Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Alarming number of anomalies generated in NetBackup

Back
Id2e0efcd4-56d2-41df-9098-d6898a58c62b
RulenameAlarming number of anomalies generated in NetBackup
DescriptionThis rule generates an incident when an alarming number of anomalies are generated in the last 15 minutes.
SeverityMedium
TacticsDiscovery
CredentialAccess
KindScheduled
Query frequency15m
Query period15m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veritas NetBackup/Analytic Rules/NetBackup_many_Anomalies.yaml
Version1.0.0
Arm template2e0efcd4-56d2-41df-9098-d6898a58c62b.json
Deploy To Azure
NetBackupAlerts_CL
| where Category contains "ANOMALY_NEW"
| extend client =  split(Message, "client '")[1]
| extend clientName = split(client, "'")[0]
| summarize Total=count() by tostring(clientName)
| where Total >= 10
query: |-
  NetBackupAlerts_CL
  | where Category contains "ANOMALY_NEW"
  | extend client =  split(Message, "client '")[1]
  | extend clientName = split(client, "'")[0]
  | summarize Total=count() by tostring(clientName)
  | where Total >= 10  
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veritas NetBackup/Analytic Rules/NetBackup_many_Anomalies.yaml
id: 2e0efcd4-56d2-41df-9098-d6898a58c62b
name: Alarming number of anomalies generated in NetBackup
techniques:
- T1110
- T1212
entityMappings:
- fieldMappings:
  - columnName: clientName
    identifier: HostName
  entityType: Host
queryPeriod: 15m
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: SingleAlert
tactics:
- Discovery
- CredentialAccess
version: 1.0.0
kind: Scheduled
suppressionEnabled: false
queryFrequency: 15m
status: Available
requiredDataConnectors: []
description: This rule generates an incident when an alarming number of anomalies are generated in the last 15 minutes.
suppressionDuration: PT5H
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
  createIncident: true
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2e0efcd4-56d2-41df-9098-d6898a58c62b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2e0efcd4-56d2-41df-9098-d6898a58c62b')]",
      "properties": {
        "alertRuleTemplateName": "2e0efcd4-56d2-41df-9098-d6898a58c62b",
        "customDetails": null,
        "description": "This rule generates an incident when an alarming number of anomalies are generated in the last 15 minutes.",
        "displayName": "Alarming number of anomalies generated in NetBackup",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "clientName",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veritas NetBackup/Analytic Rules/NetBackup_many_Anomalies.yaml",
        "query": "NetBackupAlerts_CL\n| where Category contains \"ANOMALY_NEW\"\n| extend client =  split(Message, \"client '\")[1]\n| extend clientName = split(client, \"'\")[0]\n| summarize Total=count() by tostring(clientName)\n| where Total >= 10",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Discovery"
        ],
        "techniques": [
          "T1110",
          "T1212"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}