Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Veeam ONE Job Disabled Veeam Backup for Microsoft 365

Back
Id176abf3c-392a-47bd-b565-a4ecfd0ff7ec
RulenameVeeam ONE Job Disabled (Veeam Backup for Microsoft 365)
DescriptionDetects when Veeam Backup for Microsoft 365 jobs are disabled.
SeverityMedium
TacticsImpact
TechniquesT1485
T1490
Required data connectorsVeeamCustomTablesDataConnector
KindScheduled
Query frequency3h
Query period3h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365.yaml
Version1.0.0
Arm template176abf3c-392a-47bd-b565-a4ecfd0ff7ec.json
Deploy To Azure
VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 378
tactics:
- Impact
name: Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)
id: 176abf3c-392a-47bd-b565-a4ecfd0ff7ec
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 378
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:
- T1485
- T1490
description: Detects when Veeam Backup for Microsoft 365 jobs are disabled.
triggerOperator: gt
queryPeriod: 3h
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365.yaml
version: 1.0.0
triggerThreshold: 0
kind: Scheduled
queryFrequency: 3h
status: Available
customDetails:
  Name: Name
  ObjectType: ObjectType
  TriggeredTime: TriggeredTime
  TriggeredAlarmId: TriggeredAlarmId
  VoneHostName: VoneHostName
  Comment: Comment
  PredefinedAlarmId: PredefinedAlarmId
  Status: Status
  Description: Description
  ObjectId: ObjectId
  ObjectName: ObjectName
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/176abf3c-392a-47bd-b565-a4ecfd0ff7ec')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/176abf3c-392a-47bd-b565-a4ecfd0ff7ec')]",
      "properties": {
        "alertRuleTemplateName": "176abf3c-392a-47bd-b565-a4ecfd0ff7ec",
        "customDetails": {
          "Comment": "Comment",
          "Description": "Description",
          "Name": "Name",
          "ObjectId": "ObjectId",
          "ObjectName": "ObjectName",
          "ObjectType": "ObjectType",
          "PredefinedAlarmId": "PredefinedAlarmId",
          "Status": "Status",
          "TriggeredAlarmId": "TriggeredAlarmId",
          "TriggeredTime": "TriggeredTime",
          "VoneHostName": "VoneHostName"
        },
        "description": "Detects when Veeam Backup for Microsoft 365 jobs are disabled.",
        "displayName": "Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365.yaml",
        "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 378",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1490"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}