Objects for Job Deleted

Back


Id	5367e8fc-a150-468f-84f2-90ac1dabef15
Rulename	Objects for Job Deleted
Description	Detects when objects are deleted from the job. This might indicate unauthorized removal of critical components.
Severity	High
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_for_Job_Deleted.yaml
Version	1.0.1
Arm template	5367e8fc-a150-468f-84f2-90ac1dabef15.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 32120
| extend JobName = extract("JobName=\"([^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["User Name"] = user,
    ["Job Name"] = JobName,
    MessageDetails = Description,
   Severity = SeverityDescription

YAML

customDetails:
  MessageDetails: MessageDetails
  Severity: Severity
  VbrHostName: DataSource
  Date: Date
  EventId: EventId
name: Objects for Job Deleted
relevantTechniques: []
id: 5367e8fc-a150-468f-84f2-90ac1dabef15
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_for_Job_Deleted.yaml
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: Syslog
- dataTypes:
  - Syslog
  connectorId: SyslogAma
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.1
severity: High
triggerThreshold: 0
queryPeriod: 5m
queryFrequency: 5m
status: Available
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 32120
  | extend JobName = extract("JobName=\"([^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["User Name"] = user,
      ["Job Name"] = JobName,
      MessageDetails = Description,
     Severity = SeverityDescription  
tactics: []
kind: Scheduled
description: Detects when objects are deleted from the job. This might indicate unauthorized removal of critical components.
triggerOperator: gt

ARM