Failover Plan Stopped

Back


Id	de4cc05b-2e4e-4104-9559-101b4c41c35e
Rulename	Failover Plan Stopped
Description	Detects when a failover plan stops. This might indicate disaster recovery activity or issues with primary systems.
Severity	Medium
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Stopped.yaml
Version	1.0.1
Arm template	de4cc05b-2e4e-4104-9559-101b4c41c35e.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 26700
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
 MessageDetails = Description,
   Severity = SeverityDescription

YAML

customDetails:
  MessageDetails: MessageDetails
  Severity: Severity
  VbrHostName: DataSource
  Date: Date
  EventId: EventId
name: Failover Plan Stopped
relevantTechniques: []
id: de4cc05b-2e4e-4104-9559-101b4c41c35e
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Stopped.yaml
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: Syslog
- dataTypes:
  - Syslog
  connectorId: SyslogAma
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.1
severity: Medium
triggerThreshold: 0
queryPeriod: 3h
queryFrequency: 3h
status: Available
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 26700
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      UserName = user,
   MessageDetails = Description,
     Severity = SeverityDescription  
tactics: []
kind: Scheduled
description: Detects when a failover plan stops. This might indicate disaster recovery activity or issues with primary systems.
triggerOperator: gt

ARM