Microsoft Sentinel Solution for SAP BTP: security content reference

This article details the security content available for the Microsoft Sentinel Solution for SAP BTP.

Available security content currently includes a built-in workbook and analytics rules. You can also add SAP-related watchlists to use in your search, detection rules, threat hunting, and response playbooks.

Learn more about the solution.

SAP BTP workbook

The BTP Activity Workbook provides a dashboard overview of BTP activity.

The Overview tab shows:

• An overview of BTP subaccounts, helping analysts identify the most active accounts and the type of ingested data.
• Subaccount sign-in activity, helping analysts identify spikes and trends that might be associated with sign-in failures in SAP Business Application Studio (BAS).
• Timeline of BTP activity and number of BTP security alerts, helping analysts search for any correlation between the two.

The Identity Management tab shows a grid of identity management events, such as user and security role changes, in a human-readable format. The search bar lets you quickly find specific changes.

For more information, see Tutorial: Visualize and monitor your data and Deploy Microsoft Sentinel Solution for SAP BTP.

Built-in analytics rules

Rule name	Description	Source action	Tactics
BTP - Failed access attempts across multiple BAS subaccounts	Identifies failed Business Application Studio (BAS) access attempts over a predefined number of subaccounts. Default threshold: 3	Run failed sign-in attempts to BAS over the defined threshold number of subaccounts. Data sources: SAPBTPAuditLog_CL	Discovery, Reconnaissance
BTP - Malware detected in BAS dev space	Identifies instances of malware detected by the SAP internal malware agent within BAS developer spaces.	Copy or create a malware file in a BAS developer space. Data sources: SAPBTPAuditLog_CL	Execution, Persistence, Resource Development
BTP - User added to sensitive privileged role collection	Identifies identity management actions where a user is added to a set of monitored privileged role collections.	Assign one of the following role collections to a user: - Subaccount Service Administrator - Subaccount Administrator - Connectivity and Destination Administrator - Destination Administrator - Cloud Connector Administrator Data sources: SAPBTPAuditLog_CL	Lateral Movement, Privilege Escalation
BTP - Trust and authorization Identity Provider monitor	Identifies create, read, update, and delete (CRUD) operations on Identity Provider settings within a subaccount.	Change, read, update, or delete any of the identity provider settings within a subaccount. Data sources: SAPBTPAuditLog_CL	Credential Access, Privilege Escalation
BTP - Mass user deletion in a subaccount	Identifies user account deletion activity where the number of deleted users exceeds a predefined threshold. Default threshold: 10	Delete count of user accounts over the defined threshold. Data sources: SAPBTPAuditLog_CL	Impact

Next steps

In this article, you learned about the security content provided with the Microsoft Sentinel Solution for SAP BTP.

• Deploy Microsoft Sentinel solution for SAP BTP
• Microsoft Sentinel Solution for SAP BTP overview