sap_audit_message_id_absent_from_monitoring_config

rule sap_audit_message_id_absent_from_monitoring_config {

  meta:
    author = "Google Cloud Security"
    description = "An SAP audit message ID appeared in logs but is missing from the monitoring configuration table"
    severity = "Medium"
    tactic = "TA0005"
    technique = "T1562"

  events:
    $e.metadata.log_type = "SAP_SECURITY_AUDIT"
    $message_id = $e.additional.fields["msg_1"]
    $message_id != "RZ 792"
    $sid = $e.target.application
    $client = $e.target.resource.attribute.labels["slgmand_1"]

     not $message_id in %SAP_Audit_Log_Configuration.MessageID

  match:
    $message_id, $sid, $client over 24h

  outcome:
    $risk_score = 60
    $instance = array_distinct($e.target.resource.name)
    $user = array_distinct($e.principal.user.userid)
    $message_text = array_distinct($e.metadata.description)

  condition:
    $e
}