Configuration Backup Failed

Back


Id	259ef474-836d-4662-86ef-70cb7a38e765
Rulename	Configuration Backup Failed
Description	Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.
Severity	High
Required data connectors	VeeamCustomTablesDataConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Configuration_Backup_Failed.yaml
Version	1.0.2
Arm template	259ef474-836d-4662-86ef-70cb7a38e765.json

KQL

VeeamSessions_CL | where SessionType == "ConfigurationBackup" and ResultStatus == "Failed" | project TimeGenerated, VbrHostName, SessionId = Id, SessionType, Name, Result = ResultStatus

YAML

kind: Scheduled
tactics: []
triggerThreshold: 0
triggerOperator: gt
version: 1.0.2
status: Available
queryFrequency: 5m
id: 259ef474-836d-4662-86ef-70cb7a38e765
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamSessions_CL
name: Configuration Backup Failed
description: Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.
customDetails:
  VbrHostName: VbrHostName
  Name: Name
  Result: Result
  SessionId: SessionId
  SessionType: SessionType
relevantTechniques: []
query: VeeamSessions_CL | where SessionType == "ConfigurationBackup" and ResultStatus == "Failed" | project TimeGenerated, VbrHostName, SessionId = Id, SessionType, Name, Result = ResultStatus
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Configuration_Backup_Failed.yaml
queryPeriod: 5m
severity: High
eventGroupingSettings:
  aggregationKind: AlertPerResult

ARM