Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Failover Plan Failed

Back
Id8f339b13-02f0-400f-be18-491ec0ba71f1
RulenameFailover Plan Failed
DescriptionDetects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.
SeverityLow
TacticsDefenseEvasion
TechniquesT1562
Required data connectorsSyslog
SyslogAma
KindScheduled
Query frequency3h
Query period3h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Failed.yaml
Version1.0.0
Arm template8f339b13-02f0-400f-be18-491ec0ba71f1.json
Deploy To Azure
Veeam_GetSecurityEvents
| where instanceId == 26110
| extend FailoverPlanName =  extract("FailoverPlanName=\"(?<FailoverPlanName>[^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
    ["Failover Plan Name"] = FailoverPlanName,
    MessageDetails = Description,
    Severity = SeverityDescription
tactics:
- DefenseEvasion
name: Failover Plan Failed
id: 8f339b13-02f0-400f-be18-491ec0ba71f1
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 26110
  | extend FailoverPlanName =  extract("FailoverPlanName=\"(?<FailoverPlanName>[^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      UserName = user,
      ["Failover Plan Name"] = FailoverPlanName,
      MessageDetails = Description,
      Severity = SeverityDescription  
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:
- T1562
description: Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.
triggerOperator: gt
queryPeriod: 3h
severity: Low
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Failed.yaml
version: 1.0.0
triggerThreshold: 0
kind: Scheduled
queryFrequency: 3h
status: Available
customDetails:
  VbrHostName: DataSource
  EventId: EventId
  Severity: Severity
  Date: Date
  MessageDetails: MessageDetails
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8f339b13-02f0-400f-be18-491ec0ba71f1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8f339b13-02f0-400f-be18-491ec0ba71f1')]",
      "properties": {
        "alertRuleTemplateName": "8f339b13-02f0-400f-be18-491ec0ba71f1",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.",
        "displayName": "Failover Plan Failed",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Failed.yaml",
        "query": "Veeam_GetSecurityEvents\n| where instanceId == 26110\n| extend FailoverPlanName =  extract(\"FailoverPlanName=\\\"(?<FailoverPlanName>[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    UserName = user,\n    [\"Failover Plan Name\"] = FailoverPlanName,\n    MessageDetails = Description,\n    Severity = SeverityDescription",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}