Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Veeam ONE Backup Server Security and Compliance State

Back
Id7ad4b9ff-8089-4b70-b98e-a2ca995611e9
RulenameVeeam ONE Backup Server Security and Compliance State
DescriptionDetects backup server security and compliance state issues.
SeverityMedium
TacticsImpact
TechniquesT1490
Required data connectorsVeeamCustomTablesDataConnector
KindScheduled
Query frequency3h
Query period3h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Backup_server_security_&_compliance_state.yaml
Version1.0.0
Arm template7ad4b9ff-8089-4b70-b98e-a2ca995611e9.json
Deploy To Azure
VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Backup_server_security_&_compliance_state.yaml
triggerThreshold: 0
severity: Medium
queryFrequency: 3h
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  TriggeredAlarmId: TriggeredAlarmId
  Status: Status
  Comment: Comment
  ObjectName: ObjectName
  Description: Description
  VoneHostName: VoneHostName
  ObjectType: ObjectType
  Name: Name
  PredefinedAlarmId: PredefinedAlarmId
  TriggeredTime: TriggeredTime
  ObjectId: ObjectId
relevantTechniques:
- T1490
triggerOperator: gt
id: 7ad4b9ff-8089-4b70-b98e-a2ca995611e9
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
version: 1.0.0
name: Veeam ONE Backup Server Security and Compliance State
tactics:
- Impact
description: Detects backup server security and compliance state issues.
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395
status: Available
queryPeriod: 3h
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7ad4b9ff-8089-4b70-b98e-a2ca995611e9')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7ad4b9ff-8089-4b70-b98e-a2ca995611e9')]",
      "properties": {
        "alertRuleTemplateName": "7ad4b9ff-8089-4b70-b98e-a2ca995611e9",
        "customDetails": {
          "Comment": "Comment",
          "Description": "Description",
          "Name": "Name",
          "ObjectId": "ObjectId",
          "ObjectName": "ObjectName",
          "ObjectType": "ObjectType",
          "PredefinedAlarmId": "PredefinedAlarmId",
          "Status": "Status",
          "TriggeredAlarmId": "TriggeredAlarmId",
          "TriggeredTime": "TriggeredTime",
          "VoneHostName": "VoneHostName"
        },
        "description": "Detects backup server security and compliance state issues.",
        "displayName": "Veeam ONE Backup Server Security and Compliance State",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Backup_server_security_&_compliance_state.yaml",
        "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1490"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}