Configuration Backup Failed

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.

Rule body

id: 259ef474-836d-4662-86ef-70cb7a38e765
name: Configuration Backup Failed
description: Detects failed configuration backup operations. This might indicate
  system or storage issues, or a potential sabotage of the backup infrastructure.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: VeeamCustomTablesDataConnector
    dataTypes:
      - VeeamSessions_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query:
  VeeamSessions_CL | where SessionType == "ConfigurationBackup" and ResultStatus == "Failed" | project
  TimeGenerated,
  VbrHostName,
  SessionId = Id,
  SessionType,
  Name,
  Result = ResultStatus
version: 1.0.2
kind: Scheduled
customDetails:
  VbrHostName: VbrHostName
  SessionId: SessionId
  SessionType: SessionType
  Name: Name
  Result: Result

Stages and Predicates

Stage 1: `source`

VeeamSessions_CL

Stage 2: `where`

| where SessionType == "ConfigurationBackup" and ResultStatus == "Failed"

Stage 3: `project`

| project TimeGenerated, VbrHostName, SessionId = Id, SessionType, Name, Result = ResultStatus

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ResultStatus`	eq	`Failed`	`field:"ResultStatus" kind:eq value:"Failed"`
`SessionType`	eq	`ConfigurationBackup`	`field:"SessionType" kind:eq value:"ConfigurationBackup"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Name`	`project`
`Result`	`project`
`SessionId`	`project`
`SessionType`	`project`
`TimeGenerated`	`project`
`VbrHostName`	`project`