Failover Plan Failed

Back


Id	8f339b13-02f0-400f-be18-491ec0ba71f1
Rulename	Failover Plan Failed
Description	Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.
Severity	Low
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Failed.yaml
Version	1.0.1
Arm template	8f339b13-02f0-400f-be18-491ec0ba71f1.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 26110
| extend FailoverPlanName =  extract("FailoverPlanName=\"(?<FailoverPlanName>[^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
    ["Failover Plan Name"] = FailoverPlanName,
    MessageDetails = Description,
    Severity = SeverityDescription

YAML

queryPeriod: 3h
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 26110
  | extend FailoverPlanName =  extract("FailoverPlanName=\"(?<FailoverPlanName>[^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      UserName = user,
      ["Failover Plan Name"] = FailoverPlanName,
      MessageDetails = Description,
      Severity = SeverityDescription  
name: Failover Plan Failed
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 3h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Failed.yaml
description: Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.
kind: Scheduled
version: 1.0.1
status: Available
severity: Low
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
triggerOperator: gt
triggerThreshold: 0
customDetails:
  EventId: EventId
  MessageDetails: MessageDetails
  VbrHostName: DataSource
  Date: Date
  Severity: Severity
tactics: []
id: 8f339b13-02f0-400f-be18-491ec0ba71f1
relevantTechniques: []

ARM