Sentinel Solution for SAP® BTP
Solution: SAP BTP
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Publisher | Microsoft Corporation |
| Support Tier | Microsoft |
| Support Link | https://support.microsoft.com/ |
| Categories | Application,Cloud Provider |
| Version | 3.1.1 |
| Author | Microsoft - support@microsoft.com |
| First Published | 2023-04-04 |
| Last Updated | 2026-07-24 |
| Solution Folder | SAP BTP |
| Marketplace | Azure Marketplace · Popularity: 🟡 Low (46%) |
SAP Business Technology Platform (BTP) is SAP's platform-as-a-service for building, extending, and integrating SAP and third-party applications. It brings together services such as Cloud Integration (CPI), Cloud Identity Services, Business Application Studio, and Build Work Zone that organizations rely on to run business-critical processes.
The SAP BTP Solution for Microsoft Sentinel ingests audit and activity events from the SAP BTP Audit Log Service across multiple subaccounts using a codeless data connector, and ships detections, hunting content, and a workbook to help security teams monitor BTP for identity abuse (privileged role changes, mass user deletion, IdP/trust tampering), integration threats (Cloud Integration artifact deployment, security-material and access-policy tampering, JDBC data source changes), developer-workspace risks (malware in BAS dev spaces, failed cross-tenant access), and audit coverage gaps (unaudited custom apps, audit log service unavailability).
Contents
Data Connectors
This solution provides 1 data connector(s):
Tables Used
This solution uses 2 table(s):
| Table | Used By Connectors | Used By Content |
|---|---|---|
SAPBTPAuditLog_CL |
SAP BTP | Analytics, Workbooks |
Update |
- | Workbooks |
Internal Tables
The following 1 table(s) are used internally by this solution's content items:
| Table | Used By Connectors | Used By Content |
|---|---|---|
SecurityAlert |
- | Workbooks |
Content Items
This solution includes 17 content item(s):
| Content Type | Count |
|---|---|
| Analytic Rules | 16 |
| Workbooks | 1 |
Analytic Rules
Workbooks
| Name | Tables Used |
|---|---|
| SAPBTPActivity | SAPBTPAuditLog_CLUpdateInternal use: SecurityAlert |
Release Notes
| Version | Date Modified (DD-MM-YYYY) | Change History |
|---|---|---|
| 3.1.1 | 22-07-2026 | New analytic rule: detect unaudited custom apps with login-only activity. Renamed analytic rules with SAP BTP prefix for improved discoverability. |
| 3.1.0 | 08-06-2026 | Reworked BTP Cloud Integration artifact deployment rule to use audit.configuration events with richer artifact, actor, and tenant context |
| 3.0.12 | 29-12-2025 | Updated grid view UI with new subaccount onboarding properties |
| 3.0.11 | 29-12-2025 | Added queryWindowDelayInMin for SAP log delays and included the SAP CIS analytic rules. |
| 3.0.10 | 03-10-2025 | Resolves data connector duplicate handle pagination errors |
| 3.0.9 | 02-09-2025 | Connector UI fix |
| 3.0.8 | 03-12-2024 | Removal of Function App data connector |
| 3.0.7 | 24-07-2024 | Updated BAS malware rule after changes in source message format |
| 3.0.6 | 23-07-2024 | Resolves ContentTemplateNotFound error for CCP |
| 3.0.5 | 15-07-2024 | Remove data source mappings for deprecated function app connector |
| 3.0.4 | 11-07-2024 | Move codeless connector to GA and deprecated function app connector |
| 3.0.3 | 21-06-2024 | Fixes issue with data connector TokenEndpoint query parameter |
| 3.0.2 | 21-03-2024 | Fix data connector version mismatch |
| 3.0.1 | 19-03-2024 | Add data connector based on CCP with support for multiple subaccounts |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊