Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Veeam ONE Malware Detection Change Tracking

Back
Id2a860019-0eda-4b49-bc62-8f683aed4929
RulenameVeeam ONE Malware Detection Change Tracking
DescriptionDetects changes in Veeam ONE malware detection tracking.
SeverityHigh
TacticsImpact
TechniquesT1486
Required data connectorsVeeamCustomTablesDataConnector
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Veeam_malware_detection_change_tracking.yaml
Version1.0.0
Arm template2a860019-0eda-4b49-bc62-8f683aed4929.json
Deploy To Azure
VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 403
tactics:
- Impact
name: Veeam ONE Malware Detection Change Tracking
id: 2a860019-0eda-4b49-bc62-8f683aed4929
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 403
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:
- T1486
description: Detects changes in Veeam ONE malware detection tracking.
triggerOperator: gt
queryPeriod: 5m
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Veeam_malware_detection_change_tracking.yaml
version: 1.0.0
triggerThreshold: 0
kind: Scheduled
queryFrequency: 5m
status: Available
customDetails:
  Name: Name
  ObjectType: ObjectType
  TriggeredTime: TriggeredTime
  TriggeredAlarmId: TriggeredAlarmId
  VoneHostName: VoneHostName
  Comment: Comment
  PredefinedAlarmId: PredefinedAlarmId
  Status: Status
  Description: Description
  ObjectId: ObjectId
  ObjectName: ObjectName
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2a860019-0eda-4b49-bc62-8f683aed4929')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2a860019-0eda-4b49-bc62-8f683aed4929')]",
      "properties": {
        "alertRuleTemplateName": "2a860019-0eda-4b49-bc62-8f683aed4929",
        "customDetails": {
          "Comment": "Comment",
          "Description": "Description",
          "Name": "Name",
          "ObjectId": "ObjectId",
          "ObjectName": "ObjectName",
          "ObjectType": "ObjectType",
          "PredefinedAlarmId": "PredefinedAlarmId",
          "Status": "Status",
          "TriggeredAlarmId": "TriggeredAlarmId",
          "TriggeredTime": "TriggeredTime",
          "VoneHostName": "VoneHostName"
        },
        "description": "Detects changes in Veeam ONE malware detection tracking.",
        "displayName": "Veeam ONE Malware Detection Change Tracking",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Veeam_malware_detection_change_tracking.yaml",
        "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 403",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1486"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}