Microsoft Sentinel
Cloud and workloadsMicrosoft Sentinel Solution for SAP BTP - security content reference | Microsoft Learn
In brief
The documentation now describes an optional Application Vulnerabilities workbook tab and an analytics rule correlating SAP Application Vulnerability Report Service findings with BTP audit events. The rule detects custom apps with open high or critical vulnerabilities, using a default CVSS threshold of 7.0 and a 14-day evaluation window.
What Defender admins need to know
Administrators can monitor SAP application vulnerability posture alongside BTP activity. The rule requires data from both the SAP BTP AVL and SAP BTP audit events connectors.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Microsoft Sentinel Solution for SAP BTP - security content reference | Microsoft Learn
This article detailsUse this reference to review the security content available for the Microsoft Sentinel Solution for SAP BTP.
Available security content currently includes a built-in workbook and analytics rules. You can also add SAP-related watchlists to use in your search, detection rules, threat hunting, and response playbooks.
Learn more about the solution.
The workbook also includes an optional Application Vulnerabilities tab for SAP Application Vulnerability Report Service findings. The Overview tab includes a vulnerability posture KPI to help you monitor these findings alongside BTP activity.
For more information, see Tutorial: Visualize and monitor your data and Deploy Microsoft Sentinel Solution for SAP BTP.
Built-in analytics rules
| Rule name | Description | Source action | Tactics |
|---|---|---|---|
| BTP - Failed access attempts across multiple BAS subaccounts | Detects reconnaissance activity or credential spray attacks targeting development environments |
Run failed sign-in attempts to BAS over the defined threshold number of subaccounts. | Discovery, Reconnaissance |
| BTP - Malware detected in BAS dev space | Detects malicious code in development workspaces that could be used to compromise the software supply chain, inject backdoors into applications, or establish persistence in the development environment. | Copy or create a malware file in a BAS developer space. | Execution, Persistence, Resource Development |
SAP Build Work Zone
| BTP - Audit log service unavailable | Detects potential tampering with audit logging that could indicate an attacker attempting to operate without detection by disabling security monitoring or hiding malicious activity. | Subaccount fails to report audit logs exceeding configured threshold (default: 60 minutes). | Defense Evasion |
| BTP - Mass user deletion in a subaccount | Detects large-scale user deletion that could indicate a destructive attack, sabotage attempt, or effort to disrupt business operations by removing user access.Default threshold: 10 | Delete count of user accounts over the defined threshold. | Impact |
| BTP - Trust and authorization Identity Provider monitor | Detects modifications to federation and authentication settings that could enable attackers to establish alternate authentication paths, bypass security controls, or gain unauthorized access through identity provider manipulation. | Change, read, update, or delete any of the identity provider settings within a subaccount. | Credential Access, Privilege Escalation |
\ No newline at end of file
| BTP - User added to sensitive privileged role collection | Detects privilege escalation attempts through assignment of powerful administrative roles that could enable full control over subaccounts, connectivity, and security configurations. | Assign one of the following role collections to a user: - Subaccount Service Administrator- Subaccount Administrator- Connectivity and Destination Administrator- Destination Administrator- Cloud Connector Administrator | Lateral Movement, Privilege Escalation |
\ No newline at end
SAP Application Vulnerability Report Service (Preview)
This rule correlates SAP Application Vulnerability Report Service findings with SAP BTP audit events to identify use of filecustom apps with open high or critical vulnerabilities. It requires data from both the SAP BTP AVL connector and the SAP BTP audit events connector.
Data sources: SAPBTPAVL_CL, SAPBTPAuditLog_CL
| Rule name | Description | Source action | Tactics |
|---|---|---|---|
| SAP BTP - Use of custom app with high or critical vulnerability | Detects use of a custom app that has an open high or critical vulnerability finding. The default minimum CVSS score is 7.0. Findings are evaluated over 14 days to account for the weekly vulnerability scan cadence, and only findings from the app's latest scan are considered. Findings without observed app use don't generate alerts. | Detect interactive XSUAA logins through an OAuth client that matches a vulnerable app in the same subaccount, or named-user application audit events in the same subaccount, Cloud Foundry organization, and space as the app. The activity must occur in the past hour. | Initial Access |
The rule has Medium severity and groups incidents by app and subaccount. Review the users, observed app activity, and vulnerability remediation recommendations when investigating an alert. \ No newline at end of file
@@ -23,11 +23,12 @@ ms.subservice: sentinel-siem search.appverid: met150 ms.reviewer: mapankra description: Learn about the built-in security content provided by the Microsoft Sentinel Solution for SAP BTP.-ms.author: monaberdugo+ms.author: mapankra author: mberdugo ms.topic: reference-ms.date: 2024-07-17T00:00:00.0000000Z+ms.date: 2026-10-02T00:00:00.0000000Z ms.custom: sfi-image-nochange+ai-usage: ai-assisted locale: en-us document_id: 850d5195-1370-4d33-214e-e4b3b30f3be8 document_version_independent_id: 9c85e476-f1d7-009f-c358-2dc1a8e06a9a@@ -42,21 +43,21 @@ monikers: [] item_type: Content source_path: sentinel/sap/sap-btp-security-content.md cmProducts:+- https://authoring-docs-microsoft.poolparty.biz/devrel/fcc3cd4a-59ea-47a2-9cc1-784142a5a25d - https://authoring-docs-microsoft.poolparty.biz/devrel/8a94907f-2511-4271-b5ca-ec7f2e75067c - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/12ed19f9-ebdf-4c8a-8bcd-7a681836774d-- https://authoring-docs-microsoft.poolparty.biz/devrel/07bb3e10-d135-43ff-bc8b-360497cb39fa spProducts:+- https://authoring-docs-microsoft.poolparty.biz/devrel/d7a55faf-a992-4e27-aa3a-eadc9830e778 - https://authoring-docs-microsoft.poolparty.biz/devrel/bffa8e88-f633-409d-a24d-083bdbc68872 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/3a764584-4f97-452b-8f1d-36f19b12f6ae-- https://authoring-docs-microsoft.poolparty.biz/devrel/12e559b9-eaf6-4aee-9af7-62334e15f863 platformId: 5f1d8e74-3419-69c6-3a1b-bf3324d46308 --- # Microsoft Sentinel Solution for SAP BTP - security content reference | Microsoft Learn -This article details the security content available for the Microsoft Sentinel Solution for SAP BTP.
+Use this reference to review the security content available for the Microsoft Sentinel Solution for SAP BTP.
-Available security content currently includes a built-in workbook and analytics rules. You can also add SAP-related [watchlists](../watchlists) to use in your search, detection rules, threat hunting, and response playbooks.
+Available security content includes a built-in workbook and analytics rules. You can also add SAP-related [watchlists](../watchlists) to use in your search, detection rules, threat hunting, and response playbooks.
[Learn more about the solution](sap-btp-solution-overview).
@@ -76,6 +77,8 @@ The **Identity Management** tab shows a grid of identity management events, such
[](media/sap-btp-security-content/sap-btp-workbook-identity-management.png#lightbox)
+The workbook also includes an optional **Application Vulnerabilities** tab for SAP Application Vulnerability Report Service findings. The **Overview** tab includes a vulnerability posture KPI to help you monitor these findings alongside BTP activity.
+
For more information, see [Tutorial: Visualize and monitor your data](../monitor-your-data) and [Deploy Microsoft Sentinel Solution for SAP BTP](deploy-sap-btp-solution).
## Built-in analytics rules
@@ -106,7 +109,7 @@ These analytics rules detect suspicious activity using SAP BTP audit logs. The r
| Rule name | Description | Source action | Tactics |
| --- | --- | --- | --- |
-| **BTP - Failed access attempts across multiple BAS subaccounts** | Detects reconnaissance activity or credential spray attacks targeting development environments across multiple subaccounts, indicating potential preparation for a broader compromise.Default threshold: 3 | Run failed sign-in attempts to BAS over the defined threshold number of subaccounts. | Discovery, Reconnaissance |
+| **BTP - Failed access attempts across multiple BAS subaccounts** | Detects reconnaissance activity or credential spray attacks targeting development environments in multiple subaccounts, indicating potential preparation for a broader compromise.Default threshold: 3 | Run failed sign-in attempts to BAS over the defined threshold number of subaccounts. | Discovery, Reconnaissance |
| **BTP - Malware detected in BAS dev space** | Detects malicious code in development workspaces that could be used to compromise the software supply chain, inject backdoors into applications, or establish persistence in the development environment. | Copy or create a malware file in a BAS developer space. | Execution, Persistence, Resource Development |
### SAP Build Work Zone
@@ -122,4 +125,16 @@ These analytics rules detect suspicious activity using SAP BTP audit logs. The r | **BTP - Audit log service unavailable** | Detects potential tampering with audit logging that could indicate an attacker attempting to operate without detection by disabling security monitoring or hiding malicious activity. | Subaccount fails to report audit logs exceeding configured threshold (default: 60 minutes). | Defense Evasion |
| **BTP - Mass user deletion in a subaccount** | Detects large-scale user deletion that could indicate a destructive attack, sabotage attempt, or effort to disrupt business operations by removing user access.Default threshold: 10 | Delete count of user accounts over the defined threshold. | Impact |
| **BTP - Trust and authorization Identity Provider monitor** | Detects modifications to federation and authentication settings that could enable attackers to establish alternate authentication paths, bypass security controls, or gain unauthorized access through identity provider manipulation. | Change, read, update, or delete any of the identity provider settings within a subaccount. | Credential Access, Privilege Escalation |
-| **BTP - User added to sensitive privileged role collection** | Detects privilege escalation attempts through assignment of powerful administrative roles that could enable full control over subaccounts, connectivity, and security configurations. | Assign one of the following role collections to a user: - `Subaccount Service Administrator`- `Subaccount Administrator`- `Connectivity and Destination Administrator`- `Destination Administrator`- `Cloud Connector Administrator` | Lateral Movement, Privilege Escalation |\ No newline at end of file+| **BTP - User added to sensitive privileged role collection** | Detects privilege escalation attempts through assignment of powerful administrative roles that could enable full control over subaccounts, connectivity, and security configurations. | Assign one of the following role collections to a user: - `Subaccount Service Administrator`- `Subaccount Administrator`- `Connectivity and Destination Administrator`- `Destination Administrator`- `Cloud Connector Administrator` | Lateral Movement, Privilege Escalation |
+
+### SAP Application Vulnerability Report Service (Preview)
+
+This rule correlates SAP Application Vulnerability Report Service findings with SAP BTP audit events to identify use of custom apps with open high or critical vulnerabilities. It requires data from both the **SAP BTP AVL** connector and the **SAP BTP audit events** connector.
+
+**Data sources**: `SAPBTPAVL_CL`, `SAPBTPAuditLog_CL`
+
+| Rule name | Description | Source action | Tactics |
+| --- | --- | --- | --- |
+| **SAP BTP - Use of custom app with high or critical vulnerability** | Detects use of a custom app that has an open high or critical vulnerability finding. The default minimum CVSS score is 7.0. Findings are evaluated over 14 days to account for the weekly vulnerability scan cadence, and only findings from the app's latest scan are considered. Findings without observed app use don't generate alerts. | Detect interactive XSUAA logins through an OAuth client that matches a vulnerable app in the same subaccount, or named-user application audit events in the same subaccount, Cloud Foundry organization, and space as the app. The activity must occur in the past hour. | Initial Access |
+
+The rule has **Medium** severity and groups incidents by app and subaccount. Review the users, observed app activity, and vulnerability remediation recommendations when investigating an alert.\ No newline at end of file