Detection rules › Kusto
Configuration Backup Job Failed
Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.
Rule body kusto
id: 18833d01-703a-438d-8ac6-84faa82e9b52
name: Configuration Backup Job Failed
description: Detects failed configuration backup operations. This might indicate
system or storage issues, or a potential sabotage of the backup infrastructure.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Syslog
dataTypes:
- Syslog
- connectorId: SyslogAma
dataTypes:
- Syslog
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "Veeam_GetFinishedConfigurationBackupSessions\r\n| where Result == \"Failed\"\
\r\n| project\r\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\r\
\n DataSource = Computer,\r\n EventId = instanceId,\r\n UserName = user,\r\
\n [\"State\"] = Result,\r\n MessageDetails = Description"
version: 1.0.1
kind: Scheduled
customDetails:
Date: Date
DataSource: DataSource
EventId: EventId
MessageDetails: MessageDetails
Stages and Predicates
Stage 1: source
Veeam_GetFinishedConfigurationBackupSessions
Stage 2: where
| where Result == "Failed"
Stage 3: project
| project
Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
DataSource = Computer,
EventId = instanceId,
UserName = user,
["State"] = Result,
MessageDetails = Description
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Result | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
DataSource | project |
Date | project |
EventId | project |
MessageDetails | project |
State | project |
UserName | project |