sap_btp_identity_provider_trust_manipulation

rule sap_btp_identity_provider_trust_manipulation {

  meta:
    author = "Google Cloud Security"
    description = "A BTP identity provider trust configuration was created, modified, or deleted"
    severity = "High"
    tactic = "TA0006"
    technique = "T1556.007"

  events:
    $e.metadata.log_type = "SAP_BTP"

    $e.security_result.detection_fields["object_type"] = "IdentityProvider" nocase
    $e.security_result.detection_fields["object_id_crudType"] = /^(CREATE|UPDATE|DELETE)$/ nocase

    $tenant = $e.security_result.detection_fields["tenant"]
    $user = strings.coalesce($e.principal.user.user_display_name, $e.principal.user.userid)

  match:
    $user, $tenant over 1h

  outcome:
    $risk_score     = 85
    $crud_type      = array_distinct($e.security_result.detection_fields["object_id_crudType"])
    $idp_name       = array_distinct(strings.coalesce($e.security_result.detection_fields["new_name"],
                                                      $e.security_result.detection_fields["old_name"]))
    $idp_id         = array_distinct(strings.coalesce($e.security_result.detection_fields["new_id"],
                                                      $e.security_result.detection_fields["old_id"]))
    $idp_type_old   = array_distinct($e.security_result.detection_fields["old_type"])
    $idp_type_new   = array_distinct($e.security_result.detection_fields["new_type"])
    $idp_active_old = array_distinct($e.security_result.detection_fields["old_active"])
    $idp_active_new = array_distinct($e.security_result.detection_fields["new_active"])

  condition:
    $e
}