Detection rules › Kusto

Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: medium
Time window: 3h
Source: github.com/Azure/Azure-Sentinel

Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration.

Rule body

id: cab7396a-9a18-45e7-b685-945e8bf825cb
name: Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)
description: Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamOneTriggeredAlarms_CL
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381
version: 1.0.1
kind: Scheduled
customDetails:
  PredefinedAlarmId: PredefinedAlarmId
  TriggeredAlarmId: TriggeredAlarmId
  Description: Description
  Name: Name
  VoneHostName: VoneHostName
  TriggeredTime: TriggeredTime
  Status: Status
  Comment: Comment
  ObjectId: ObjectId
  ObjectName: ObjectName
  ObjectType: ObjectType

Stages and Predicates

Stage 1: `source`

VeeamOneTriggeredAlarms_CL

Stage 2: `where`

| where PredefinedAlarmId == 381

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`PredefinedAlarmId`	eq	`381`	`field:"PredefinedAlarmId" kind:eq value:"381"`