Detection rules › Kusto

Veeam ONE Backup Server Security and Compliance State

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: medium
Time window: 3h
Source: github.com/Azure/Azure-Sentinel

Detects backup server security and compliance state issues.

Rule body

id: 7ad4b9ff-8089-4b70-b98e-a2ca995611e9
name: Veeam ONE Backup Server Security and Compliance State
description: Detects backup server security and compliance state issues.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395
version: 1.0.1
kind: Scheduled
customDetails:
  PredefinedAlarmId: PredefinedAlarmId
  TriggeredAlarmId: TriggeredAlarmId
  Description: Description
  Name: Name
  VoneHostName: VoneHostName
  TriggeredTime: TriggeredTime
  Status: Status
  Comment: Comment
  ObjectId: ObjectId
  ObjectName: ObjectName
  ObjectType: ObjectType

Stages and Predicates

Stage 1: `source`

VeeamOneTriggeredAlarms_CL

Stage 2: `where`

| where PredefinedAlarmId == 395

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`PredefinedAlarmId`	eq	`395`	`field:"PredefinedAlarmId" kind:eq value:"395"`