Object Marked as Clean

Back


Id	56d70592-077e-4e7b-9d8a-b5d8b0a6a52b
Rulename	Object Marked as Clean
Description	Detects when an object is marked as clean.
Severity	Informational
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Object_Marked_as_Clean.yaml
Version	1.0.1
Arm template	56d70592-077e-4e7b-9d8a-b5d8b0a6a52b.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 41610
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["User Name"] = user,
  MessageDetails = Description,
   Severity = SeverityDescription

YAML

name: Object Marked as Clean
id: 56d70592-077e-4e7b-9d8a-b5d8b0a6a52b
description: Detects when an object is marked as clean.
triggerThreshold: 0
version: 1.0.1
triggerOperator: gt
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 41610
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["User Name"] = user,
    MessageDetails = Description,
     Severity = SeverityDescription  
tactics: []
kind: Scheduled
queryFrequency: 1d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Object_Marked_as_Clean.yaml
severity: Informational
queryPeriod: 1d
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: Syslog
- dataTypes:
  - Syslog
  connectorId: SyslogAma
status: Available
customDetails:
  VbrHostName: DataSource
  Severity: Severity
  Date: Date
  MessageDetails: MessageDetails
  EventId: EventId
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: []

ARM