Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Tape Erase Job Started

Back
Id06ba509c-606e-4967-baee-21815ae61f8e
RulenameTape Erase Job Started
DescriptionDetects when tape erase operations start. This might indicate data destruction activity.
SeverityHigh
TacticsImpact
TechniquesT1485
Required data connectorsSyslog
SyslogAma
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Tape_Erase_Job_Started.yaml
Version1.0.0
Arm template06ba509c-606e-4967-baee-21815ae61f8e.json
Deploy To Azure
Veeam_GetSecurityEvents
| where instanceId == 115
| extend JobName = extract("JobName=\"([^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["Job Name"] = JobName,
    MessageDetails = Description,
    Severity = SeverityDescription
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Tape_Erase_Job_Started.yaml
triggerThreshold: 0
severity: High
queryFrequency: 5m
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  EventId: EventId
  Date: Date
  Severity: Severity
  MessageDetails: MessageDetails
  VbrHostName: DataSource
relevantTechniques:
- T1485
triggerOperator: gt
id: 06ba509c-606e-4967-baee-21815ae61f8e
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
version: 1.0.0
name: Tape Erase Job Started
tactics:
- Impact
description: Detects when tape erase operations start. This might indicate data destruction activity.
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 115
  | extend JobName = extract("JobName=\"([^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["Job Name"] = JobName,
      MessageDetails = Description,
      Severity = SeverityDescription  
status: Available
queryPeriod: 5m
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/06ba509c-606e-4967-baee-21815ae61f8e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/06ba509c-606e-4967-baee-21815ae61f8e')]",
      "properties": {
        "alertRuleTemplateName": "06ba509c-606e-4967-baee-21815ae61f8e",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects when tape erase operations start. This might indicate data destruction activity.",
        "displayName": "Tape Erase Job Started",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Tape_Erase_Job_Started.yaml",
        "query": "Veeam_GetSecurityEvents\n| where instanceId == 115\n| extend JobName = extract(\"JobName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    [\"Job Name\"] = JobName,\n    MessageDetails = Description,\n    Severity = SeverityDescription",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}