sap_btp_workzone_site_creation

rule sap_btp_workzone_site_creation {

  meta:
    author = "Google Cloud Security"
    description = "A Build Work Zone site was created or its content was modified"
    severity = "Medium"
    tactic = "TA0003"
    technique = "T1505"

  events:
    $e.metadata.log_type = "SAP_BTP"

    $e.security_result.detection_fields["object_id_json_message"] = "CDM data changed." nocase
    $e.security_result.category_details = "audit.data-modification" nocase
    $e.security_result.detection_fields.value = /Operation: (CREATE|UPDATE), entity id: [^,]+, entity type: site/ nocase

    $tenant = $e.security_result.detection_fields["tenant"]
    $user = strings.coalesce($e.principal.user.user_display_name, $e.principal.user.userid)

    not $e.principal.user.userid            = /^sb-/ nocase
    not $e.principal.user.user_display_name = /^sb-/ nocase

  match:
    $user, $tenant over 1h

  outcome:
    $action             = array_distinct(re.capture($e.security_result.detection_fields.value, `Operation: (.*?),`))
    $risk_score         = 60
    $audit_record_count = count_distinct($e.security_result.detection_fields["message_uuid"])

  condition:
    $e
}