Tape Erase Job Started

Back


Id	06ba509c-606e-4967-baee-21815ae61f8e
Rulename	Tape Erase Job Started
Description	Detects when tape erase operations start. This might indicate data destruction activity.
Severity	High
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Tape_Erase_Job_Started.yaml
Version	1.0.1
Arm template	06ba509c-606e-4967-baee-21815ae61f8e.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 115
| extend JobName = extract("JobName=\"([^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["Job Name"] = JobName,
    MessageDetails = Description,
    Severity = SeverityDescription

YAML

name: Tape Erase Job Started
id: 06ba509c-606e-4967-baee-21815ae61f8e
description: Detects when tape erase operations start. This might indicate data destruction activity.
triggerThreshold: 0
version: 1.0.1
triggerOperator: gt
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 115
  | extend JobName = extract("JobName=\"([^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["Job Name"] = JobName,
      MessageDetails = Description,
      Severity = SeverityDescription  
tactics: []
kind: Scheduled
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Tape_Erase_Job_Started.yaml
severity: High
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: Syslog
- dataTypes:
  - Syslog
  connectorId: SyslogAma
status: Available
customDetails:
  VbrHostName: DataSource
  Severity: Severity
  Date: Date
  MessageDetails: MessageDetails
  EventId: EventId
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: []

ARM