sap_impossible_travel

rule sap_impossible_travel {

  meta:
    author = "Google Cloud Security"
    description = "Identifies two successful logons for the same User ID from two different geographic locations in a timeframe that is physically impossible to travel between, indicating credential sharing or theft."
    severity = "medium"
    tactic = "TA0006"
    technique = "T1078"

  events:
    $e.metadata.log_type = "SAP_SECURITY_AUDIT"
    (
        $e.metadata.event_type = "USER_LOGIN" or
        $e.additional.fields["msg_1"] = /^AU1$|^AU5$/
    )
    $e.principal.ip_geo_artifact.location.country_or_region != ""

    $country = $e.principal.ip_geo_artifact.location.country_or_region
    $state = $e.principal.ip_geo_artifact.location.state
    $user = $e.principal.user.userid

  match:
    $user over 1h

  outcome:
    $countries = array_distinct($country)
    $states = array_distinct($state)
    $count_of_countries = count_distinct($country)
    $count_of_states = count_distinct($state)
    $risk_score = if(count_distinct($country) > 1, 30, 0) + if(count_distinct($state) > 2, 30, 0) + 30
    $network_carrier_name = array_distinct($e.principal.ip_geo_artifact.network.carrier_name)
    $networn_dns_domain = array_distinct($e.principal.ip_geo_artifact.network.dns_domain)
    $network_org = array_distinct($e.principal.ip_geo_artifact.network.organization_name)
    $sap_instance = array_distinct($e.target.resource.name)

  condition:
    #country >= 2 or #state >= 2
}