SAP BTP - Audit log service unavailable
Identifies SAP BTP subaccounts that have not reported audit logs for an unusual period. This could indicate that the audit log service has been disabled or tampered with, potentially by an attacker attempting to hide…
Description
Identifies SAP BTP subaccounts that have not reported audit logs for an unusual period. This could indicate that the audit log service has been disabled or tampered with, potentially by an attacker attempting to hide malicious activity. It may also indicate service key expiry or SAP BTP service availability problems.
Detection logic
Detection requirements
- Platform
- IaaSIdentity ProviderOffice SuiteSaaS
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- sapbtpauditevents
- Log source service
- sapbtpauditlog_cl
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 8a3b5c7d-9e1f-4a2b-8c6d-3e5f7a9b1c2d
- Tagged by the source as
- DefenseEvasion
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1