Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Veeam ONE Application with No Recent Data Backup Sessions

Back
Id73e36985-d65d-4852-b3cc-5e8f4b64b39c
RulenameVeeam ONE Application with No Recent Data Backup Sessions
DescriptionDetects applications with no recent backup sessions.
SeverityHigh
TacticsImpact
TechniquesT1490
Required data connectorsVeeamCustomTablesDataConnector
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Application_with_no_recent_data_backup_sessions.yaml
Version1.0.0
Arm template73e36985-d65d-4852-b3cc-5e8f4b64b39c.json
Deploy To Azure
VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 391
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Application_with_no_recent_data_backup_sessions.yaml
triggerThreshold: 0
severity: High
queryFrequency: 5m
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  TriggeredAlarmId: TriggeredAlarmId
  Status: Status
  Comment: Comment
  ObjectName: ObjectName
  Description: Description
  VoneHostName: VoneHostName
  ObjectType: ObjectType
  Name: Name
  PredefinedAlarmId: PredefinedAlarmId
  TriggeredTime: TriggeredTime
  ObjectId: ObjectId
relevantTechniques:
- T1490
triggerOperator: gt
id: 73e36985-d65d-4852-b3cc-5e8f4b64b39c
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
version: 1.0.0
name: Veeam ONE Application with No Recent Data Backup Sessions
tactics:
- Impact
description: Detects applications with no recent backup sessions.
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 391
status: Available
queryPeriod: 5m
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/73e36985-d65d-4852-b3cc-5e8f4b64b39c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/73e36985-d65d-4852-b3cc-5e8f4b64b39c')]",
      "properties": {
        "alertRuleTemplateName": "73e36985-d65d-4852-b3cc-5e8f4b64b39c",
        "customDetails": {
          "Comment": "Comment",
          "Description": "Description",
          "Name": "Name",
          "ObjectId": "ObjectId",
          "ObjectName": "ObjectName",
          "ObjectType": "ObjectType",
          "PredefinedAlarmId": "PredefinedAlarmId",
          "Status": "Status",
          "TriggeredAlarmId": "TriggeredAlarmId",
          "TriggeredTime": "TriggeredTime",
          "VoneHostName": "VoneHostName"
        },
        "description": "Detects applications with no recent backup sessions.",
        "displayName": "Veeam ONE Application with No Recent Data Backup Sessions",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Application_with_no_recent_data_backup_sessions.yaml",
        "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 391",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1490"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}