SAP BTP - Unaudited custom app with login-only activity

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Identifies SAP BTP custom applications (CloudFoundry, SAP CAP, etc.) that only produce XSUAA authentication events (TokenIssuedEvent, ClientAuthenticationSuccess) but have not generated any business audit log activity in the past 7 days. This pattern indicates that the application has not implemented audit logging (e.g., missing @AuditLog annotations in CAP or missing audit log service bindings), creating a security blind spot where user actions within the application are invisible to monitoring

Attribute Value
Type Analytic Rule
Solution SAP BTP
ID 5e8f2a1b-7c3d-4b9e-a6f0-1d2e3c4b5a6f
Severity Medium
Status Available
Kind Scheduled
Tactics DefenseEvasion
Techniques T1562, T1562.008
Required Connectors SAPBTPAuditEvents
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
SAPBTPAuditLog_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules · Back to SAP BTP