Failover Plan Started

Back


Id	e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0
Rulename	Failover Plan Started
Description	Detects when a failover plan starts. This might indicate disaster recovery activity or issues with primary systems.
Severity	High
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Started.yaml
Version	1.0.1
Arm template	e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 26600
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    UserName = user,
  MessageDetails = Description,
    Severity = SeverityDescription

YAML

queryPeriod: 5m
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 26600
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      UserName = user,
    MessageDetails = Description,
      Severity = SeverityDescription  
name: Failover Plan Started
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Failover_Plan_Started.yaml
description: Detects when a failover plan starts. This might indicate disaster recovery activity or issues with primary systems.
kind: Scheduled
version: 1.0.1
status: Available
severity: High
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
triggerOperator: gt
triggerThreshold: 0
customDetails:
  EventId: EventId
  MessageDetails: MessageDetails
  VbrHostName: DataSource
  Date: Date
  Severity: Severity
tactics: []
id: e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0
relevantTechniques: []

ARM