Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Veeam ONE Backup Server Security and Compliance State

Back
Id7ad4b9ff-8089-4b70-b98e-a2ca995611e9
RulenameVeeam ONE Backup Server Security and Compliance State
DescriptionDetects backup server security and compliance state issues.
SeverityMedium
TacticsImpact
TechniquesT1490
Required data connectorsVeeamCustomTablesDataConnector
KindScheduled
Query frequency3h
Query period3h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Backup_server_security_&_compliance_state.yaml
Version1.0.0
Arm template7ad4b9ff-8089-4b70-b98e-a2ca995611e9.json
Deploy To Azure
VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395
tactics:
- Impact
name: Veeam ONE Backup Server Security and Compliance State
id: 7ad4b9ff-8089-4b70-b98e-a2ca995611e9
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:
- T1490
description: Detects backup server security and compliance state issues.
triggerOperator: gt
queryPeriod: 3h
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Backup_server_security_&_compliance_state.yaml
version: 1.0.0
triggerThreshold: 0
kind: Scheduled
queryFrequency: 3h
status: Available
customDetails:
  Name: Name
  ObjectType: ObjectType
  TriggeredTime: TriggeredTime
  TriggeredAlarmId: TriggeredAlarmId
  VoneHostName: VoneHostName
  Comment: Comment
  PredefinedAlarmId: PredefinedAlarmId
  Status: Status
  Description: Description
  ObjectId: ObjectId
  ObjectName: ObjectName
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7ad4b9ff-8089-4b70-b98e-a2ca995611e9')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7ad4b9ff-8089-4b70-b98e-a2ca995611e9')]",
      "properties": {
        "alertRuleTemplateName": "7ad4b9ff-8089-4b70-b98e-a2ca995611e9",
        "customDetails": {
          "Comment": "Comment",
          "Description": "Description",
          "Name": "Name",
          "ObjectId": "ObjectId",
          "ObjectName": "ObjectName",
          "ObjectType": "ObjectType",
          "PredefinedAlarmId": "PredefinedAlarmId",
          "Status": "Status",
          "TriggeredAlarmId": "TriggeredAlarmId",
          "TriggeredTime": "TriggeredTime",
          "VoneHostName": "VoneHostName"
        },
        "description": "Detects backup server security and compliance state issues.",
        "displayName": "Veeam ONE Backup Server Security and Compliance State",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Backup_server_security_&_compliance_state.yaml",
        "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1490"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}