detection.wiki

Detection rules › Kusto

Best Practice Compliance Check Not Passed

Status
available
Severity
medium
Time window
5m
Source
github.com/Azure/Azure-Sentinel

Detects when a security best practice does not pass a compliance check in Veeam Security & Compliance Analyzer.

Rule body

id: f920ac64-dfd0-4dea-9b7c-acecf1ea2b28
name: Best Practice Compliance Check Not Passed
description: Detects when a security best practice does not pass a compliance check
  in Veeam Security & Compliance Analyzer.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: VeeamCustomTablesDataConnector
  dataTypes:
  - VeeamSecurityComplianceAnalyzer_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "VeeamSecurityComplianceAnalyzer_CL\r\n| where Status != \"OK\""
version: 1.0.1
kind: Scheduled
customDetails:
  VbrHostName: VbrHostName
  Status: Status
  BestPracticeName: BestPractice
  TenantId: TenantId
  Id: Id
  Note: Note

Stages and Predicates

Stage 1: source

VeeamSecurityComplianceAnalyzer_CL

Stage 2: where

| where Status != "OK"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Statusne
  • OK
field:"Status" kind:ne value:"OK"