Objects Added to Malware Detection Exclusions

Back


Id	a8ebf22b-a050-434c-8095-2267f206257a
Rulename	Objects Added to Malware Detection Exclusions
Description	Detects when an object is added to malware detection exclusions.
Severity	High
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Added_to_Malware_Detection_Exclusions.yaml
Version	1.0.1
Arm template	a8ebf22b-a050-434c-8095-2267f206257a.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 42260
| extend AddedObjectNames = extract("AddedObjectNames=\"([^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["Object Names"] = AddedObjectNames,
    MessageDetails = Description,
    Severity = SeverityDescription

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Added_to_Malware_Detection_Exclusions.yaml
queryPeriod: 5m
description: Detects when an object is added to malware detection exclusions.
triggerThreshold: 0
name: Objects Added to Malware Detection Exclusions
triggerOperator: gt
kind: Scheduled
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
customDetails:
  MessageDetails: MessageDetails
  EventId: EventId
  VbrHostName: DataSource
  Date: Date
  Severity: Severity
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 5m
tactics: []
id: a8ebf22b-a050-434c-8095-2267f206257a
status: Available
version: 1.0.1
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 42260
  | extend AddedObjectNames = extract("AddedObjectNames=\"([^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["Object Names"] = AddedObjectNames,
      MessageDetails = Description,
      Severity = SeverityDescription  
severity: High
relevantTechniques: []

ARM