Best Practice Compliance Check Not Passed

Back


Id	f920ac64-dfd0-4dea-9b7c-acecf1ea2b28
Rulename	Best Practice Compliance Check Not Passed
Description	Detects when a security best practice does not pass a compliance check in Veeam Security & Compliance Analyzer.
Severity	Medium
Required data connectors	VeeamCustomTablesDataConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Best_Practice_Compliance_Check_Not_Passed.yaml
Version	1.0.1
Arm template	f920ac64-dfd0-4dea-9b7c-acecf1ea2b28.json

KQL

VeeamSecurityComplianceAnalyzer_CL
| where Status != "OK"

YAML

name: Best Practice Compliance Check Not Passed
id: f920ac64-dfd0-4dea-9b7c-acecf1ea2b28
description: Detects when a security best practice does not pass a compliance check in Veeam Security & Compliance Analyzer.
triggerThreshold: 0
version: 1.0.1
triggerOperator: gt
query: |-
  VeeamSecurityComplianceAnalyzer_CL
  | where Status != "OK"  
tactics: []
kind: Scheduled
queryFrequency: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Veeam/Analytic Rules/Best_Practice_Compliance_Check_Not_Passed.yaml
severity: Medium
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - VeeamSecurityComplianceAnalyzer_CL
  connectorId: VeeamCustomTablesDataConnector
status: Available
customDetails:
  Note: Note
  VbrHostName: VbrHostName
  BestPracticeName: BestPractice
  Id: Id
  TenantId: TenantId
  Status: Status
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: []

ARM