Microsoft Sentinel high experimental kql

SureBackup Job Failed

Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure.

View Source

Detection Logic

Veeam_GetJobFinished
| where instanceId == 390
| project
    Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),
    DataSource = original_host,
    EventId = instanceId,
    ["StateMessage"] = JobTypeDescription,
    ["State"] = JobResultMessage,
    Severity = Severity,
    MessageDetails = Description

Field Validations

Loading…

Comments (0)

Loading comments...