↳ GitHub sourceConnector

Veeam Data Connector (using Azure Functions)

Description

Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel. The connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE). **Custom Tables Included:** - **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication - **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components - **VeeamAuthorizationEvents_CL**: Authorization and authentication events - **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers - **VeeamCovewareFindings_CL**: Security findings from Coveware solution - **VeeamSessions_CL**: Veeam sessions

Declared status: 1
Declared author / publisher: Veeam

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

VeeamMalwareEvents_CL VeeamSecurityComplianceAnalyzer_CL VeeamAuthorizationEvents_CL VeeamOneTriggeredAlarms_CL VeeamCovewareFindings_CL VeeamSessions_CL

Declared permissions

read and write permissions on the workspace are required.

Workspace

Workspace

read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).

Keys

Workspace

Microsoft.Web/sites permissions

Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/).

Veeam Infrastructure Access

Access to Veeam Backup & Replication REST API and Veeam ONE monitoring platform is required. This includes proper authentication credentials and network connectivity.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

>**NOTE:** This connector uses Azure Functions to connect to Veeam APIs and pull data into Microsoft Sentinel custom tables. This may result in additional data ingestion costs. See the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.

**STEP 1 - Select the deployment option for Veeam Data Connector and associated Azure Functions** >**IMPORTANT:** Before you deploy Veeam Data Connector, prepare Workspace Name (can be copied from the following).

Workspace Name

Azure Resource Manager (ARM) Template

Use this method for automated deployment of the Veeam data connector using an ARM Template. 1. Click the **Deploy to Azure** button below. [![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FVeeam%2FData%2520Connectors%2Fazuredeploy_Veeam_API_FunctionApp.json) 2. Select the preferred **Subscription**, **Resource Group** and **Location**. 3. Enter the **Microsoft Sentinel Workspace Name**. 4. Click **Review + Create**, **Create**.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Veeam/Data Connectors/Veeam_API_FunctionApp.json ↗
Commit: 9800e51 ↗
Source identifier: VeeamCustomTablesDataConnector

Additional source files 1

Solutions/Veeam/Data Connectors/Veeam_API_FunctionApp.jsonsource ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.