License Support Expired

Back


Id	7a6f7e95-b574-44ab-b215-f5c32a2378d1
Rulename	License Support Expired
Description	Detects when the Veeam support contract is expired. This might impact backup operations and data protection.
Severity	High
Tactics	Impact
Techniques	T1489
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/License_Support_Expired.yaml
Version	1.0.0
Arm template	7a6f7e95-b574-44ab-b215-f5c32a2378d1.json

KQL

let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist("license_editions_lookup")); 
let license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist("license_types_lookup")); 
Veeam_GetSecurityEvents
| where instanceId == 24050
| extend Edition = extract("Edition=\"([^\"]*)\"", 1, SyslogMessage)
| lookup kind=leftouter (license_editions_lookup) 
    on $left.Edition == $right.Edition
| extend Type = extract("Type=\"([^\"]*)\"", 1, SyslogMessage)
| lookup kind=leftouter (license_types_lookup) 
    on $left.Type == $right.Type
| extend TenantID = extract("TenantID=\"([^\"]*)\"", 1, SyslogMessage)
| extend DaysLeft = extract("DaysLeft=\"([^\"]*)\"", 1, SyslogMessage)
| extend SupportLeft = extract("SupportLeft=\"([^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["License Edition"] = EditionDescription,
    ["License Type"] = TypeDescription,
    ["Days Left"] = DaysLeft,
    ["Days of Support Left"] = SupportLeft,
    MessageDetails = Description,
    Severity = SeverityDescription

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/License_Support_Expired.yaml
triggerThreshold: 0
severity: High
queryFrequency: 5m
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  EventId: EventId
  Date: Date
  Severity: Severity
  MessageDetails: MessageDetails
  VbrHostName: DataSource
relevantTechniques:
- T1489
triggerOperator: gt
id: 7a6f7e95-b574-44ab-b215-f5c32a2378d1
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
version: 1.0.0
name: License Support Expired
tactics:
- Impact
description: Detects when the Veeam support contract is expired. This might impact backup operations and data protection.
query: |
  let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist("license_editions_lookup")); 
  let license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist("license_types_lookup")); 
  Veeam_GetSecurityEvents
  | where instanceId == 24050
  | extend Edition = extract("Edition=\"([^\"]*)\"", 1, SyslogMessage)
  | lookup kind=leftouter (license_editions_lookup) 
      on $left.Edition == $right.Edition
  | extend Type = extract("Type=\"([^\"]*)\"", 1, SyslogMessage)
  | lookup kind=leftouter (license_types_lookup) 
      on $left.Type == $right.Type
  | extend TenantID = extract("TenantID=\"([^\"]*)\"", 1, SyslogMessage)
  | extend DaysLeft = extract("DaysLeft=\"([^\"]*)\"", 1, SyslogMessage)
  | extend SupportLeft = extract("SupportLeft=\"([^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["License Edition"] = EditionDescription,
      ["License Type"] = TypeDescription,
      ["Days Left"] = DaysLeft,
      ["Days of Support Left"] = SupportLeft,
      MessageDetails = Description,
      Severity = SeverityDescription  
status: Available
queryPeriod: 5m
kind: Scheduled

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7a6f7e95-b574-44ab-b215-f5c32a2378d1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7a6f7e95-b574-44ab-b215-f5c32a2378d1')]",
      "properties": {
        "alertRuleTemplateName": "7a6f7e95-b574-44ab-b215-f5c32a2378d1",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects when the Veeam support contract is expired. This might impact backup operations and data protection.",
        "displayName": "License Support Expired",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/License_Support_Expired.yaml",
        "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24050\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n    on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n    on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    [\"License Edition\"] = EditionDescription,\n    [\"License Type\"] = TypeDescription,\n    [\"Days Left\"] = DaysLeft,\n    [\"Days of Support Left\"] = SupportLeft,\n    MessageDetails = Description,\n    Severity = SeverityDescription\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1489"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}