↳ GitHub sourceAnalytics ruleHigh
SAP BTP - Cloud Integration JDBC data source changes
Description
Identifies deployment and undeployment of JDBC data source configurations in SAP Cloud Integration.
JDBC data sources contain database connection credentials and configuration that enable
integration flows to access backend databases.
Unauthorized JDBC data source manipulation could indicate:
- Attacker adding rogue database connections for data exfiltration
- Credential theft by accessing stored database passwords
- Modification of connection strings to redirect traffic to attacker-controlled systems
- Rule type
- Scheduled
- Version
- 1.0.1
- Declared status
- Available
- Query frequency
- 15m
- Query period
- 15m
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
SAPBTPAuditLog_CL
| where Category == "audit.security-events"
| extend data_s = tostring(Message.data),
ipAddress = tostring(Message.ip)
| extend parsedData = parse_json(data_s)
| extend action = tostring(parsedData.action),
objectType = tostring(parsedData.objectType),
objectId = tostring(parsedData.objectId)
| where objectType == "Data Source"
| where action in ("PasswordStore", "PasswordDelete")
| extend normalizedAction = case(
action == "PasswordStore", "deployed",
action == "PasswordDelete", "undeployed",
action
)
| extend MessageText = strcat("JDBC data source '", objectId, "' was ", normalizedAction)
| project
UpdatedOn,
UserName,
MessageText,
DataSourceName = objectId,
Action = action,
Tenant,
ipAddress,
CloudApp = "SAP Cloud Integration"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC