Malware Detection Settings Updated

Back


Id	effd8410-3119-41c8-a228-9c0c8ce10d67
Rulename	Malware Detection Settings Updated
Description	Detects when malware detection settings are updated.
Severity	High
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Malware_Detection_Settings_Updated.yaml
Version	1.0.1
Arm template	effd8410-3119-41c8-a228-9c0c8ce10d67.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 42290
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["User Name"] = user,
  MessageDetails = Description,
   Severity = SeverityDescription

YAML

name: Malware Detection Settings Updated
id: effd8410-3119-41c8-a228-9c0c8ce10d67
description: Detects when malware detection settings are updated.
triggerThreshold: 0
version: 1.0.1
triggerOperator: gt
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 42290
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["User Name"] = user,
    MessageDetails = Description,
     Severity = SeverityDescription  
tactics: []
kind: Scheduled
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Malware_Detection_Settings_Updated.yaml
severity: High
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: Syslog
- dataTypes:
  - Syslog
  connectorId: SyslogAma
status: Available
customDetails:
  VbrHostName: DataSource
  Severity: Severity
  Date: Date
  MessageDetails: MessageDetails
  EventId: EventId
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: []

ARM