{
    "id": "VeeamCustomTablesDataConnector",
    "title": "Veeam Data Connector (using Azure Functions)",
    "publisher": "Veeam",
    "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions",
    "additionalRequirementBanner": "The following queries and workbooks require a parser based on Kusto to work properly. To use **VeeamSyslogEventsV2** alias for Kusto functions in queries and workbooks, see [this instruction](https://aka.ms/sentinel-veeam-function) ",
    "graphQueries": [
        {
            "metricName": "All malware events",
            "legend": "VeeamMalwareEvents_CL",
            "baseQuery": "VeeamMalwareEvents_CL"
        },
        {
            "metricName": "Critical malware events",
            "legend": "VeeamMalwareEvents_CL",
            "baseQuery": "VeeamMalwareEvents_CL\n| where Severity == \"Critical\""
        },
        {
            "metricName": "Security & Compliance Analyzer results",
            "legend": "VeeamSecurityComplianceAnalyzer_CL",
            "baseQuery": "VeeamSecurityComplianceAnalyzer_CL"
        },
        {
            "metricName": "Veeam ONE alarms",
            "legend": "VeeamOneTriggeredAlarms_CL",
            "baseQuery": "VeeamOneTriggeredAlarms_CL"
        },
        {
            "metricName": "Authorization events",
            "legend": "VeeamAuthorizationEvents_CL",
            "baseQuery": "VeeamAuthorizationEvents_CL"
        },
        {
            "metricName": "Coveware findings",
            "legend": "VeeamCovewareFindings_CL",
            "baseQuery": "VeeamCovewareFindings_CL"
        },
        {
            "metricName": "Veeam sessions",
            "legend": "VeeamSessions_CL",
            "baseQuery": "VeeamSessions_CL"
        }
    ],
    "sampleQueries": [
    ],
    "dataTypes": [
        {
            "name": "VeeamMalwareEvents_CL",
            "lastDataReceivedQuery": "VeeamMalwareEvents_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "VeeamSecurityComplianceAnalyzer_CL",
            "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzer_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "VeeamAuthorizationEvents_CL",
            "lastDataReceivedQuery": "VeeamAuthorizationEvents_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "VeeamOneTriggeredAlarms_CL",
            "lastDataReceivedQuery": "VeeamOneTriggeredAlarms_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "VeeamCovewareFindings_CL",
            "lastDataReceivedQuery": "VeeamCovewareFindings_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "VeeamSessions_CL",
            "lastDataReceivedQuery": "VeeamSessions_CL\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "union VeeamMalwareEvents_CL, VeeamSecurityComplianceAnalyzer_CL, VeeamAuthorizationEvents_CL, VeeamOneTriggeredAlarms_CL, VeeamCovewareFindings_CL, VeeamSessions_CL\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(3d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions on the workspace are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Microsoft.Web/sites permissions",
                "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
            },
            {
                "name": "Veeam Infrastructure Access",
                "description": "Access to Veeam Backup & Replication REST API and Veeam ONE monitoring platform is required. This includes proper authentication credentials and network connectivity."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": ">**NOTE:** This connector uses Azure Functions to connect to Veeam APIs and pull data into Microsoft Sentinel custom tables. This may result in additional data ingestion costs. See the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
        },
        {
            "title": "",
            "description": "**STEP 1 - Select the deployment option for Veeam Data Connector and associated Azure Functions**\n\n>**IMPORTANT:** Before you deploy Veeam Data Connector, prepare Workspace Name (can be copied from the following).",
           "instructions": [
                {
                "parameters": {
                    "fillWith": [
                    "WorkspaceName"
                    ],
                    "label": "Workspace Name"
                },
                "type": "CopyableLabel"
                }
            ]
        },
        {
            "title": "Azure Resource Manager (ARM) Template",
            "description": "Use this method for automated deployment of the Veeam data connector using an ARM Template.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FVeeam%2FData%2520Connectors%2Fazuredeploy_Veeam_API_FunctionApp.json)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Microsoft Sentinel Workspace Name**. \n4. Click **Review + Create**, **Create**."
        }
    ]
}