Detection rules › Kusto

Veeam ONE Unusual Job Duration

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: medium
Time window: 3h
Source: github.com/Azure/Azure-Sentinel

Detects Veeam ONE unusual job duration alerts.

Rule body

id: 04530ba4-b26e-4a83-8057-a4fc286de848
name: Veeam ONE Unusual Job Duration
description: Detects Veeam ONE unusual job duration alerts.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 369
version: 1.0.1
kind: Scheduled
customDetails:
  PredefinedAlarmId: PredefinedAlarmId
  TriggeredAlarmId: TriggeredAlarmId
  Description: Description
  Name: Name
  VoneHostName: VoneHostName
  TriggeredTime: TriggeredTime
  Status: Status
  Comment: Comment
  ObjectId: ObjectId
  ObjectName: ObjectName
  ObjectType: ObjectType

Stages and Predicates

Stage 1: `source`

VeeamOneTriggeredAlarms_CL

Stage 2: `where`

| where PredefinedAlarmId == 369

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`PredefinedAlarmId`	eq	`369`	`field:"PredefinedAlarmId" kind:eq value:"369"`