Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Objects Deleted from Malware Detection Exclusions

Back
Idf4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca
RulenameObjects Deleted from Malware Detection Exclusions
DescriptionDetects when an object is deleted from malware detection exclusions.
SeverityInformational
TacticsImpact
TechniquesT1485
T1486
Required data connectorsSyslog
SyslogAma
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml
Version1.0.0
Arm templatef4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca.json
Deploy To Azure
Veeam_GetSecurityEvents
| where instanceId == 42270
| extend RemovedObjectNames = extract("RemovedObjectNames=\"([^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["User Name"] = user,
    ["Object Names"] = RemovedObjectNames,
    MessageDetails = Description,
   Severity = SeverityDescription
tactics:
- Impact
name: Objects Deleted from Malware Detection Exclusions
id: f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 42270
  | extend RemovedObjectNames = extract("RemovedObjectNames=\"([^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["User Name"] = user,
      ["Object Names"] = RemovedObjectNames,
      MessageDetails = Description,
     Severity = SeverityDescription  
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:
- T1485
- T1486
description: Detects when an object is deleted from malware detection exclusions.
triggerOperator: gt
queryPeriod: 1d
severity: Informational
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml
version: 1.0.0
triggerThreshold: 0
kind: Scheduled
queryFrequency: 1d
status: Available
customDetails:
  VbrHostName: DataSource
  EventId: EventId
  Severity: Severity
  Date: Date
  MessageDetails: MessageDetails
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca')]",
      "properties": {
        "alertRuleTemplateName": "f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca",
        "customDetails": {
          "Date": "Date",
          "EventId": "EventId",
          "MessageDetails": "MessageDetails",
          "Severity": "Severity",
          "VbrHostName": "DataSource"
        },
        "description": "Detects when an object is deleted from malware detection exclusions.",
        "displayName": "Objects Deleted from Malware Detection Exclusions",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml",
        "query": "Veeam_GetSecurityEvents\n| where instanceId == 42270\n| extend RemovedObjectNames = extract(\"RemovedObjectNames=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n    EventId = instanceId,\n    [\"User Name\"] = user,\n    [\"Object Names\"] = RemovedObjectNames,\n    MessageDetails = Description,\n   Severity = SeverityDescription",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1486"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}