Description
Identifies a complete gap in the SAP Enterprise Threat Detection (ETD) feed when no records have been ingested into the SAPETDAlerts_CL table within the configured time window (default 1 hour). A full-feed blackout may indicate that an adversary is tampering with the security telemetry pipeline (for example by stopping the SAP ETD collector, disabling the data connector, or blocking network egress to Microsoft Sentinel) to hide follow-on activity in the SAP landscape. Benign causes such as a service outage, connector failure, or maintenance window are also possible and should be ruled out during triage. This rule is complementary to the per-SAP-system rule "SAP ETD - SAP system stopped reporting data", which can help distinguish a targeted silencing of a single system from a full-feed blackout. To change the freshness threshold, update the `LookbackPeriod` variable in the query and align `queryFrequency` / `queryPeriod` accordingly.
- Rule type
- Scheduled
- Version
- 1.0.0
- Declared status
- Available
- Query frequency
- 1h
- Query period
- 1h
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
// Configurable freshness threshold for the entire SAP ETD data feed.
// When changing this value also update queryFrequency and queryPeriod accordingly.
let LookbackPeriod = 1h;
SAPETDAlerts_CL
| summarize
LastIngestionTime = max(TimeGenerated),
RecordsInWindow = countif(TimeGenerated > ago(LookbackPeriod))
| where RecordsInWindow == 0 or isnull(LastIngestionTime)
| extend
LookbackPeriod = LookbackPeriod,
TimeSinceLastIngestion = now() - coalesce(LastIngestionTime, datetime(null)),
FeedName = "SAPETD",
Reason = iff(isnull(LastIngestionTime),
"No SAPETDAlerts_CL records have ever been ingested.",
strcat("No SAPETDAlerts_CL records ingested in the last ", tostring(LookbackPeriod), " (last ingestion: ", tostring(LastIngestionTime), ")."))
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
a9206c5a-3e72-4c10-807f-313a56075b20
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC