{ "Name": "Veeam", "Author": "Veeam Software - microsoftappsupport@veeam.com", "Logo": "", "Description": "Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\nc. [Azure Key Vault](https://azure.microsoft.com/products/key-vault/)\n\nd. [Azure Storage Account](https://azure.microsoft.com/products/storage/)\n\ne. [Azure Relays](https://azure.microsoft.com/products/service-bus/)\n\nf. [Azure Logic Apps](https://azure.microsoft.com/products/logic-apps/)\n\ng. [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview)", "DataConnectors": [ "Data Connectors/Veeam_API_FunctionApp.json" ], "Playbooks": [ "Playbooks/Veeam-ChangeCollectionTime/ChangeCollectionTime.json", "Playbooks/Veeam-CollectVeeamAuthorizationEvents/CollectVeeamAuthorizationEventsPlaybook.json", "Playbooks/Veeam-CollectSecurityComplianceAnalyzerResult/Veeam-CollectSecurityComplianceAnalyzerResult.json", "Playbooks/Veeam-CollectMalwareEvents/CollectMalwareEventsPlaybook.json", "Playbooks/Veeam-CollectVoneAlarms/CollectVoneAlarmsPlaybook.json", "Playbooks/Veeam-CollectCovewareFindings/CollectCovewareFindingsPlaybook.json", "Playbooks/Veeam-CollectConfigurationBackups/Veeam-CollectConfigurationBackups.json", "Playbooks/Veeam-FindCleanRestorePoints/FindCleanRestorePoints.json", "Playbooks/Veeam-PerformScanBackup/PerformScanBackup.json", "Playbooks/Veeam-PerformInstantVMRecovery/PerformInstantVMRecovery.json", "Playbooks/Veeam-ResolveTriggeredAlarm/ResolveTriggeredAlarm.json", "Playbooks/Veeam-StartSecurityComplianceAnalyzer/Veeam-StartSecurityComplianceAnalyzer.json", "Playbooks/Veeam-PerformConfigurationBackupOnIncident/Veeam-PerformConfigurationBackupOnIncident.json", "Playbooks/Veeam-StartQuickBackup/StartQuickBackup.json", "Playbooks/Veeam-SetupConnectionsPlaybook/SetupConnectionsPlaybook.json" ], "Watchlists": [ "Watchlists/JobTypesLookup/job_types_lookup.json", "Watchlists/LicenseEditionsLookup/license_editions_lookup.json", "Watchlists/LicenseTypesLookup/license_types_lookup.json", "Watchlists/OperationNamesLookup/operation_names_lookup.json", "Watchlists/SessionStatesLookup/session_states_lookup.json", "Watchlists/VBREventsLookup/vbr_events_lookup.json", "Watchlists/ActionResultsLookup/action_results_lookup.json", "Watchlists/VeeamBackupReplicationSettings/vbr_settings.json", "Watchlists/VONESettings/vone_settings.json", "Watchlists/CovewareSettings/coveware_settings.json", "Watchlists/VeeamCollectionScheduleSettings/collection_schedule_settings.json" ], "Parsers": [ "Parsers/Veeam_GetJobFinished.yaml", "Parsers/Veeam_GetVeeamONEAlarms.yaml", "Parsers/Veeam_GetFinishedConfigurationBackupSessions.yaml", "Parsers/Veeam_GetSecurityEvents.yaml" ], "AnalyticsRules": [ "Analytic Rules/Adding_User_or_Group_Failed.yaml", "Analytic Rules/Application_Group_Deleted.yaml", "Analytic Rules/Application_Group_Settings_Updated.yaml", "Analytic Rules/Archive_Repository_Deleted.yaml", "Analytic Rules/Archive_Repository_Settings_Updated.yaml", "Analytic Rules/Attempt_to_Delete_Backup_Failed.yaml", "Analytic Rules/Attempt_to_Update_Security_Object_Failed.yaml", "Analytic Rules/Backup_Proxy_Deleted.yaml", "Analytic Rules/Backup_Repository_Deleted.yaml", "Analytic Rules/Backup_Repository_Settings_Updated.yaml", "Analytic Rules/Cloud_Gateway_Deleted.yaml", "Analytic Rules/Cloud_Gateway_Pool_Deleted.yaml", "Analytic Rules/Cloud_Gateway_Pool_Settings_Updated.yaml", "Analytic Rules/Cloud_Gateway_Settings_Updated.yaml", "Analytic Rules/Cloud_Replica_Permanent_Failover_Performed_by_Tenant.yaml", "Analytic Rules/Configuration_Backup_Job_Failed.yaml", "Analytic Rules/Configuration_Backup_Job_Settings_Updated.yaml", "Analytic Rules/Connection_to_Backup_Repository_Lost.yaml", "Analytic Rules/Credential_Record_Deleted.yaml", "Analytic Rules/Credential_Record_Updated.yaml", "Analytic Rules/Detaching_Backups_Started.yaml", "Analytic Rules/Encryption_Password_Added.yaml", "Analytic Rules/Encryption_Password_Changed.yaml", "Analytic Rules/Encryption_Password_Deleted.yaml", "Analytic Rules/External_Repository_Deleted.yaml", "Analytic Rules/External_Repository_Settings_Updated.yaml", "Analytic Rules/Failover_Plan_Deleted.yaml", "Analytic Rules/Failover_Plan_Failed.yaml", "Analytic Rules/Failover_Plan_Settings_Updated.yaml", "Analytic Rules/Failover_Plan_Started.yaml", "Analytic Rules/Failover_Plan_Stopped.yaml", "Analytic Rules/File_Server_Deleted.yaml", "Analytic Rules/File_Server_Settings_Updated.yaml", "Analytic Rules/File_Share_Deleted.yaml", "Analytic Rules/Four_Eyes_Authorization_Disabled.yaml", "Analytic Rules/Four_Eyes_Authorization_Request_Created.yaml", "Analytic Rules/Four_Eyes_Authorization_Request_Expired.yaml", "Analytic Rules/Four_Eyes_Authorization_Request_Rejected.yaml", "Analytic Rules/General_Settings_Updated.yaml", "Analytic Rules/Global_Network_Traffic_Rules_Deleted.yaml", "Analytic Rules/Global_VM_Exclusions_Added.yaml", "Analytic Rules/Global_VM_Exclusions_Changed.yaml", "Analytic Rules/Global_VM_Exclusions_Deleted.yaml", "Analytic Rules/Host_Deleted.yaml", "Analytic Rules/Host_Settings_Updated.yaml", "Analytic Rules/Hypervisor_Host_Deleted.yaml", "Analytic Rules/Hypervisor_Host_Settings_Updated.yaml", "Analytic Rules/Invalid_Code_for_Multi_Factor_Authentication_Entered.yaml", "Analytic Rules/Job_Deleted.yaml", "Analytic Rules/Job_No_Longer_Used_as_Second_Destination.yaml", "Analytic Rules/KMS_Key_Rotation_Job_Finished.yaml", "Analytic Rules/KMS_Server_Deleted.yaml", "Analytic Rules/KMS_Server_Settings_Updated.yaml", "Analytic Rules/License_Expired.yaml", "Analytic Rules/License_Expiring.yaml", "Analytic Rules/License_Grace_Period_Started.yaml", "Analytic Rules/License_Limit_Exceeded.yaml", "Analytic Rules/License_Removed.yaml", "Analytic Rules/License_Support_Expired.yaml", "Analytic Rules/License_Support_Expiring.yaml", "Analytic Rules/Malware_Activity_Detected.yaml", "Analytic Rules/Malware_Detection_Exclusions_List_Updated.yaml", "Analytic Rules/Malware_Detection_Session_Finished.yaml", "Analytic Rules/Malware_Detection_Settings_Updated.yaml", "Analytic Rules/Malware_Event_Detected.yaml", "Analytic Rules/Multi_Factor_Authentication_Disabled.yaml", "Analytic Rules/Multi_Factor_Authentication_for_User_Disabled.yaml", "Analytic Rules/Multi_Factor_Authentication_Token_Revoked.yaml", "Analytic Rules/Multi_Factor_Authentication_User_Locked.yaml", "Analytic Rules/NDMP_Server_Deleted.yaml", "Analytic Rules/Object_Marked_as_Clean.yaml", "Analytic Rules/Object_Storage_Deleted.yaml", "Analytic Rules/Object_Storage_Settings_Updated.yaml", "Analytic Rules/Objects_Added_to_Malware_Detection_Exclusions.yaml", "Analytic Rules/Objects_Deleted_from_Malware_Detection_Exclusions.yaml", "Analytic Rules/Objects_for_Job_Deleted.yaml", "Analytic Rules/Objects_for_Protection_Group_Changed.yaml", "Analytic Rules/Objects_for_Protection_Group_Deleted.yaml", "Analytic Rules/Preferred_Networks_Deleted.yaml", "Analytic Rules/Protection_Group_Deleted.yaml", "Analytic Rules/Protection_Group_Settings_Updated.yaml", "Analytic Rules/Recovery_Token_Deleted.yaml", "Analytic Rules/Restore_Point_Marked_as_Clean.yaml", "Analytic Rules/Restore_Point_Marked_as_Infected.yaml", "Analytic Rules/Scale_Out_Backup_Repository_Deleted.yaml", "Analytic Rules/Scale_Out_Backup_Repository_Settings_Updated.yaml", "Analytic Rules/Service_Provider_Deleted.yaml", "Analytic Rules/Service_Provider_Updated.yaml", "Analytic Rules/SSH_Credentials_Changed.yaml", "Analytic Rules/Storage_Deleted.yaml", "Analytic Rules/Storage_Settings_Updated.yaml", "Analytic Rules/Subtenant_Deleted.yaml", "Analytic Rules/Subtenant_Updated.yaml", "Analytic Rules/SureBackup_Job_Failed.yaml", "Analytic Rules/Tape_Erase_Job_Started.yaml", "Analytic Rules/Tape_Library_Deleted.yaml", "Analytic Rules/Tape_Media_Pool_Deleted.yaml", "Analytic Rules/Tape_Media_Vault_Deleted.yaml", "Analytic Rules/Tape_Medium_Deleted.yaml", "Analytic Rules/Tape_Server_Deleted.yaml", "Analytic Rules/Tenant_Password_Changed.yaml", "Analytic Rules/Tenant_Quota_Changed.yaml", "Analytic Rules/Tenant_Quota_Deleted.yaml", "Analytic Rules/Tenant_Replica_Started.yaml", "Analytic Rules/Tenant_Replica_Stopped.yaml", "Analytic Rules/Tenant_State_Changed.yaml", "Analytic Rules/User_or_Group_Added.yaml", "Analytic Rules/User_or_Group_Deleted.yaml", "Analytic Rules/Best_Practice_Compliance_Check_Not_Passed.yaml", "Analytic Rules/Veeam_One_Application_with_no_recent_data_backup_sessions.yaml", "Analytic Rules/Veeam_One_Backup_Copy_RPO.yaml", "Analytic Rules/Veeam_One_Backup_server_security_&_compliance_state.yaml", "Analytic Rules/Veeam_One_Computer_with_no_backup.yaml", "Analytic Rules/Veeam_One_Immutability_change_tracking.yaml", "Analytic Rules/Veeam_One_Immutability_state.yaml", "Analytic Rules/Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365.yaml", "Analytic Rules/Veeam_One_Job_disabled.yaml", "Analytic Rules/Veeam_One_Possible_ransomware_activity_Hyper_V.yaml", "Analytic Rules/Veeam_One_Possible_ransomware_activity_vSphere.yaml", "Analytic Rules/Veeam_One_Suspicious_incremental_backup_size.yaml", "Analytic Rules/Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365.yaml", "Analytic Rules/Veeam_One_Unusual_job_duration.yaml", "Analytic Rules/Veeam_One_Veeam_malware_detection_change_tracking.yaml", "Analytic Rules/Veeam_One_VM_with_no_backup_Hyper_V.yaml", "Analytic Rules/Veeam_One_VM_with_no_backup.yaml", "Analytic Rules/Veeam_One_VM_with_no_replica_Hyper_V.yaml", "Analytic Rules/Veeam_One_VM_with_no_replica.yaml", "Analytic Rules/Virtual_Lab_Deleted.yaml", "Analytic Rules/Virtual_Lab_Settings_Updated.yaml", "Analytic Rules/WAN_Accelerator_Deleted.yaml", "Analytic Rules/WAN_Accelerator_Settings_Updated.yaml", "Analytic Rules/Configuration_Backup_Failed.yaml" ], "Workbooks": [ "Workbooks/VeeamDataPlatformMonitoring/VeeamDataPlatformMonitoring.json", "Workbooks/VeeamSecurityActivities/VeeamSecurityActivities.json" ], "SavedSearches": [], "Hunting Queries": [], "SummaryRules": [], "WatchlistDescription": [], "dependentDomainSolutionIds": [], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Veeam", "Version": "3.1.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false }