Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Failover Plan Failed

Back
Id8f339b13-02f0-400f-be18-491ec0ba71f1
RulenameFailover Plan Failed
DescriptionDetects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.
SeverityLow
TacticsDefenseEvasion
TechniquesT1562
Required data connectorsSyslog
SyslogAma
KindScheduled
Query frequency3h
Query period3h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Failed.yaml
Version1.0.0
Arm template8f339b13-02f0-400f-be18-491ec0ba71f1.json
Deploy To Azure
Veeam_GetSecurityEvents
| where instanceId == 26110
| extend FailoverPlanName =  extract("FailoverPlanName=\"(?<FailoverPlanName>[^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
    ["Failover Plan Name"] = FailoverPlanName,
    MessageDetails = Description,
    Severity = SeverityDescription
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Failed.yaml
triggerThreshold: 0
severity: Low
queryFrequency: 3h
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  EventId: EventId
  Date: Date
  Severity: Severity
  MessageDetails: MessageDetails
  VbrHostName: DataSource
relevantTechniques:
- T1562
triggerOperator: gt
id: 8f339b13-02f0-400f-be18-491ec0ba71f1
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
version: 1.0.0
name: Failover Plan Failed
tactics:
- DefenseEvasion
description: Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 26110
  | extend FailoverPlanName =  extract("FailoverPlanName=\"(?<FailoverPlanName>[^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      UserName = user,
      ["Failover Plan Name"] = FailoverPlanName,
      MessageDetails = Description,
      Severity = SeverityDescription  
status: Available
queryPeriod: 3h
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8f339b13-02f0-400f-be18-491ec0ba71f1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8f339b13-02f0-400f-be18-491ec0ba71f1')]",
      "properties": {
        "alertRuleTemplateName": "8f339b13-02f0-400f-be18-491ec0ba71f1",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.",
        "displayName": "Failover Plan Failed",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Failed.yaml",
        "query": "Veeam_GetSecurityEvents\n| where instanceId == 26110\n| extend FailoverPlanName =  extract(\"FailoverPlanName=\\\"(?<FailoverPlanName>[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    UserName = user,\n    [\"Failover Plan Name\"] = FailoverPlanName,\n    MessageDetails = Description,\n    Severity = SeverityDescription",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}