Microsoft Sentinel medium experimental kql
Pathlock TDnR - Spool Job Changes
Detects changes to SAP spool jobs, forwarded by Pathlock Threat Detection and Response. Unauthorized spool job manipulations may indicate tampering with scheduled output, redirection of sensitive reports, or data collection activity involving SAP output management.
Detection Logic
Pathlock_TDnR_CL
| where DataSource == "SPOOL_REQUEST"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTsField Validations
Loading…
Comments (0)
Loading comments...