoft.operationalinsights/workspaces\" and subscriptionId == \"', steps('basics').resourceScope.subscription.subscriptionId, '\" | project label = name, description = location, value = pack(\"name\", name, \"location\", location, \"resourceGroup\", resourceGroup, \"id\", id) | order by label asc')]" - } - } - }, - { - "name": "getKeyVaults", - "type": "Microsoft.Solutions.ArmApiControl", - "request": { - "method": "POST", - "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", - "body": { - "query": "[concat('resources | where type =~ \"microsoft.keyvault/vaults\" and subscriptionId == \"', steps('basics').resourceScope.subscription.subscriptionId, '\" | project label = name, description = resourceGroup, value = name | order by label asc')]" - } - } - }, - { - "name": "sentinelWorkspace", - "type": "Microsoft.Common.DropDown", - "label": "Sentinel workspace", - "defaultValue": "[parse('[]')]", - "toolTip": "", - "multiselect": false, - "selectAll": true, - "filter": true, - "filterPlaceholder": "Filter items ...", - "multiLine": true, - "visible": true, - "constraints": { - "allowedValues": "[steps('basics').getLAWorkspace.data]", - "required": true - } - } - ] - }, - { - "name": "identity", - "label": "Identity", - "elements": [ - { - "name": "keyVaultNameApi", - "type": "Microsoft.Solutions.ArmApiControl", - "request": { - "method": "POST", - "path": "[concat(steps('basics').resourceScope.subscription.id, '/providers/Microsoft.KeyVault/checknameavailability?api-version=2022-07-01')]", - "body": { - "name": "[steps('identity').keyvault.newKeyVaultName]", - "type": "Microsoft.KeyVault/vaults" - } - } - }, - { - "name": "announcement", - "type": "Microsoft.Common.TextBlock", - "visible": true, - "options": { - "text": "The SAP ETD data connector collects data using a Client ID and Client Secret to connect to ETD.", - "link": { - "label": "Learn more", - "uri": "https://learn.microsoft.com/azure/sentinel/business-applications" - } - } - }, - { - "name": "spn", - "type": "Microsoft.Common.Section", - "label": "Client credentials", - "elements": [ - { - "name": "clientId", - "type": "Microsoft.Common.TextBox", - "label": "Client (App) ID", - "placeholder": "example: sb-101464cb-6d15-4abd-9dbd-gx233d401e22!b312711|etdcloudprod-004-prod-etd-cloud-service-broker!b274464", - "constraints": { - "required": true - } - } - ], - "visible": true - }, - { - "name": "keyvault", - "type": "Microsoft.Common.Section", - "label": "Key Vault", - "elements": [ - { - "name": "useExistingKeyVault", - "type": "Microsoft.Common.OptionsGroup", - "label": "Create new, or existing Key Vault", - "defaultValue": "New", - "toolTip": "", - "constraints": { - "allowedValues": [ - { - "label": "New", - "value": false - }, - { - "label": "Existing", - "value": true - } - ], - "required": true - }, - "visible": true - }, - { - "name": "newKeyVaultName", - "type": "Microsoft.Common.TextBox", - "label": "Key Vault name", - "defaultValue": "[toLower(concat('SAPETDkv', first(split(steps('basics').resourceScope.subscription.subscriptionId, '-'))))]", - "toolTip": "Name of the Key Vault", - "constraints": { - "required": true, - "validations": [ - { - "isValid": "[steps('identity').keyVaultNameApi.nameAvailable]", - "message": "[steps('identity').keyVaultNameApi.message]" - } - ] - }, - "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]" - }, - { - "name": "existingKeyVaultName", - "type": "Microsoft.Common.DropDown", - "label": "Azure Key Vault", - "defaultValue": "[parse('[]')]", - "toolTip": "", - "multiselect": false, - "selectAll": true, - "filter": true, - "filterPlaceholder": "Filter items ...", - "multiLine": true, - "constraints": { - "allowedValues": "[steps('basics').getKeyVaults.data]", - "required": true - }, - "visible": "[steps('identity').keyvault.useExistingKeyVault]" - }, - { - "name": "secretName", - "type": "Microsoft.Common.TextBox", - "label": "Secret name", - "placeholder": "example: secret1", - "toolTip": "Name of the secret in Key Vault (not the actual client secret)", - "constraints": { - "required": true - }, - "visible": true - }, - { - "name": "secretValue", - "type": "Microsoft.Common.PasswordBox", - "label": { - "password": "Client Secret", - "confirmPassword": "Confirm secret" - }, - "toolTip": "The client secret value from SAP ETD", - "constraints": { - "required": true - }, - "options": { - "hideConfirmation": true - }, - "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]" - } - ], - "visible": true - } - ] - }, - { - "name": "etd", - "label": "API Connection", - "elements": [ - { - "name": "uaaUrl", - "type": "Microsoft.Common.TextBox", - "label": "Authentication Server URL", - "placeholder": "example: https://etd-cloud-wv245d01.authentication.eu10.hana.ondemand.com", - "toolTip": "UAA URL", - "constraints": { - "required": true, - "regex": "^https:\/\/[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", - "validationMessage": "Please enter a valid URL starting with https:// and without a trailing \"/\"." - }, - "visible": true - }, - { - "name": "apiHost", - "type": "Microsoft.Common.TextBox", - "label": "SAP ETD API Host URL", - "placeholder": "example: https://etdcloud-data-retrieval-service.cfapps.eu10-004.hana.ondemand.com", - "toolTip": "UAA URL", - "constraints": { - "required": true, - "regex": "^https:\/\/[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", - "validationMessage": "Please enter a valid URL starting with https:// and without a trailing \"/\"." - }, - "visible": true - } - ] - }, - { - "name": "roles", - "label": "Role Assignments", - "elements": [ - { - "name": "roleAssignment", - "type": "Microsoft.Common.Section", - "label": "Storage and DCR Role Assignment", - "elements": [ - { - "name": "storageOverview", - "type": "Microsoft.Common.TextBlock", - "visible": true, - "options": { - "text": "As part of the deployment, the Funcion App uses identity based connection to host storage. The Function App managed identity must be assigned the Storage Blob Data Owner role on the Storage Account.", - "link": { - "label": "Learn more", - "uri": "https://learn.microsoft.com/azure/azure-functions/functions-reference?tabs=azurewebjobsstorage&pivots=programming-language-csharp#grant-permission-to-the-identity" - } - } - }, - { - "name": "dcrOverview", - "type": "Microsoft.Common.TextBlock", - "visible": true, - "options": { - "text": "As part of the deployment, Data Collection Rule (DCR) and Data Collection Endpoint (DCE) resources will be created. To ingest data, the Function App managed identity must be assigned the Monitoring Metrics Publisher role on the DCR.", - "link": { - "label": "Learn more", - "uri": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview" - } - } - }, - { - "name": "dcrInfo", - "type": "Microsoft.Common.InfoBox", - "visible": true, - "options": { - "text": "Role assignment typically requires Owner or User Access Administrator privileges on the target resource.", - "uri": "https://learn.microsoft.com/azure/role-based-access-control/role-assignments-portal", - "style": "Info" - } - }, - { - "name": "hasPermissions", - "type": "Microsoft.Common.OptionsGroup", - "label": "Role assignment", - "defaultValue": "none", - "toolTip": "", - "constraints": { - "allowedValues": [ - { - "label": "Yes (I have sufficient privileges for role assignment)", - "value": true - }, - { - "label": "No (I will assign roles after deployment)", - "value": false - } - ], - "required": true - }, - "visible": true - } - ], - "visible": true - }, - { - "name": "ketVaultRoleAssignment", - "type": "Microsoft.Common.Section", - "label": "Key Vault Role Assignment", - "elements": [ - { - "name": "kvOverview", - "type": "Microsoft.Common.TextBlock", - "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]", - "options": { - "text": "As part of the deployment, a Key Vault resource will be created to store the client secret of the Microsoft Entra Service Principal. To ingest data, the Function App managed identity must be assigned the Key Vault Secrets User role on the Key Vault.", - "link": { - "label": "Learn more", - "uri": "https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide" - } - } - }, - { - "name": "kvInfo", - "type": "Microsoft.Common.InfoBox", - "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]", - "options": { - "text": "Role assignment to the Key Vault typically requires Owner or User Access Administrator privileges on the target resource.", - "uri": "https://learn.microsoft.com/azure/role-based-access-control/role-assignments-portal", - "style": "Info" - } - }, - { - "name": "hasPermissions", - "type": "Microsoft.Common.OptionsGroup", - "label": "Role assignment", - "defaultValue": "none", - "toolTip": "", - "constraints": { - "allowedValues": [ - { - "label": "Yes (I have sufficient privileges for role assignment)", - "value": true - }, - { - "label": "No (I will assign roles after deployment)", - "value": false - } - ], - "required": true - }, - "visible": "[equals(steps('identity').keyvault.useExistingKeyVault, false)]" - }, - { - "name": "noKvPermissions", - "type": "Microsoft.Common.InfoBox", - "options": { - "text": "To complete the deployment, you will need to assign the Key Vault Secrets User role to the Function App managed identity on the Key Vault resource created during deployment. For more information, see the deployment guide.", - "uri": "https://learn.microsoft.com/azure/sentinel/business-applications", - "style": "Warning" - }, - "visible": "[or(steps('identity').keyvault.useExistingKeyVault, equals(steps('roles').ketVaultRoleAssignment.hasPermissions, false))]" - } - ], - "visible": true - } - ] - }, - { - "name": "tags", - "label": "Tags", - "elements": [ - { - "name": "tagsByResource", - "type": "Microsoft.Common.TagsByResource", - "resources": [ - "Microsoft.Resources/deployments", - "Microsoft.Insights/components", - "Microsoft.Web/serverfarms", - "Microsoft.Storage/storageAccounts", - "Microsoft.Web/sites", - "Microsoft.Insights/dataCollectionRules", - "Microsoft.Insights/dataCollectionEndpoints", - "Microsoft.Authorization/roleAssignments", - "Microsoft.OperationalInsights/workspaces/tables" - ] - } - ] - } - ] - }, - "outputs": { - "kind": "ResourceGroup", - "location": "[steps('basics').resourceScope.location.name]", - "resourceGroupId": "[steps('basics').resourceScope.resourceGroup.id]", - "parameters": { - "functionAppName": "[steps('function').newFunctionAppName]", - "storageAccountName": "[steps('function').newStorageAccountName]", - "appInsightsWorkspaceResourceId": "[steps('function').appInsightsWorkspace.id]", - "roleAssignmentDcr": "[steps('roles').roleAssignment.hasPermissions]", - "roleAssignmentStorage": "[steps('roles').roleAssignment.hasPermissions]", - "roleAssignmentKv": "[steps('roles').ketVaultRoleAssignment.hasPermissions]", - "sentinelWorkspace": "[steps('basics').sentinelWorkspace]", - "etdUaaUrl": "[steps('etd').uaaUrl]", - "etdApiHost": "[steps('etd').apiHost]", - "tagsByResource": "[steps('tags').tagsByResource]", - "keyVault": { - "useExistingKeyVault": "[steps('identity').keyvault.useExistingKeyVault]", - "keyVaultName": "[coalesce(steps('identity').keyvault.existingKeyVaultName, steps('identity').keyvault.newKeyVaultName)]", - "secretName": "[steps('identity').keyvault.secretName]" - }, - "secretValue": "[coalesce(steps('identity').keyvault.secretValue, 'empty')]", - "identity": { - "clientId": "[steps('identity').spn.clientId]" - } - } - } - } -} \ No newline at end of file diff --git a/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json b/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json index 0ce0c01ddf4..def80c74e0e 100644 --- a/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json +++ b/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json @@ -6,17 +6,21 @@ "WorkbookDescription": [], "Workbooks": [], "Analytic Rules": [ - "/Analytic Rules/SAP ETD - Synch alerts.yaml" + "/Analytic Rules/SAP ETD - Synch alerts.yaml", + "/Analytic Rules/SAP ETD - Login from unexpected network.yaml" ], "Playbooks": [], "PlaybookDescription": [], "Parsers": [], "SavedSearches": [], "Hunting Queries": [], - "Data Connectors": [], + "Data Connectors": [ + "Data Connectors/SAPETD_ccp/connectorDefinition.json", + "Data Connectors/SAPETD.json" + ], "Watchlists": [], "WatchlistDescription": [], - "BasePath": "C:\\GitHub\\Azure-Sentinel", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\SAP ETD Cloud", "Version": "3.0.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, diff --git a/Solutions/SAP ETD Cloud/Package/3.0.0.zip b/Solutions/SAP ETD Cloud/Package/3.0.0.zip index 70d2afb81813d60122dd2e10b512b6b490daa14b..bf7e1f7f2c6cbe022515750290fbdbd126c1a910 100644 GIT binary patch delta 7689 zcmY+JWl)?Aldh5A9tbwL1PBt`<%Qr9+#$HTYj}Xc-66P3Z~_D;0|W^ULm1p`aCg}E zt8@08-InU=s=mAb_qD3jri7!Wg#3mG0sUWBP*X{@LE{I=TWW1S{+o~9H8#g$OB&n5 z?xzW75?amk(>Tt2oIC+SzGT$64LrWi6sA7?`T3?;Rr`M>*{`QjBJvpf);96Z~1M1h1U#h3o!}(2Q$4;rMya{{LH-izr+}Y{{ zpJ8#p{dv?&c9^3j8qYn)qHk0CHIu{Tx0d#njfQrTWz$Yg{+s|_>yloXkXP02B8ooT zC(_lIfxcm!KngpD=IGZlc5AkB+<1am)lCA?QUy^QDaW9ufYNMtR~`zsO&6q((TL2^ zJ5$?q=ormRXcdoQ(>prx+!eIp$q4a%f?rI5Sv{Hz@vx!u@!So3b&8G`1`zeM*Yo^X z!GNZ3Z#uBifR*igt_oH1UAv`?4P|Ivh~<>u1-B%VAATbEGJeI_HH^E`K2UedAEoe? z%SL`8HR~=;XpGkFpIzP#(M8pH9(R!;&cE2Nx{;@=;{y^q3TQKnf? zbx`-XPAw)Zch#ziL%QqsR|Mx-Au#qn*8+)7FjG1v8fq^y&?G;QWRg_k+KOrCd&C6- z4)J(`$gk!eUlte9G!@g(rvyjeJM#hzzb5UCHjx(tOS*91Th3RksvIp6)bL=D`E4zl z;iHgn356K%K8*F3CF-kp+TWhkBPHG73pe;quGW@fEKBfFeERm=y;;DJoKF#ftvD|H6!Yg#~`7m zqp(bZrgIhNB%5)Xj|cI^Wwif6N9i8oMZC2WW&k?lt zgVe9y8xPJkH>AVZ_+*`_W>}Pf);HS|<4B>3!V}NBz_ber89Y_E1X>Rdo>6aC{R8N} zAI%4#f;@?E2w?67wtLAGtsC!}x$cC1Am0i5{0Dk1n1OgG__SQ|V#RPvptfoaei1s6 zdFkDZF8;e~%Ae>mklZIye9W^Cbg;L6-ua}@%ubU^=VJD)^oS9$u#p|83Sj*y>Mr{s zLj#3YyTI)8>D<_%XNf?(JBx8H^G|4s_jt6NACi_^I6bi0Q#a87_p*;pX4<3xz3VvaVa7Jk^ z*`Ko)uxEHXl&btOWcbO2?n;XuwE55{gSfN@yhbAM=?UT)pG;wp#YZFiF7&;<+A5sD zq-}6jdySGMtDru{>n& zD5(~pe7rb_rVIldBLllxsQn~e?@91gM7Eby(DHZEtABLQTf7QzcQ(O>gsv&w$vaXp z`cp5~F}ox0GDdYHgTLM5u6F#=eWF~Tb)(@ccmJtgw6h3XgVFRVJo@8};CPCA*%Z1? zFXW0cdA`La%6AYfxAm8{(0lL9lX_Z^>UQeIiLotAr$YV%g%1Yq6!brx3zzD`+hYs6M5w7+W!VAMJb|aU0NL3gb(W!bp8@+qO zR~g2a3a9u7P0Yzo=(D7W&u%WY@_uu8V$RH*p|K$}94=@gXnK53{d-R_D~^QIsHV<| z0b!5I&>sMHMPuSozsU*y?WQ?`VYXg!#`@HDMN} z#~EPCqH31?>CMlKlC|mr?_r_5+z{I~>0$e`KKt^hGamxBH~V2WQ%+}arttUQqiIlF zP~Sy>`c62WWF&T9>?Ln;N(d;NKmE>q{I*ZFOXdy8e>Nv)n&#XpBZuvL4UHnX=jsh( z5+F#r#lHyO5mG_KKl%Gkp3Z+fjFKryqFFm6h zvaO;1GxsHjfQ$3emc{jEk(L`Xni74+h!i^k1+kLIatx1<0TJ}O%Ab$f7H zh^FBM0S#eDKh}X}QQZ#>6qlmE8<*iO(<$gzu;|`~Xol;+C&TWpQL}>Vta#^DUI2%M zm1LaqQPhyFrD3VV)+F|xlYGC}z}>W{ad&VNPYRqn6Tm|X0_7qGjME+H%24gL9{@p= zYu~2cj1_;jyuJt2Zgh!p7njpi3ngV3{ zu9tk~W}R7x5dJqP=9}!It=eWp-oQR(B?WDb6QPjwrIy1JExHZw=b`rm2C*LkO;P^B zZI6HlEo~ha7caP8jD_{2wV<_*6M#tsT3$`@Ptm5tvIOBo!5QgVWl7;*Q~8!n3`1%p|%%1>Dkkxyn&6*vBS2z`VxJ( z(nwdkqkb&s4N~^kH-zy=NfLG@<#3+gl7()GM}<}7=-`+lzEkm6$(81WT@<>K!*qp$n41vo@L*du=%LT3!v z@omep3ei!hy+iu%OVE*wsdn)-PFRqV>j*pqtyVt}RID@TBYfW$!vVBTil;wy7k>%8 z6+U@_FOUgqq~6mE75Bs8xbFa5Gr|Fd{Q|}pZ2c_S?kzR{v?n^`D&{hGnjg5o zDh(3&*wuw3D@8qm4UD9!0_+*5w}0Q+W9yBTX?n(#3wyRkhyn}dPF`-p?hvI$dqeVf zILr`A*A;q*=jTqg;V~k6l1$TyUR^yDm8I(Rp>~B|bVjviJ{4c&59(%4j0^0WbnWG8 zX0B?od}n07RPoBKP`Fomg~Z+{;txgydtJuwVE9S*!(5V<@()dR>6t3Vax7kO@zOn! zL>7P1udg2;K!Ee<^NkV6!olbkcxCp-Gk6xU?3nNfEgXldFIe)?GO1veFVkb&rwE zlYjMnaYA^OYO{%!++k_+LGnT|=LGAfX56`cI?fb111=@^@-#vbnp<5mdbLKH0AY_#-P%r@wM zO-Ae2Qw$Fp1D034fw}eo73Fkj%R>p4W}7P$&Ij|O!7r`ninkCqZ)#Bn{*HezJeFno zK&MMWfS~Y@;gz~4-*l^2b-s!5te^Wy`*fOib$A;2?pU(`Z##!z~BU_waTXJ0^*t(bVwaqjzNbWD%Z_m<{Q*CfmMTL!7 z>wPR8sr`Ei3&U8IeTaTs8pPe>H3zf>o(jb0-frCJ9LCMIZF=ewbVr2}*(klO+NSgk zxjmxb;7;A>dR-OXYg7%|8bP#l@UXfR=(x1Y?iA*{Qkom4;*B{MmB{FV_FUv*a?djY z0GKt^tuC(ZBnFyJ3uV!JU!uH8U!;ggTV?u;N@(O9`F-;JO5~rsCCLU#i z(mlzyd;idE;~`t|6!p8LX;VvTMuSu~U;nZpcnP5kOo<{nt~2fRKtj2AHyGY!XTny3^KS}wIFV&_%5#!EOnno$;l3$A zNHj^P4!A4)VT{W@oU}{EI}sN!MAz3ykaoqnp@+6|1^>M!*xjc(sr2)-%sS%}j$R1V z#$0<4mZCQtpzGUCp_OCklboUawo1-uD*Mi^tw;Q3=mjri4`sfqcAw>b1p-w(dKM4u z9<3#Xg)9Ws_-_@Bqlz|6q@rUJHOT!+%6UM9*$C*gvJ>Dns4(eNx;6s8W?I+F_|8K; zo@QH-8#L*#_}K&yH>@^AHsXIju?k=Z648Jh=-p%dS$>o5^X~h76~pMh_TsMm_VNDw z?s^eFM@=|o{A@GpCn#iU*$|!!3#l7Vp0Jtvdt3uxbyp z5RoB?<$MTE4Yu*ScN3Lj<0@Lcdsjo|kxsPNs-da*Nj`14(x@$=yc-1MP>0qS4Ycr3 zMkm#Di@quohg5;k@sSYXZwqvM9*P3Dj$h*vE7#ncwF3RecKi@yfV){{jlYI zVYG*+Hc~o$NFnI^6-Sn`fHhn{=-M@%TZfmd8eBLLWWb_7pg2PQZfzz;hm7x2bDTQi z{>VGoucxASwh`}67vihkDK#V1L=+DY7Gp0S&Krw~BU&)ae7R`sABHFMgg-pX$Y%|9 zEp4iTKj_$6M~$5V?q%UYKSSrfASBTtX9%H|6f%yrK-=5k?pH(U_1jl}m z8Z`fSIg)Uk<@Wm&!EQS-2Lz&SncrjrH_W`o+hg2Vb3#Z#-;$b%9;^b|^cQsqAMB`h z7&n?xyFh~#Kf@t8ku3B04DqFP>7YdQGbLHbyegn2ozK1IjE~aBm=Q;#M?lZ&NW4^7 zSNVAj+t97#t>^Ek$O%NeTMtyE0KGzMgU5iOL7Pbd*BjD&p=|E^uDToJNRHi1UFd>I zaWNhl-(R6tHf5B^5 z@9l0jiZSa?L=1(X4%y8t6$`b{xzs~j2R>l2GJjXX7ji9Sa>{ZlcYDBe3efBn@0Lh;Nj_oqQPNGBv0> z@LcB%E%>P6-&IviR;}$u`Kx{yw(^f3XAqm{vt2Bm{0%-QoHT?Qs4Ik{ildhdP^S7& zFaVFV3IaL%L9X^c!%xr>Kl4w0b$YM4w6}W3)$DhIRiI}p=rwrIgOeUtdnEROG-Cj~1*r;W4SmJK%ix=+Qv6gMQ zVu;x-TIr9S2j^V&dJeaOw>8fh+OmYr=l~{W+FtLJ;Vh(3b=%s4Ga0CgUfUNbhrBT1 zLtjV-`rtJ_aV=O)yyuUHQ>~Ahzyc#2#AY~O=p-J0jg`Gjo(F#yDCvc{h;DC?SXf12 z7w{ay&$bB1ZibRnLM831m`wHL{vix*Y3e}q(fMc!5k?%;pIvDxQ-LFrLJ@5zf!F%k zTZiCUXMMxVN9xN52Rp~yNkErkA^WF`xvPoU(I=~m(`p_^f*;eji*kE~2D!C{a+bg~QI>l<4Pu1fYbT8$%6T6cNsI#^< zJ)KQvk@Vbg9A}`t$gn@T`>hm+6$G5~35>5f8y=U>lQm^@2Tg&b7lQz$72>SFG_VYsJrFeB>P2ex1RRWFTF;-<-YRVo&*8T2B*TR?V3Rs z-!D^gPGnwP{f2$66tKZvTUN8YEq;SoyCfgebeD5gjWAoLckmo8Bb1(7{Q6YxAx?e} zpKLs%?0-C7Tr5^yR%m-uMAtfpPmijG~7onZ>Rqnde--g^L%IF6jLh zH+k|&`{T}lb@&I@M&U2upZJWT(j_=I1nObc$5pR);P&`GFJ;@GbIz?+`VJBMbEm3# z=+4nq^^l>){&E+b^z-RJix&RcDki$$(@9$O!;&TAT1W#DCBiw3qOtNvo!njc607jt zMJ>qRc6SXa6w!j|FtsW|nB&UK?(KjsO1%vU(Y5mewn|zv;21tkZ0uzXBYs>a)J_LR zuw~{R@{>FykHRGY9Y2l0si*Kx%oo(X-S5q_M{)At^YpsELwGshI!*>g)KgQ| zq|5pyWPt@hsc=om0vQs=Q1m>sKhvS;gXXO-aW=#6FwD4*Nt99 z&AN%@a5T1lDcr4zUCzwioaRou<#Uf>r^}f;WdWNUvJBRksTY0viDB*?QMz2UImcUu zWdD)OYmvjQEW(_Hd+L5Um5UKXU3+-wfPI^*udvUxhD%Y7)d$x&l3(rQ=Tv`@)$xfb zU5*6?2<<#Tx`rV0N8ahEJ?-bQPp5d#0vs{hwJOFIqRwlaYBYk0-BW04*JtJr)`@G= zE~ym{TS0@N4B}TI?Z|78-}ka2f5OKo-T569@DX z&}-_2vXr6FO|XPNSEy^W{hRB*wnI&C;5|oph6$$ku^L{Dt#@JvZ%GnyNIZ1Md26#y zVm~HMmlP0BTR`6d8OM_r9dR)0k}Go3E$Z5 z%1YCUFkF66u+dgb(BN&Xlj1{WLK)VK)mj&2PIL^lTP3h#d0+IM!#0*(t!0?$^hQ1| zoSHyi9bzVL>0MFT!nq@4(ZzsFok4BOSqv&e--sG3(4cPh)4AVxl1+>FWyWz={FbTu zUj(45$8KH>7x^X6qx&512RL&!jz$?FkG6?Z3ucDDvwEXdGj74cQy`Nt`ZGeBPlHbi zqaK{^k_wq^#OUqU=|T!T@5og&EaS1sT)WEEMflcKKnU|%pT$XT^t(I``VsgczsJi) zwcYHR!95f1h}C}AEs~SO-0ZQ9ad0g^9P{Q%6GQPMf9b%lCT1gpbpQn$k86mIWsB-8 ziBJ{s>8Hu0L|=hsgq-HXt;d#HPx+^IS5?zR1yI0z-~bV2qZb6VyzUs4@q%ltPH2o{ z{SR)1n#-+|7fMIOMiry#C}~L)oY-E@O81Bb{s9~+EIcal`O$f<(~|GOTx|PEvufW_ z8;64Dwd0)0`-EY}6(Hl&pO{$|?R4#D7JsX_(u4k8O6>Mq%k_Z2!S~eB>hY{rm3K!U zCbhi}BU7f3VW~7VHeO7>NE-}5-4)IPQDtfP`1g$*3oSmwUxUt7#;aGx9Ht%UtSA0y z-%3(2jw+CrOjgqg-%Z=9cYdW-Q$j;eTXy&0qeMV(pGH7XQ^NXh$VzFboQxxi^&htS ze;I3|7CPDoL?j~Q|3_gB{->4zffV7ttu+JzAvKSYiSs{*R!!;ui~ikeKxp8mb&ZOE okVuSxK=QvtX_Tq|FtU^X=cbwx%D*EB2uS~W^S||k;XmDf0jAmt!vFvP delta 7726 zcmY*eRZyG@vs~OQ5L|*29D-|bcTHe%TL|v@;RJVgcXtTx!QI*58k`_O?m6|>wdsec zsh;V1nWyPCg)IdPRRuVBJP`6f$afV=%qJ56Z?cLI=dz+J@ce zzu|jv85i~p1-zARsbU%<`N7%)7HVgRA~8+eYlCkM_@7c#!|1*b(O)5x&vB(A;_!%W z@oOsaw-I6D-|z;c(t(m_oUEM4CE?c+UlO}=j+_dmQ6Q4WG@lFEV+d9NE}ZY?Slf>rZ#;Tlc<$J0GII{h>mgbExA{H}z%c zuT1X_CRmRrkw5dY4+<{ga1PyLR{B1jHb9yHPgCTmXvNi-um{V4L%+AY?DXN(gSaTi zR7~fzcEU@JdIU3Xy_Q-W@G~B~+YMGj%1 z`-0CN7CM#n1w&meaH#F|1yOf?2~m#JjqB%nw%u|l%+;BjAXorsrp(>_$MHu>cm^Bhe> zZ*Q7T)yDQ^%15@cUocuOwISQrEHnjr+-WQIEG?qT5DpfQ0OmVD!e`Q*Z3%7*{y2 zTO9L>3R$NkMcOcYkY9N9wJd|t2xX(AT{86y<&5NkzV_~S2y8as~u*CFxSx*wy567w9|IK z{?>U0TDjlXRn6?XTh&*uQLiQnyPZGT75pI_MaL!*Ohkq!1N76a&cR{)mU(urH9kq# zq*7QaC!&A5aS>|_w{%{jpSOcLMPrR#$x=x|oVzzV3REvyjq&t5@*;-$^AkB-g=5Tn z1u#W#$^e{kU-+cf)jS~7JN~WKqoAyLH8*6enNQtArpXuaMTK{0Dcy$wtr)>f{fvb< zF{z6N#MMFzxZ3Zh$V`n6s+W8)JNYzm+?C;(ZFgIu#%dmkdzkVyfkp5n;!x-4z-+c~ zQYJP8VjY6h>9VSoU(a@z^kYf2knDC@I(o$9YGZ7btLwfw%VLrx7>l-=-K-n8=jKLp z*M6%pmfbRINq-pYBss`JfM?X*=rpuYkAtb1?I?Hvn5|drJ9&)DrKqC(klH5IrKa4K z*DOC7ue#=n2A4V2$5`Rg&#vijqht)?8%x&v-Q0x8k2z{gcjDa5# zKTalqQ;6aSV$;(N^n17PB_OCb%vZ8@`J_&gMxR~%*mbO*>9>ZG;lZvomGE>qLF1FO zLxj{a@|r11fLu1{;EL-q%hK!=I^6B!^$iIJ@Rsi0N{apQq3wa`dx_=Vx)M^(esbmf z=CUbZ8uTo&*4-(Kn%5UD2xtC%O8h!&Mvh&TeQCJc+DjJq17)k_*!-c{hBuiatek1m zD9&YWoPaDc=s=KbhqZ};{2p65Ys#W`xQ9c$aO^nBkMvg^TUx9*@uvH!&E8ptgCf>1 zU>Xj|8;18otR9|rU>0c8=k*%?&q|yuD|y0;f^M^^Cw#A-g^F)d^yv+X*#h-+?)x%1 zkXC;=1N0JFZ;IXbF_O>xwy*U0*>P0QZAivfI=FTRyr-=H0T$qchm9V2Z5#Q>*V(i( z5_cewpNlah=^%nF&tQ-A7lDw=W}y5LhydH;&LSGw#d-&O%P%zYiKaGAq7c8kL{+Y`sV4o)X;)UbmQfbm}A zVsdDVefmhkDQku%I?VZiD4}1V7Nx1;Tc%;+?kVAsD`=f3bA!Q+jK3H>ZSHqf93A`a z@zorg{xS6^tE78Ux%5)Jg+FfEdVQOcYW)SilLLzAZu$DsXS`pHCRB@KqA&7-&GE3@ z+MXvMwCc6G@DL|u*Q*jgAmg0@gmS>yB23Bq1#*rkS$2d%kPo$@V2#+K8#GE`!t`T( zabeH}zi}GJt5OdYkE87g;%6(C$1pZ%40FubXar$evIciJ%Ym_Q=6WTGJ8_)=r4%%FnK>rh*kHON-0M)3-&6Z^i17qkYze7Tz7>Aaqnh2QKJ6sJp4hSK7Fbv z9CPxLztOk7Id41Sc*%DR47-F?(tITd2!BGoCxXR^`H~>})rxMTFi~!hP9MKJp@f29 z%ORAap6~92pvRBM+l`pM?^`Ub!xT3LYS`dM#*ci&Z#oidQ~0h}pbnuv@$_cNbgBw}rMQ4r_lFKweQ6E}J*vs%@R&)CW|;=VMx)P+ zt7cYs8srBHRsKOHu9oXbT-P^ei#leivks50N-X5jG9gv1j@pTj@UR)a@VL=J)Bw?a zQCEvFVQjXF-oOa&?p4|2a7&$MF*k<2VJynXmgr=iis`d5b5dGx{fH2>QOr+Qe?>v>51(m&q~Rxz(g~cvV?ms z)%Hkfth)rSj|S6i+xv+cx9ug{A4UoWPEIi21DM9RG?2aAl2`OEX_Q@wvQG=aBO0FP zW~t3tg2_qxwcK!8=_b1Rzl_bBLj^jPyRiqyo-Gi10KIHe<%b=o@vA@t#ypJ<#`qXJ zA5@chrz(MO4}3a~Y+T2YBYxpKp~0=5k8V(#yc+z_Ol~~y zgWQ?(1J&J%&;-X{`YD`7d+&B$^YBwu4|2ZBsd{iI67OOtCvmuBJ#!!O1%y>EHXaX3yJ^Gg+WEM=G!%LYb-pOMdVF99X0=!f{=y>-@x4#xAarXyU zSn(sVP!Db5RfUgVd=^KkDw64T8i=9K`Q2~p#LGUEaPsSo$;%O4dsD&(VkJ*M%6-;> zMR{a|JFQNCT^f-(9TKD-?DL!FoNK%dy?_o_4!$s*M6d@yeUK`6c~ife&FKwlYPk@? zC{JL1#7^vyRqWPIbCHi>yh!&#nPqlFjj4e`7k2#0xEEvW5KrLdK zDXGyIrg5rzQVjcOTjxyO+q-_hmN*0V8EK5^Hh1&{B@XAx#F~SHNZ=6q4xq-Ey`;L{7h#U(X3g&B5+^KeriIn0-0nu-(frElj1HT z#gDQz1v$S{@Y8yH_Z&kkXd|v3D#^G`7!bo|I*wWJ-BVM4+=2blZZv4XJZ~J}8k$Os zcjHX_9y(82OD+r13bbdHT&eZW~hOpm~10$xF+YT;V*81u*eBB zzKfpLDbKS+;PS|?p}D=`kpv7Jb4`M?k)DdJ&9I2+J@hH$46F@3l@Zcw5_nd_QZm`!{QFmNE^4f{fx|nz0mGHcdu-Ub9M-b*4uwVsxY-}$X4;NA; zJUQ8%X|bn_2`k}QcoEwnvOSk5X)t`fIH4NbkV~{0{xNPEycMO*Rcn>7cT?U{-29a@ zGjqZ%L3J8PAJ zWBi_eFv*hsv;?43q^WW-|~pFjH7luq7_KOnmxo9d?q3|{Q)DE+62>q1MhjJ?kv z_ORg0-{p(ibJgMmreL>*5584@0j)V;+veTDt@J9)z`Q#}by@kv_^RO$Ivcg5|L97F z<`#%xYE>Y`$i-IQ2_t;*eZHI}+234O{l4O(e&9NS!shpiARiq-GMNndislU#jTN>U z(G%@1oq7S4gD3Kgl)MSMp@=kmh3HJC%+}PW>Xdq7mP}vl=GO?rzKu&(or4xC^hrRR zT5pi5zaRleie^}>fh--2S{##!2WjgT`7`p06>x~4^P~FcrM2y6!yx%G}QA@(U+yFqdQKSWGpYwkLnrH2W31azGkx+ra+9G|d8qm)zbP4nlVb7wXg;-Kff$OMUcS1~uz zmENB-T4K_L3i$t=0}>W zr)C~c>J=c1)G9umMg3E$i}T3h$X?tNi;TjM`SL$Ujf!CPo>pVwLNIDFy5>_}EV4Ic z!h7_NeEEyOF&EpCoP8ZE9mrG!ovADK!cDHWJbt};gLFu3Q-PNBBsPob0=$<~h#FK7 zO(es3$lGnVLVqNRav?@tz<&v3{`9WW22@kaq((D9010AR%nT42X)Xql*wOSMeBz^Z z0vMQCxE=KKjb8CQvCuW=IZX4;@M#%sZkcw8nYWml^hg;>v8cT}ct}=kR{mNzK@^^7(=ZH{o3rGti_jWXd3Ggql+#h zdsIsgXh^J>UA z`{5;+q3NY%=M1BtAGLlrS9nyBfUt2w+!fQokZy-L$ZwWhDW!Q)(k%nYQI4+~xH=2n zKD1RkKTsRxh9841w%H$+i2Iu$c7BKZKA?D_l|&N8E}WJcS$l94HFJokjLCYGcR+ii z3?9s}lkeO+u$dLmOO9WbzO;27f3xbTIDUNjQ@4)CJ|h#9{)flvxi=Nj0k`rw zl1RhOop4`?{@l-`NXh-2bylf74Rx{Kd{c9BsElHhGWNF?aY6YHey4pG074>jyMtPY z&OLV(=?S;eTGISu^}>E(rH2joT3OD4s7K$TxYoDeoJH*^nL;B7ksL*d_ScmXv31#H zcKLT|qQh|+I=~?TzR6-khVD?^mE|B-4I&1CLDvVRelGrlq7z$p8ktmi@{VbT$T&}Vqh1To`^n!a_=aDo=9cZ2{jW5p^%lOW@dqWo;4uQ7lybb8M|KX@ zts&=#vC2F%U|Twk^~0%4jwa7@)Ld=7Lrk}}_-JP&55g55cd=+pp6Gh1MyD{ltG&1&uxAwwHA017@pM_3f45TeeQ8nNrZnFxX=!Al3{tkVd+6TuR2cI=;<||_U)C0KgEWoinNNSuk zNu~5!UvHdfLCG!r8eu$z#VS+9)H9H-R;ttq-cXe&kS8!Bg~W=HZq2|T4>rVv26qK1ko$4y)-s)sH-8yuCM|GE0Gpj@wAc*Vj&n@sO;M$G2a+1=_?fXV) z+mkXpeEifp6kiQ_q)Rbgw1H;18BV)1DK{F@b#)62;B(j{Bt!Cygo?&Ri^c(><7*3E z2$Mpjp`*YLHM)Nm=XtJm8dv;`nA;F6Y0WHcc2}{yNE_ZFC2G)J^BQrv`y*5^l^&M; z2{Tnu#*h)C3vlK%x^KEknJ8+}pY`q%KUjq-l*Y0p@pS8UJPd`7^KCHfP%26md!1p4^uz!?y-cEdSbFQJYT< z{P|$j9rrb}c>y=zmz8XVj#!-Dl?6w*&PR@$jIcY5tKYerSyeTpgQBiv%`K=uj4OOsxDk@sJYkSEKTq<)R^u z%eySi?X)IJ856yknW-jrN#C!0GO+UER`r9@ix8e{XJoBE2{`1zoFf<7I~3HY0fZ`T zlXAS79h=(R%z}LzZkNUb0$gO>#P6}2FTeU7-xkkB%vxOD&G1x8HO&&!UZBB`8r>~R z-}&B}Nv)P9Ao(S7~kc2(yhyU=SDLOp>Zc zV)B=3_WPmMOTWYg)-x|_#9p-$*i^_4%C7o>FSct2N%ij1+q#+A+!ihJ8l40f`Y@C{-` zs1p~!fgu%Wl7yobGzf}dG*d3bXUcGpE2azX>LKpBc%$vTao7t2_P_T&Wdw~$DzS(> z6fP5gPhsFuwU2hI639Crf2~_YOzC0JBCv^sCbBwStvGPFuPV+*9Ctrl6N1;w!~c3G zFPS^sF#Jdzi;{5?!N?UwcrSWMKMh4hS@-Lpe4`2@FXXVm$Z15r`OHpWnUn53JjLOS z1b0<-Xx=X1^bw`(ihM4uQ!8A3~(Sc|E)dwmhg=h=CTryu@{C@O(Dvo>i8 z7y`F}F&080@|89nkLKjRVO&X zNKHmkJIS8#UHaNbR2D_ge!|+3-mv{rqNt-`B5^*do6?0aVG*{!4sI+b;=kArebmAW zu}Q_D3e4{T4z(dNqoVZ6*I^pov=u4E8h>;BT&ygGzKBD3&8kVbkB69%q^b58;nqbb zz&nFoA*cnW$_U*vtlkys<! ze^{0o>aU&`foEhunJ7nL6*?Wg`;ei$*H0S&p||}7zIjx??O(!=;<&ZpwTi>yaGT_C zgIRXr3-J=PuVk9xMpR+()Gi>D(ro1uWb8CiQTs&HG(QV@bzE|<+@h#d!#|}w%#~-c zth5F;)A*O8MRT2*j6=tdMx9a)T2|XhhQ{(|j{ZnWzGrM#sj8M)+EvHUH?SUVvMmAY zc-A!Ni6#Y;_vXN>30DfjAo?#79|^lQi!m1m`;V%)q}O!8onI={*ckkt0ONPjnH*Fl z>cylk4BgA&;h~rhSt|3to*cZvs45^K_sa6kg5UCXTF diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index 613c78683d9..8ac70b60cc8 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -299,10 +299,10 @@ "kind": "Customizable", "properties": { "connectorUiConfig": { - "title": "SAP ETD", + "title": "SAP Enterprise Threat Detection, cloud edition", "logo": "SapLogo.svg", "id": "SAPETDAlerts", - "publisher": "Microsoft", + "publisher": "SAP", "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.", "graphQueriesTableName": "SAPETDAlerts_CL", "graphQueries": [ @@ -651,10 +651,10 @@ "kind": "Customizable", "properties": { "connectorUiConfig": { - "title": "SAP ETD", + "title": "SAP Enterprise Threat Detection, cloud edition", "logo": "SapLogo.svg", "id": "SAPETDAlerts", - "publisher": "Microsoft", + "publisher": "SAP", "descriptionMarkdown": "The SAP ETD data connector enables ingestion of security alerts from ETD into Microsoft Sentinel, supporting cross-correlation, alerting, and threat hunting.", "graphQueriesTableName": "SAPETDAlerts_CL", "graphQueries": [ @@ -993,7 +993,7 @@ "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "SAP ETD", - "publisherDisplayName": "SAP", + "publisherDisplayName": "SAP SE", "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Microsoft Sentinel Solution for SAP ETD integrates SAP Enterprise Threat Detection alerts into Microsoft Sentinel, allowing SOC teams to ingest, monitor, and hunt across SAP data. This integration enhances security by enabling faster detection, investigation, and mitigation of risks within SAP environments.

\n

Data Connectors: 1, Analytic Rules: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", From 086774380e389387c576c7d5b1ac94aab98fae11 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 13 Feb 2025 10:16:30 +0100 Subject: [PATCH 15/17] table name fix --- .../Analytic Rules/SAP ETD - Login from unexpected network.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml index e75d84b9893..5ec6851325e 100644 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml @@ -27,7 +27,7 @@ query: | let regex_instance_name = @"instance_name:(\w+)"; let regex_instance_host = @"instance_host:([\w-]+)"; let SAPNetworks = _GetWatchlist('SAP - Networks'); - ETDAlerts_CL + SAPETDAlerts_CL | mv-expand TriggeringEvents | extend sapOriginalEvent = tostring(TriggeringEvents.OriginalEvent) | extend Id_ = TriggeringEvents.Id From b7e4f164d412e4302c34c7905fe7d3f0d22250cf Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 13 Feb 2025 11:55:49 +0100 Subject: [PATCH 16/17] id fix --- ...P ETD - Login from unexpected network.yaml | 2 +- .../SAP ETD Cloud/Package/mainTemplate.json | 83 ++++++++++++++++--- 2 files changed, 74 insertions(+), 11 deletions(-) diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml index 5ec6851325e..27b4e574ca5 100644 --- a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml +++ b/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml @@ -1,4 +1,4 @@ -id: 7a830484-e349-4527-85f6-7850c468c238 +id: 5dd72ebe-03ac-43ac-851b-68cfe5106e4f kind: Scheduled name: SAP ETD - Login from unexpected network description: | diff --git a/Solutions/SAP ETD Cloud/Package/mainTemplate.json b/Solutions/SAP ETD Cloud/Package/mainTemplate.json index 8ac70b60cc8..97567db105a 100644 --- a/Solutions/SAP ETD Cloud/Package/mainTemplate.json +++ b/Solutions/SAP ETD Cloud/Package/mainTemplate.json @@ -55,6 +55,13 @@ "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7a830484-e349-4527-85f6-7850c468c238')))]", "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7a830484-e349-4527-85f6-7850c468c238','-', '3.0.0')))]" }, + "analyticRuleObject2": { + "analyticRuleVersion2": "3.0.0", + "_analyticRulecontentId2": "5dd72ebe-03ac-43ac-851b-68cfe5106e4f", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5dd72ebe-03ac-43ac-851b-68cfe5106e4f')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5dd72ebe-03ac-43ac-851b-68cfe5106e4f')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5dd72ebe-03ac-43ac-851b-68cfe5106e4f','-', '3.0.0')))]" + }, "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "dataConnectorCCPVersion": "1.0.0", "_dataConnectorContentIdConnectorDefinition1": "SAPETDAlerts", @@ -160,9 +167,65 @@ } } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", + "properties": { + "description": "SAP ETD Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "source": { + "kind": "Solution", + "name": "SAP ETD", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SAP" + }, + "support": { + "name": "SAP", + "tier": "Partner", + "link": "https://help.sap.com/docs/SAP_ENTERPRISE_THREAT_DETECTION_CLOUD_EDITION" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentKind": "AnalyticsRule", + "displayName": "SAP ETD - Synch alerts", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SAP ETD - Login from unexpected network Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -238,11 +301,11 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", "properties": { - "description": "SAP ETD Analytics Rule 1", - "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", - "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "description": "SAP ETD Analytics Rule 2", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", "source": { "kind": "Solution", "name": "SAP ETD", @@ -265,12 +328,12 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "contentKind": "AnalyticsRule", - "displayName": "SAP ETD - Synch alerts", - "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", - "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", - "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + "displayName": "SAP ETD - Login from unexpected network", + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" } }, { From 17dea93f52b30f58f2583d15348bcb1bacdb6fd6 Mon Sep 17 00:00:00 2001 From: MartinPankraz Date: Thu, 13 Feb 2025 14:30:34 +0100 Subject: [PATCH 17/17] validation exclusion for dynamic params --- .../tests/KqlvalidationsTests/SkipValidationsTemplates.json | 5 +++++ ...d network.yaml => SAPETD-LoginFromUnexpectedNetwork.yaml} | 0 Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) rename Solutions/SAP ETD Cloud/Analytic Rules/{SAP ETD - Login from unexpected network.yaml => SAPETD-LoginFromUnexpectedNetwork.yaml} (100%) diff --git a/.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json b/.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json index 7588b1ba65d..9de54e1864c 100644 --- a/.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json +++ b/.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json @@ -1,4 +1,9 @@ [ + { + "id": "5dd72ebe-03ac-43ac-851b-68cfe5106e4f", + "templateName": "SAPETD-LoginFromUnexpectedNetwork.yaml", + "validationFailReason": "The name 'Network' does not refer to any known column, table, variable or function. The name 'geo_info_from_ip_address' does not refer to any known function." + }, { "id": "ef895ada-e8e8-4cf0-9313-b1ab67fab69f", "templateName": "AuthenticationAttemptfromNewCountry.yaml", diff --git a/Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml b/Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml similarity index 100% rename from Solutions/SAP ETD Cloud/Analytic Rules/SAP ETD - Login from unexpected network.yaml rename to Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml diff --git a/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json b/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json index def80c74e0e..8d701d01d6b 100644 --- a/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json +++ b/Solutions/SAP ETD Cloud/Data/Solution_SAPETD.json @@ -7,7 +7,7 @@ "Workbooks": [], "Analytic Rules": [ "/Analytic Rules/SAP ETD - Synch alerts.yaml", - "/Analytic Rules/SAP ETD - Login from unexpected network.yaml" + "/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml" ], "Playbooks": [], "PlaybookDescription": [],