Objects Deleted from Malware Detection Exclusions

Back


Id	f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca
Rulename	Objects Deleted from Malware Detection Exclusions
Description	Detects when an object is deleted from malware detection exclusions.
Severity	Informational
Required data connectors	Syslog SyslogAma
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml
Version	1.0.1
Arm template	f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca.json

KQL

Veeam_GetSecurityEvents
| where instanceId == 42270
| extend RemovedObjectNames = extract("RemovedObjectNames=\"([^\"]*)\"", 1, SyslogMessage)
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["User Name"] = user,
    ["Object Names"] = RemovedObjectNames,
    MessageDetails = Description,
   Severity = SeverityDescription

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml
queryPeriod: 1d
description: Detects when an object is deleted from malware detection exclusions.
triggerThreshold: 0
name: Objects Deleted from Malware Detection Exclusions
triggerOperator: gt
kind: Scheduled
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
customDetails:
  MessageDetails: MessageDetails
  EventId: EventId
  VbrHostName: DataSource
  Date: Date
  Severity: Severity
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 1d
tactics: []
id: f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca
status: Available
version: 1.0.1
query: |-
  Veeam_GetSecurityEvents
  | where instanceId == 42270
  | extend RemovedObjectNames = extract("RemovedObjectNames=\"([^\"]*)\"", 1, SyslogMessage)
  | project
      Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
      DataSource = original_host,
      EventId = instanceId,
      ["User Name"] = user,
      ["Object Names"] = RemovedObjectNames,
      MessageDetails = Description,
     Severity = SeverityDescription  
severity: Informational
relevantTechniques: []

ARM