Microsoft Sentinel medium experimental kql

Pathlock TDnR - SAP System Job Monitoring Events

Detects monitoring events from SAP system jobs (SJOBREPO), forwarded by Pathlock Threat Detection and Response. Anomalies in system job execution may indicate unauthorized task scheduling, manipulation of critical background processes, or use of system jobs as a persistence mechanism.

View Source

Detection Logic

Pathlock_TDnR_CL
| where DataSource == "SYSTEM_JOBS"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs

Field Validations

Loading…

Comments (0)

Loading comments...