Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Veeam ONE Unusual Job Duration Veeam Backup for Microsoft 365

Back
Idcab7396a-9a18-45e7-b685-945e8bf825cb
RulenameVeeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)
DescriptionDetects Veeam Backup for Microsoft 365 jobs with unusual execution duration.
SeverityMedium
TacticsImpact
TechniquesT1490
Required data connectorsVeeamCustomTablesDataConnector
KindScheduled
Query frequency3h
Query period3h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365.yaml
Version1.0.0
Arm templatecab7396a-9a18-45e7-b685-945e8bf825cb.json
Deploy To Azure
VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365.yaml
triggerThreshold: 0
severity: Medium
queryFrequency: 3h
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  TriggeredAlarmId: TriggeredAlarmId
  Status: Status
  Comment: Comment
  ObjectName: ObjectName
  Description: Description
  VoneHostName: VoneHostName
  ObjectType: ObjectType
  Name: Name
  PredefinedAlarmId: PredefinedAlarmId
  TriggeredTime: TriggeredTime
  ObjectId: ObjectId
relevantTechniques:
- T1490
triggerOperator: gt
id: cab7396a-9a18-45e7-b685-945e8bf825cb
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
version: 1.0.0
name: Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)
tactics:
- Impact
description: Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration.
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381
status: Available
queryPeriod: 3h
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cab7396a-9a18-45e7-b685-945e8bf825cb')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cab7396a-9a18-45e7-b685-945e8bf825cb')]",
      "properties": {
        "alertRuleTemplateName": "cab7396a-9a18-45e7-b685-945e8bf825cb",
        "customDetails": {
          "Comment": "Comment",
          "Description": "Description",
          "Name": "Name",
          "ObjectId": "ObjectId",
          "ObjectName": "ObjectName",
          "ObjectType": "ObjectType",
          "PredefinedAlarmId": "PredefinedAlarmId",
          "Status": "Status",
          "TriggeredAlarmId": "TriggeredAlarmId",
          "TriggeredTime": "TriggeredTime",
          "VoneHostName": "VoneHostName"
        },
        "description": "Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration.",
        "displayName": "Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365.yaml",
        "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1490"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}