Veeam App v1.0.16
The Veeam Apps allow Veeam Data Platform Advanced and Premium customers to combine the automation and orchestration features of the Cortex product suite with a simple and powerful Veeam Data Platform that goes beyond backup providing businesses with reliable data protection, seamless recovery, and streamlined data management.
- Author:
- Veeam Software
- Support:
- partner
- Default data source:
- VBR REST API
Classifiers (4)
Dashboards (1)
- Veeam Incident Dashboard
Generics (9)
- Veeam_All_Veeam_failed_multi-factor_authentication_events_for_the_last_24h
- Veeam_All_Veeam_finished_jobs_for_the_last_24h
- Veeam_All_Veeam_four-eyes_authorization_events_for_the_last_24h
- Veeam_All_Veeam_malware_detection_events_for_the_last_24h
- Veeam_All_Veeam_security_events_for_the_last_7_days
- Veeam_All_Veeam_security_events_with_Critical_and_High_severity_for_the_last_24h
- Veeam_All_Veeam_triggered_alarms_for_the_last_7_days
- Veeam_Data_Platform_Monitoring_Dashboard
- Veeam_Security_Activities_Dashboard
Incident fields (25)
- Veeam Affected Machine
- Veeam Alarm Status
- Veeam Alarm Template ID
- Veeam Alarm Template Name
- Veeam Assigned Object
- Veeam Backup Object ID
- Veeam Backup Repository Capacity (GB)
- Veeam Backup Repository Free Space (GB)
- Veeam Backup Repository ID
- Veeam Backup Repository Name
- Veeam Backup Repository Used Space (GB)
- Veeam Backup Scheduling
- Veeam Encryption
- Veeam Event Source Description
- Veeam Event Type Description
- Veeam Is Enabled
- Veeam Last Successful Backup
- Veeam Malware Detection Method
- Veeam Malware Detection Time
- Veeam Malware Status
- Veeam Notifications
- Veeam Number of Stored Restore Points
- Veeam Number of Triggered Alarms
- Veeam Remediation
- Veeam Triggered Time
Incident types (25)
- Backup Copy Creation Time
- Backup Server Security Status
- Configuration Backup
- Enterprise Application Backup
- Immutability Change Tracking
- Immutability State
- Incident Fetch Error
- Incremental Backup Size
- Job Disabling
- Job Duration
- Job Duration Deviation (Veeam Backup for Microsoft 365)
- Malware Detection - Antivirus Scan
- Malware Detection - Deleted Files
- Malware Detection - Encrypted Files
- Malware Detection - Ransomware Notes
- Malware Detection - Renamed Files
- Malware Detection - Suspicious Files and Extensions
- Malware Detection - Unknown
- Malware Detection - Yara Scan
- Malware Detection Change Tracking
- Physical Machine Backup
- Possible Malware Activity
- Repository Capacity
- Virtual Machine Backup
- Virtual Machine Replica
Integrations (2)
Scripts (3)
README
Overview
Secure backup is critical to your cyber resilience. Veeam Data Platform provides comprehensive capabilities to extend the principles of Zero Trust to data backup and recovery including Proactive Threat Hunting, Immutability Everywhere, and Secure Access.
<~XSOAR>
Using the data received from Veeam Backup & Replication and Veeam ONE REST APIs, the app creates custom incidents related to malware detection and the health state of the backup infrastructure components. These incidents can be managed through the built-in Veeam Incident dashboard and resolved manually or automatically with built-in Veeam playbooks.
The content pack includes:
- Veeam Incident Dashboard: an overview of all API activities and incidents handled by the Veeam App
- Leverage custom incident types and fields related to malware detection and the health state of the backup infrastructure components
- Predefined incident classifiers and incoming mappers for incident types
- Ingestion of the most important security alerts and detections:
- Configuration Backup State
- Malware Detection
- Backup Repository State
- Triggered Alarm
- Predefined playbooks to remediate incidents:
- Start configuration backup
- Start Instance VM Recovery manually
- Start Instance VM Recovery automatically
- Resolve alarms triggered by Veeam ONE
Documentation
Screenshots
</~XSOAR>
<~XSIAM>
This app allows Veeam Data Platform Advanced and Premium users to monitor various security activities in their Veeam backup infrastructure and use leverage pre-defined automation playbooks via REST API for:
- Veeam Backup & Replication
- Veeam ONE
Monitoring
The app gets information from the event forwarding capabilities via syslog servers integrated with Veeam Backup & Replication and Veeam ONE, parses the data and displays it on the Veeam Data Platform Monitoring dashboard. For events and alarms with Medium, High and Critical severity, the app displays them on the Veeam Security Activities dashboard.
It includes:
- Built-in dashboards to monitor job statuses and security activities on a daily basis.
- Built-in reports.
- Multiple data source support.
Information:\
Consider the following:
- Correlation rules are not included in the content pack. To download and import them manually, please follow this link.
- The app supports Palo Alto Cortex XSIAM 2.5 and later.
Automation
Using the data available in Palo Alto Networks Cortex XSIAM you can leverage built-in Veeam playbooks such as:
- Start configuration backup
- Start Instance VM Recovery manually
- Start Instance VM Recovery automatically
- Resolve alarms triggered by Veeam ONE
Documentation
Veeam Helpcenter User Guide for XSIAM Monitoring
The documentation also includes examples of correlation rules for Veeam security activities.
Veeam Helpcenter User Guide for XSOAR Automation
Screenshots
</~XSIAM>