Alarming number of anomalies generated in NetBackup

Back


Id	2e0efcd4-56d2-41df-9098-d6898a58c62b
Rulename	Alarming number of anomalies generated in NetBackup
Description	This rule generates an incident when an alarming number of anomalies are generated in the last 15 minutes.
Severity	Medium
Tactics	Discovery CredentialAccess
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veritas NetBackup/Analytic Rules/NetBackup_many_Anomalies.yaml
Version	1.0.1
Arm template	2e0efcd4-56d2-41df-9098-d6898a58c62b.json

KQL

NetBackupAlerts_CL
| where Category contains "ANOMALY_NEW"
| extend client =  split(Message, "client '")[1]
| extend clientName = split(client, "'")[0]
| summarize Total=count() by tostring(clientName)
| where Total >= 10

YAML

entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: clientName
    identifier: HostName
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.1
suppressionEnabled: false
id: 2e0efcd4-56d2-41df-9098-d6898a58c62b
suppressionDuration: PT5H
severity: Medium
kind: Scheduled
queryFrequency: 15m
description: This rule generates an incident when an alarming number of anomalies are generated in the last 15 minutes.
requiredDataConnectors: []
triggerOperator: gt
techniques:
- T1110
- T1212
tactics:
- Discovery
- CredentialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veritas NetBackup/Analytic Rules/NetBackup_many_Anomalies.yaml
triggerThreshold: 0
queryPeriod: 15m
query: |-
  NetBackupAlerts_CL
  | where Category contains "ANOMALY_NEW"
  | extend client =  split(Message, "client '")[1]
  | extend clientName = split(client, "'")[0]
  | summarize Total=count() by tostring(clientName)
  | where Total >= 10  
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
name: Alarming number of anomalies generated in NetBackup

ARM