SureBackup Job Failed | Microsoft Sentinel Analytic Rules

Back


Id	b7409bbb-6f0c-43c4-bb63-b20add5eb717
Rulename	SureBackup Job Failed
Description	Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure.
Severity	High
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/SureBackup_Job_Failed.yaml
Version	1.0.1
Arm template	b7409bbb-6f0c-43c4-bb63-b20add5eb717.json

KQL

Veeam_GetJobFinished
| where instanceId == 390
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["StateMessage"] = JobTypeDescription,
    ["State"] = JobResultMessage,
    Severity = Severity,
    MessageDetails = Description

YAML

name: SureBackup Job Failed
triggerOperator: gt
query: |-
  Veeam_GetJobFinished
  | where instanceId == 390
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["StateMessage"] = JobTypeDescription,
      ["State"] = JobResultMessage,
      Severity = Severity,
      MessageDetails = Description
queryFrequency: 3h
description: Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure.
id: b7409bbb-6f0c-43c4-bb63-b20add5eb717
triggerThreshold: 0
queryPeriod: 3h
version: 1.0.1
kind: Scheduled
customDetails:
  VbrHostName: DataSource
  Severity: Severity
  EventId: EventId
  Date: Date
  MessageDetails: MessageDetails
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/SureBackup_Job_Failed.yaml
relevantTechniques: []
tactics: []

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b7409bbb-6f0c-43c4-bb63-b20add5eb717')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b7409bbb-6f0c-43c4-bb63-b20add5eb717')]",
      "properties": {
        "alertRuleTemplateName": "b7409bbb-6f0c-43c4-bb63-b20add5eb717",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure.",
        "displayName": "SureBackup Job Failed",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic%20Rules/SureBackup_Job_Failed.yaml",
        "query": "Veeam_GetJobFinished\n| where instanceId == 390\n| project\n    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    [\"StateMessage\"] = JobTypeDescription,\n    [\"State\"] = JobResultMessage,\n    Severity = Severity,\n    MessageDetails = Description",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}