Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Objects Deleted from Malware Detection Exclusions

Back
Idf4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca
RulenameObjects Deleted from Malware Detection Exclusions
DescriptionDetects when an object is deleted from malware detection exclusions.
SeverityInformational
TacticsImpact
TechniquesT1485
T1486
Required data connectorsSyslog
SyslogAma
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml
Version1.0.0
Arm templatef4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca.json
Deploy To Azure
Veeam_GetSecurityEvents
| where instanceId == 42270
| extend RemovedObjectNames = extract("RemovedObjectNames=\"([^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["User Name"] = user,
    ["Object Names"] = RemovedObjectNames,
    MessageDetails = Description,
   Severity = SeverityDescription
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml
triggerThreshold: 0
severity: Informational
queryFrequency: 1d
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  EventId: EventId
  Date: Date
  Severity: Severity
  MessageDetails: MessageDetails
  VbrHostName: DataSource
relevantTechniques:
- T1485
- T1486
triggerOperator: gt
id: f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
version: 1.0.0
name: Objects Deleted from Malware Detection Exclusions
tactics:
- Impact
description: Detects when an object is deleted from malware detection exclusions.
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 42270
  | extend RemovedObjectNames = extract("RemovedObjectNames=\"([^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["User Name"] = user,
      ["Object Names"] = RemovedObjectNames,
      MessageDetails = Description,
     Severity = SeverityDescription  
status: Available
queryPeriod: 1d
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca')]",
      "properties": {
        "alertRuleTemplateName": "f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects when an object is deleted from malware detection exclusions.",
        "displayName": "Objects Deleted from Malware Detection Exclusions",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml",
        "query": "Veeam_GetSecurityEvents\n| where instanceId == 42270\n| extend RemovedObjectNames = extract(\"RemovedObjectNames=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    [\"User Name\"] = user,\n    [\"Object Names\"] = RemovedObjectNames,\n    MessageDetails = Description,\n   Severity = SeverityDescription",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1486"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}