sap_btp_service_manager_instance_or_binding_change

rule sap_btp_service_manager_instance_or_binding_change {

  meta:
    author = "Google Cloud Security"
    description = "A BTP service instance or service binding was created, modified, or deleted through the Service Manager API"
    severity = "Medium"
    tactic = "TA0003"
    technique = "T1098.001"

  events:
    $e.metadata.log_type = "SAP_BTP"

    $e.security_result.detection_fields["object_type"] = /^\/v1\/service_(instances|bindings)(\/|\?|$)/ nocase
    $e.security_result.detection_fields["object_id_action"] = /^(POST|PATCH|PUT|DELETE)$/ nocase

    $tenant = $e.security_result.detection_fields["tenant"]
    $user = strings.coalesce($e.principal.user.user_display_name, $e.principal.user.userid)

    not $e.principal.user.userid            = /^sb-/ nocase
    not $e.principal.user.user_display_name = /^sb-/ nocase

  match:
    $user, $tenant over 1h

  outcome:
    $resource_type = array_distinct(re.capture($e.security_result.detection_fields["object_type"], `/v1/service_(instances|bindings)`))
    $action = array_distinct($e.security_result.detection_fields["object_id_action"])
    $resource_id = array_distinct(re.capture($e.security_result.detection_fields["object_type"], `/v1/service_(?:instances|bindings)/([0-9a-f\-]+)`))
    $resource_name = array_distinct($e.security_result.detection_fields["new_name"])
    $service_plan_id = array_distinct($e.security_result.detection_fields["new_service_plan_id"])
    $api_path = array_distinct($e.security_result.detection_fields["object_type"])
    $correlation_id = array_distinct($e.security_result.detection_fields["object_id_correlation-id"])
    $space_id = array_distinct($e.security_result.detection_fields["space_id"])
    $record_count = count_distinct($e.security_result.detection_fields["message_uuid"])

  condition:
    $e
}