Fix SAPETD-NoNewDataReceived: shorten CustomDetails key

Renamed customDetails key 'TimeSinceLastIngestion' (22 chars) to 'LastIngestionGap' (16) to satisfy the 20-char max key length validation. Repackaged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MartinPankraz

Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-NoNewDataReceived.yaml

@@ -51,5 +51,5 @@ alertDetailsOverride:
 customDetails:
   LookbackPeriod: LookbackPeriod
   LastIngestion: LastIngestionTime
-  TimeSinceLastIngestion: TimeSinceLastIngestion
+  LastIngestionGap: TimeSinceLastIngestion
 version: 1.0.0

Solutions/SAP ETD Cloud/Package/3.0.5.zip

@@ -203,9 +203,9 @@
                   "aggregationKind": "AlertPerResult"
                 },
                 "customDetails": {
-                  "SAP_User": "User",
+                  "SAP_UserEmail": "UserEmail",
                   "ETD_AlertNumber": "AlertId",
-                  "SAP_UserEmail": "UserEmail"
+                  "SAP_User": "User"
                 },
                 "alertDetailsOverride": {
                   "alertDescriptionFormat": "{{PatternDescription}}",
@@ -471,9 +471,9 @@
                   "aggregationKind": "AlertPerResult"
                 },
                 "customDetails": {
-                  "SAP_User": "extracted_sap_user",
+                  "SAP_UserEmail": "UserEmail",
                   "ETD_AlertNumber": "AlertId",
-                  "SAP_UserEmail": "UserEmail"
+                  "SAP_User": "extracted_sap_user"
                 },
                 "alertDetailsOverride": {
                   "alertDescriptionFormat": "{{PatternDescription}}\n",
@@ -622,9 +622,9 @@
                   "aggregationKind": "SingleAlert"
                 },
                 "customDetails": {
-                  "SAP_User": "extracted_sap_user",
+                  "SAP_UserEmail": "UserEmail",
                   "ETD_AlertNumber": "AlertId",
-                  "SAP_UserEmail": "UserEmail"
+                  "SAP_User": "extracted_sap_user"
                 },
                 "alertDetailsOverride": {
                   "alertDescriptionFormat": "{{PatternDescription}}\n\nSource: SAP ETD\n",
@@ -731,8 +731,8 @@
                 },
                 "customDetails": {
                   "LastIngestion": "LastIngestionTime",
-                  "LookbackPeriod": "LookbackPeriod",
-                  "TimeSinceLastIngestion": "TimeSinceLastIngestion"
+                  "LastIngestionGap": "TimeSinceLastIngestion",
+                  "LookbackPeriod": "LookbackPeriod"
                 },
                 "alertDetailsOverride": {
                   "alertDescriptionFormat": "{{Reason}}\n\nA complete gap in the SAP ETD feed may indicate that an adversary is tampering with the security telemetry pipeline (for example by stopping the SAP ETD collector, disabling the data connector, or blocking network egress to Microsoft Sentinel) in order to hide malicious activity in the SAP landscape. Treat the silence as suspicious until proven otherwise: validate the integrity and runtime state of the SAP ETD data connector, the SAP ETD service, and the network path between them, and review recent change / admin activity on those components before concluding the cause is a benign outage.\n",
@@ -866,11 +866,11 @@
                   "aggregationKind": "AlertPerResult"
                 },
                 "customDetails": {
-                  "LookbackPeriod": "LookbackPeriod",
                   "LastIngestion": "LastIngestionTime",
-                  "SAP_Client": "ClientId",
+                  "LastIngestionGap": "TimeSinceLastIngestion",
                   "SAP_SID": "SystemId",
-                  "LastIngestionGap": "TimeSinceLastIngestion"
+                  "LookbackPeriod": "LookbackPeriod",
+                  "SAP_Client": "ClientId"
                 },
                 "alertDetailsOverride": {
                   "alertDescriptionFormat": "{{Reason}}\n\nA selective silence of a single SAP SID may indicate that an adversary is tampering with the security telemetry pipeline for this specific system (for example by stopping the SAP ETD collector for that SID, disabling the relevant data connector path, or blocking network egress from that host) in order to hide malicious activity while leaving the rest of the SAP ETD feed intact. Treat the silence as suspicious until proven otherwise: validate the integrity and runtime state of the SAP system, the SAP ETD collector configuration for this SID, and the data connector between SAP ETD and Microsoft Sentinel, and review recent change / admin activity on those components before concluding the cause is a benign outage.\n",