↳ Source GitHubRègle analytiqueHigh

SAP ETD - SAP system stopped reporting data

Description

Identifies a per-system silence when an individual SAP system (identified by its SID) that has recently been reporting to SAP Enterprise Threat Detection (ETD) stops producing new records in the SAPETDAlerts_CL table within the configured per-system grace period (default 2 hours). A targeted silence of a single SID may indicate that an adversary with access to the SAP system, the SAP ETD collector for that SID, or the data connector is selectively blocking security telemetry to hide follow-on activity while leaving the rest of the SAP ETD feed intact; benign causes such as connectivity issues, collector misconfiguration, or planned maintenance for that SID are also possible and should be ruled out during triage. The set of "expected" SIDs is derived from any system that has reported within the `BaselineLookback` period (default 7 days); systems silent for longer are considered decommissioned and are not alerted on. Tunable parameters at the top of the query: `LookbackPeriod` (silence threshold per SID; align with `queryFrequency`) and `BaselineLookback` (how far back to look to discover known SIDs; align with `queryPeriod`). This rule is complementary to the overall-feed rule "SAP ETD - No new data received".

Type de règle: Scheduled
Version: 1.0.0
Statut déclaré: Available
Fréquence: 1h
Période analysée: 7d
Déclenchement: gt 0

Couverture MITRE déclarée

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Connecteurs

SAPETDAlerts

Types de données

SAPETDAlerts_CL

Requête KQL

Requête originale, sans modification.

// ---- Configurable thresholds ----
let LookbackPeriod = 2h;
let BaselineLookback = 7d;
// ---------------------------------
let regex_sid = @"^([A-Z0-9]{3})/";
let regex_client = @'\/(.{3})$';
SAPETDAlerts_CL
| where TimeGenerated > ago(BaselineLookback)
| mv-expand NormalizedTriggeringEvents
| extend
    SystemId = extract(regex_sid, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
    ClientId = extract(regex_client, 1, tostring(NormalizedTriggeringEvents.SystemIdActor)),
    Host     = tostring(NormalizedTriggeringEvents.NetworkHostnameInitiator),
    Instance = tostring(NormalizedTriggeringEvents.NetworkHostnameActor)
| where isnotempty(SystemId)
| summarize
    LastIngestionTime = max(TimeGenerated),
    Host     = take_any(Host),
    Instance = take_any(Instance),
    ClientId = take_any(ClientId)
    by SystemId
| extend TimeSinceLastIngestion = now() - LastIngestionTime
| where TimeSinceLastIngestion > LookbackPeriod
| extend
    LookbackPeriod = LookbackPeriod,
    Reason = strcat("SAP system ", SystemId, " has not reported any data to SAP ETD in the last ", tostring(LookbackPeriod), " (last seen: ", tostring(LastIngestionTime), ").")

Entités déclarées

CloudApplicationHost

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Fichier: Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-SystemStoppedReporting.yaml ↗
Commit: 629d1d3 ↗
Identifiant source: b1413b43-9410-46f4-94d9-da507105d834

Autres fichiers source 2

Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-SystemStoppedReporting.yamlsource ↗Solutions/SAP ETD Cloud/Data/Solution_SAPETD.jsonsolution-membership ↗

GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.