What Changed

SAP BTP solution bumped to v3.1.1 with three changes:

  1. New Analytic Rule - SAP BTP - Unaudited custom app with login-only activity detects BTP custom applications that are silently missing audit log coverage.
  2. New Workbook - SAPBTPActivity added to visualise the underlying BTP audit data used by existing rules.
  3. Bulk rule rename - All 16 existing Analytic Rules prefixed from BTP - to SAP BTP - for discoverability in Sentinel content search; GUIDs are unchanged so deployed rules are unaffected.

Detection Logic - Unaudited Custom App

Data source: SAPBTPAuditLog_CL (requires SAPBTPAuditEvents connector)

Core logic: The rule performs a 7-day lookback with a two-phase join:

  • Phase 1: Collects XSUAA authentication events (TokenIssuedEvent, ClientAuthenticationSuccess) for custom CloudFoundry/CAP apps, filtering out known BTP platform service patterns (app-studio, auditlog, cis-local, service-manager, destination-xsappname, connectivity-proxy, feature-flags).
  • Phase 2: Looks for any matching business audit events (audit.security_events, audit.configuration, audit.data_modification, audit.object_read) from those same apps in the same 7-day window.
  • An alert fires for any app found in Phase 1 but absent from Phase 2 - i.e., the app is authenticating users but producing no auditable business-layer activity.

Entity mappings: Account (AccountName, UPNSuffix), CloudApplication (app_name), IP (SourceIP)

Detection cadence: Runs hourly (queryFrequency: 1h) over a 7-day window (queryPeriod: 7d)

Security Impact

This detection closes a structural blind spot in BTP environments: custom CAP or CloudFoundry applications that omit @AuditLog annotations or lack an audit log service binding generate no business-layer telemetry. Users can authenticate and perform operations within these apps with zero audit trail. The 7-day lookback is deliberately broad to suppress false positives for legitimate apps where no auditable actions happened to occur in the current session.

Attackers exploiting this gap can use unaudited BTP apps as staging ground for data exfiltration (T1562 / T1562.008 - Impair Defenses: Disable or Modify Cloud Logs) without generating any Sentinel incidents.

Recommended action: After deploying this rule, triage any firing alerts to identify apps missing audit log service bindings, then enforce @AuditLog annotations or equivalent configuration in your BTP development standards.

Analytic Rule - BTP Malware Detection (Logic Fix)

The SAP BTP - Malware detected in BAS dev space rule received a non-trivial KQL fix beyond the rename:

  • Before: Used parse Message with string pattern matching - brittle string parsing dependent on a fixed message format.
  • After: Parses MessageData.message as a nested JSON object (MalwareData), extracts dev_space_id, user, and findings as typed fields. Malware is now built via strcat_array(MalwareData.findings) rather than regex-style string slicing. Added isnotempty(User) and isnotempty(Malware) guards to suppress null-field false positives.

This is a data fidelity fix - the previous string-parse approach would silently produce null User and Malware fields if the message format varied, causing entity mapping failures and empty alert context.

Affected Files

Solutions/SAP BTP/Analytic Rules/BTP - Audit log service unavailable.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Build Work Zone unauthorized access and role tampering.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Cloud Identity Service application configuration monitor.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Cloud Integration JDBC data source changes.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Cloud Integration access policy tampering.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Cloud Integration artifact deployment.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Cloud Integration package import or transport.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Cloud Integration tampering with security material.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Failed access attempts across multiple BAS subaccounts.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Malware detected in BAS dev space.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Mass user deletion in Cloud Identity Service.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Mass user deletion in a sub account.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Trust and authorization Identity Provider monitor.yaml
Solutions/SAP BTP/Analytic Rules/BTP - Unaudited custom app with login-only activity.yaml
Solutions/SAP BTP/Analytic Rules/BTP - User added to privileged Administrators list.yaml
Solutions/SAP BTP/Analytic Rules/BTP - User added to sensitive privileged role collection.yaml
Solutions/SAP BTP/Workbooks/SAPBTPActivity.json
(packaging artefacts: 3.1.1.zip, ReleaseNotes.md, Solution_SAPBTP.json, createUiDefinition.json, mainTemplate.json)