Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleHigh

SAP ETD - Synch investigations

View on GitHub ↗Original file ↗

Description

Synch investigations coming in from SAP Enterprise Threat Detection into Microsoft Sentinel (one way)
Rule type
Scheduled
Version
1.0.1
Declared status
Available
Query frequency
1h
Query period
2d
Trigger
gt 0

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SAPETDAlerts

Data types

SAPETDInvestigations_CL

KQL query

Original query, unchanged.

let AuditTimeAgo = 2d;
let _severity= dynamic(["HIGH","VERY HIGH"]);
SAPETDInvestigations_CL
| where TimeGenerated > ago(AuditTimeAgo)
| where Severity in (_severity)
| mv-expand Users
| extend
  UserAccountName = tostring(Users.UserAccountName),
  UserEmail = tostring(Users.EmailAddresses[0])

Declared entities

AccountMailbox

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
5096db53-fad3-4844-a264-246f7b7e6e06
Additional source files 2Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-SynchInvestigations.yamlsource ↗Solutions/SAP ETD Cloud/Data/Solution_SAPETD.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.