Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Veeam ONE Unusual Job Duration Veeam Backup for Microsoft 365

Back
Idcab7396a-9a18-45e7-b685-945e8bf825cb
RulenameVeeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)
DescriptionDetects Veeam Backup for Microsoft 365 jobs with unusual execution duration.
SeverityMedium
TacticsImpact
TechniquesT1490
Required data connectorsVeeamCustomTablesDataConnector
KindScheduled
Query frequency3h
Query period3h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365.yaml
Version1.0.0
Arm templatecab7396a-9a18-45e7-b685-945e8bf825cb.json
Deploy To Azure
VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381
tactics:
- Impact
name: Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)
id: cab7396a-9a18-45e7-b685-945e8bf825cb
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:
- T1490
description: Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration.
triggerOperator: gt
queryPeriod: 3h
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365.yaml
version: 1.0.0
triggerThreshold: 0
kind: Scheduled
queryFrequency: 3h
status: Available
customDetails:
  Name: Name
  ObjectType: ObjectType
  TriggeredTime: TriggeredTime
  TriggeredAlarmId: TriggeredAlarmId
  VoneHostName: VoneHostName
  Comment: Comment
  PredefinedAlarmId: PredefinedAlarmId
  Status: Status
  Description: Description
  ObjectId: ObjectId
  ObjectName: ObjectName
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cab7396a-9a18-45e7-b685-945e8bf825cb')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cab7396a-9a18-45e7-b685-945e8bf825cb')]",
      "properties": {
        "alertRuleTemplateName": "cab7396a-9a18-45e7-b685-945e8bf825cb",
        "customDetails": {
          "Comment": "Comment",
          "Description": "Description",
          "Name": "Name",
          "ObjectId": "ObjectId",
          "ObjectName": "ObjectName",
          "ObjectType": "ObjectType",
          "PredefinedAlarmId": "PredefinedAlarmId",
          "Status": "Status",
          "TriggeredAlarmId": "TriggeredAlarmId",
          "TriggeredTime": "TriggeredTime",
          "VoneHostName": "VoneHostName"
        },
        "description": "Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration.",
        "displayName": "Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365.yaml",
        "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381",
        "queryFrequency": "PT3H",
        "queryPeriod": "PT3H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1490"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}