Objects for Protection Group Changed

Back


Id	af97a601-8fac-4628-bdad-5fc0511236b2
Rulename	Objects for Protection Group Changed
Description	Detects when protection group objects are updated.
Severity	Informational
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_for_Protection_Group_Changed.yaml
Version	1.0.1
Arm template	af97a601-8fac-4628-bdad-5fc0511236b2.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 29140
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
  MessageDetails = Description,
    Severity = SeverityDescription

YAML

customDetails:
  MessageDetails: MessageDetails
  Severity: Severity
  VbrHostName: DataSource
  Date: Date
  EventId: EventId
name: Objects for Protection Group Changed
relevantTechniques: []
id: af97a601-8fac-4628-bdad-5fc0511236b2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_for_Protection_Group_Changed.yaml
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: Syslog
- dataTypes:
  - Syslog
  connectorId: SyslogAma
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.1
severity: Informational
triggerThreshold: 0
queryPeriod: 1d
queryFrequency: 1d
status: Available
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 29140
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      UserName = user,
    MessageDetails = Description,
      Severity = SeverityDescription  
tactics: []
kind: Scheduled
description: Detects when protection group objects are updated.
triggerOperator: gt

ARM