What Changed

This PR makes two significant changes to the SAP LogServ connector (v3.0.5):

Analytic Rules (4 updated)

All four HANA DB Analytic Rules had their primary data source table changed from SAPLogServ_CL to Syslog.

Detection blind spot: Any environment where HANA audit logs were already being routed to Syslog via DCR would have had these four detections return zero results – producing no alerts and no incidents – since the SAPLogServ_CL query would find no HANA audit events.

Before: SAPLogServ_CL filtered on clz_subdir == hanaaudit, split Raw on semicolons. After: Syslog filtered on SourceSystem == HANADB and CollectorHostName == SAPLogServ, split SyslogMessage on semicolons.

The four detections cover:

  • Privileged authorisation assignment (T1078 – Valid Accounts)
  • Audit trail policy tampering (T1562 – Impair Defenses)
  • Audit trail deactivation (T1562.001 – Disable or Modify Tools)
  • User administration actions (T1098 – Account Manipulation)

No MITRE technique fields are declared in the YAML (relevantTechniques: []) so mappings are inferred from rule names.

Data Connector – DCR Multi-Destination ASIM Routing

SAPLogServ_DCR.json was rewritten to replace the single catch-all dataFlow with six targeted flows routing events based on the clz_dir field:

  • windows: routes to Microsoft-WindowsEvent (WindowsEvent table)
  • linux/hana: routes to Microsoft-Syslog (Syslog table)
  • dns: routes to Microsoft-ASimDnsActivityLogs (ASimDnsActivityLogs table)
  • network/firewall/proxy: routes to Microsoft-ASimNetworkSessionLogs (ASimNetworkSessionLogs table)
  • webdispatcher+accesslog, abap/httpaccesslog, squid: routes to Microsoft-ASimWebSessionLogs (ASimWebSessionLogs table)
  • everything else: routes to Custom-SAPLogServ_CL (SAPLogServ_CL table)

Each flow includes a transformKql using regex extraction (extract()) to map raw log fields to the appropriate ASIM or standard table schema. The catch-all preserves the Raw field for SAP-proprietary events. Debug columns test and test1 were removed from the stream declaration.

Security Impact

The ASIM routing unlocks existing ASIM-based detections and hunting queries against SAP LogServ data without requiring custom KQL. Any detection targeting imWebSession, imDns, imNetworkSession, Syslog, or WindowsEvent will now automatically include SAP LogServ events matching those log types. Detection engineers should validate field extraction fidelity before relying on ASIM normalised fields for production alerting as the PR notes the transform KQL regex patterns are starting points to be refined with real data.

Affected Files

Solutions/SAP LogServ/Analytic Rules/SAPLogServ-AssignAdminAuthorizations.yaml
Solutions/SAP LogServ/Analytic Rules/SAPLogServ-AuditTrailPolicyChanges.yaml
Solutions/SAP LogServ/Analytic Rules/SAPLogServ-DeactivationofAuditTrail.yaml
Solutions/SAP LogServ/Analytic Rules/SAPLogServ-UserAdminActions.yaml
Solutions/SAP LogServ/Data Connectors/SAPLogServ.json
Solutions/SAP LogServ/Data Connectors/SAPLogServ_PUSH_CCP/SAPLogServ_DCR.json
Solutions/SAP LogServ/Data Connectors/SAPLogServ_PUSH_CCP/SAPLogServ_connectorDefinition.json
(packaging artefacts: 3.0.5.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_SAPLogServ.json, mainTemplate.json)