Microsoft Sentinel high experimental kql

Configuration Backup Failed

Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.

View Source

Detection Logic

VeeamSessions_CL
| where SessionType == "ConfigurationBackup" and ResultStatus == "Failed"
| project TimeGenerated, VbrHostName, SessionId = Id, SessionType, Name, Result = ResultStatus

Field Validations

Loading…

Comments (0)

Loading comments...