Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Veeam ONE Job Disabled Veeam Backup for Microsoft 365

Back
Id176abf3c-392a-47bd-b565-a4ecfd0ff7ec
RulenameVeeam ONE Job Disabled (Veeam Backup for Microsoft 365)
DescriptionDetects when Veeam Backup for Microsoft 365 jobs are disabled.
SeverityMedium
TacticsImpact
TechniquesT1485
T1490
Required data connectorsVeeamCustomTablesDataConnector
KindScheduled
Query frequency3h
Query period3h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365.yaml
Version1.0.0
Arm template176abf3c-392a-47bd-b565-a4ecfd0ff7ec.json
Deploy To Azure
VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 378
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365.yaml
triggerThreshold: 0
severity: Medium
queryFrequency: 3h
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  TriggeredAlarmId: TriggeredAlarmId
  Status: Status
  Comment: Comment
  ObjectName: ObjectName
  Description: Description
  VoneHostName: VoneHostName
  ObjectType: ObjectType
  Name: Name
  PredefinedAlarmId: PredefinedAlarmId
  TriggeredTime: TriggeredTime
  ObjectId: ObjectId
relevantTechniques:
- T1485
- T1490
triggerOperator: gt
id: 176abf3c-392a-47bd-b565-a4ecfd0ff7ec
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
version: 1.0.0
name: Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)
tactics:
- Impact
description: Detects when Veeam Backup for Microsoft 365 jobs are disabled.
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 378
status: Available
queryPeriod: 3h
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/176abf3c-392a-47bd-b565-a4ecfd0ff7ec')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/176abf3c-392a-47bd-b565-a4ecfd0ff7ec')]",
      "properties": {
        "alertRuleTemplateName": "176abf3c-392a-47bd-b565-a4ecfd0ff7ec",
        "customDetails": {
          "Comment": "Comment",
          "Description": "Description",
          "Name": "Name",
          "ObjectId": "ObjectId",
          "ObjectName": "ObjectName",
          "ObjectType": "ObjectType",
          "PredefinedAlarmId": "PredefinedAlarmId",
          "Status": "Status",
          "TriggeredAlarmId": "TriggeredAlarmId",
          "TriggeredTime": "TriggeredTime",
          "VoneHostName": "VoneHostName"
        },
        "description": "Detects when Veeam Backup for Microsoft 365 jobs are disabled.",
        "displayName": "Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365.yaml",
        "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 378",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1490"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}