{ "dashboards_data": [ { "id": "fe984e4ee65345ea837a955d65a6c3f2", "name": "Veeam Security Activities", "description": "Aggregated information about security activities on Veeam Backup & Replication and Veeam ONE servers.", "status": "ENABLED", "layout": [ { "id": "row-2323", "data": [ { "key": "xql_1715781920209", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter _status=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\"),\r\n _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId ) as _count by _status\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _status yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "valuecolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "valuecolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "valuecolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "valuecolor" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| filter _severity = $x_axis.value \r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1715782110514", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" }, { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0),\r\n _oneInstanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n OR _oneInstanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter _host=if(_instanceId != null, arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0), \r\n _oneInstanceId != null, arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0))\r\n| filter _host in ($vbr_hosts) OR _host in ($one_hosts)\r\n| comp count(1) as _count\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } } }, { "key": "xql_1719488295523", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp count(_instanceId ) as _count by _severity\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _severity yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_severity" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } }, { "func": { "args": [ "\"Critical\"", "\"#D10000\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"High\"", "\"#FF8F2E\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Medium\"", "\"#0084D1\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Information\"", "\"#00D15F\"" ], "name": "valuecolor" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _severity = $x_axis.value \r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } } ] }, { "id": "row-6498", "data": [ { "key": "xql_1715782213232", "data": { "type": "Custom XQL", "width": 25, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1715782338600", "data": { "type": "Custom XQL", "width": 25, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1715782276516", "data": { "type": "Custom XQL", "width": 25, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1719493861066", "data": { "type": "Custom XQL", "width": 25, "height": 400, "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| comp count(_instanceId ) as _count by _alarmName\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _alarmName yaxis = _count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_alarmName" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _alarmName = $x_axis.value \r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } } ] }, { "id": "row-772", "data": [ { "key": "xql_1715782419912", "data": { "type": "Custom XQL", "width": 50, "height": 570, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n_day=date_floor(_time ,\"d\")\r\n| filter _host in ($vbr_hosts)\r\n| comp \r\n count(if(_instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), 1)) as Critical, \r\n count(if(_instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), 1)) as High,\r\n count(if(_instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), 1)) as Medium,\r\n count(if(_instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), 1)) as Information by _day\r\n| sort asc _day\r\n\r\n\r\n\n| view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor(\"Critical\",\"#D10000\") seriescolor(\"Medium\",\"#0084D1\") seriescolor(\"High\",\"#FF8F2E\") seriescolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "area", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "show_percentage", "value": "false" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "Critical,High,Medium,Information" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "seriescolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "seriescolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "seriescolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "seriescolor" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter\r\n _day=date_floor(_time ,\"d\"),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| filter _day = to_timestamp($x_axis.value, \"MILLIS\") AND _severity = $y_axis.name \r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1719484549012", "data": { "type": "Custom XQL", "width": 50, "height": 570, "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter _day=date_floor(_time ,\"d\"),\r\n _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp \r\n count(if(_severity = \"Critical\", 1)) as Critical, \r\n count(if(_severity = \"High\", 1)) as High,\r\n count(if(_severity = \"Medium\", 1)) as Medium,\r\n count(if(_severity = \"Information\", 1)) as Information by _day\r\n| sort asc _day\r\n\r\n\r\n\r\n\n| view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor(\"Critical\",\"#D10000\") seriescolor(\"Medium\",\"#0084D1\") seriescolor(\"High\",\"#FF8F2E\") seriescolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "area", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "show_percentage", "value": "false" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "Critical,High,Medium,Information" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "seriescolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "seriescolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "seriescolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "seriescolor" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter\r\n _day=date_floor(_time ,\"d\"),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _day = to_timestamp($x_axis.value, \"MILLIS\") AND _severity = $y_axis.name \r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } } ] }, { "id": "row-799", "data": [ { "key": "xql_1715782512114", "data": { "type": "Custom XQL", "width": 50, "height": 570, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| filter _host in ($vbr_hosts) \r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "entityType": "xql-widget-table-e56e365c-5f88-4e5c-b983-6653dfc566e0", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } }, { "key": "xql_1719413377594", "data": { "type": "Custom XQL", "width": 50, "height": 570, "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _host in ($one_hosts)\r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`\r\n| limit 100", "entityType": "xql-widget-table-a5d3d14d-bf13-4220-a9f0-6c5dbdbbe376", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } } ] }, { "id": "row-7402", "data": [ { "key": "xql_1721205591354", "data": { "type": "Custom XQL", "width": 100, "height": 418, "params": [ { "name": "hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n _day=date_floor(_time ,\"d\"),\r\n _operationId=arrayindex(regextract(_raw_log, \"OperationId\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($hosts)\r\n| comp \r\n count(if(_operationId = \"0\", 1)) as _MDAEnabled,\r\n count(if(_operationId = \"1\", 1)) as _MDADisabled,\r\n count(if(_operationId = \"100\", 1)) as _MDABackupDeletion,\r\n count(if(_operationId = \"101\", 1)) as _MDALogBackupDeletion,\r\n count(if(_operationId = \"102\", 1)) as _MDAConfigurationBackupDeletion,\r\n count(if(_operationId = \"103\", 1)) as _MDAAdminApproval,\r\n count(if(_operationId = \"104\", 1)) as _MDASanSnapshotDeletion,\r\n count(if(_operationId = \"105\", 1)) as _MDAInfraItemDeletion,\r\n count(if(_operationId = \"106\", 1)) as _MDAServiceProviderDeletion,\r\n count(if(_operationId = \"107\", 1)) as _MDAStorageDeletion,\r\n count(if(_operationId = \"108\", 1)) as _MDAVbrSecuritySettingsChange,\r\n count(if(_operationId = \"10000\", 1)) as _MDAStaticInfo by _day\r\n| sort asc _day\r\n\r\n\n| view graph type = column subtype = stacked xaxis = _day yaxis = _MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo seriestitle(\"_MDAEnabled\",\"Four-eyes authorization has been enabled\") seriestitle(\"_MDADisabled\",\"Four-eyes authorization has been disabled\") seriestitle(\"_MDABackupDeletion\",\"Delete backup\") seriestitle(\"_MDALogBackupDeletion\",\"Delete log backup\") seriestitle(\"_MDAConfigurationBackupDeletion\",\"Delete configuration backup\") seriestitle(\"_MDAAdminApproval\",\"Disable four-eyes authorization\") seriestitle(\"_MDASanSnapshotDeletion\",\"Delete snapshot\") seriestitle(\"_MDAInfraItemDeletion\",\"Delete infrastructure object\") seriestitle(\"_MDAServiceProviderDeletion\",\"Delete service provider\") seriestitle(\"_MDAStorageDeletion\",\"Delete storage\") seriestitle(\"_MDAVbrSecuritySettingsChange\",\"Update Veeam Backup & Replication security settings\") seriestitle(\"_MDAStaticInfo\",\"Other operations\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "stacked" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "_MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo" } }, { "func": { "args": [ "_MDAEnabled", "Four-eyes authorization has been enabled" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDADisabled", "Four-eyes authorization has been disabled" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDABackupDeletion", "Delete backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDALogBackupDeletion", "Delete log backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAConfigurationBackupDeletion", "Delete configuration backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAAdminApproval", "Disable four-eyes authorization" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDASanSnapshotDeletion", "Delete snapshot" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAInfraItemDeletion", "Delete infrastructure object" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAServiceProviderDeletion", "Delete service provider" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAStorageDeletion", "Delete storage" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAVbrSecuritySettingsChange", "Update Veeam Backup & Replication security settings" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAStaticInfo", "Other operations" ], "name": "seriestitle" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n _day=date_floor(_time ,\"d\"),\r\n _operationId=arrayindex(regextract(_raw_log, \"OperationId\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter \r\n _operationColumn=if(\r\n _operationId = \"0\", \"_MDAEnabled\",\r\n _operationId = \"1\", \"_MDADisabled\",\r\n _operationId = \"100\", \"_MDABackupDeletion\",\r\n _operationId = \"101\", \"_MDALogBackupDeletion\",\r\n _operationId = \"102\", \"_MDAConfigurationBackupDeletion\",\r\n _operationId = \"103\", \"_MDAAdminApproval\",\r\n _operationId = \"104\", \"_MDASanSnapshotDeletion\",\r\n _operationId = \"105\", \"_MDAInfraItemDeletion\",\r\n _operationId = \"106\", \"_MDAServiceProviderDeletion\",\r\n _operationId = \"107\", \"_MDAStorageDeletion\",\r\n _operationId = \"108\", \"_MDAVbrSecuritySettingsChange\",\r\n _operationId = \"10000\", \"_MDAStaticInfo\"),\r\n _operation = if(\r\n _operationId = \"0\", \"Four-eyes authorization has been enabled\",\r\n _operationId = \"1\", \"Four-eyes authorization has been disabled\",\r\n _operationId = \"100\", \"Delete backup\",\r\n _operationId = \"101\", \"Delete log backup\",\r\n _operationId = \"102\", \"Delete configuration backup\",\r\n _operationId = \"103\", \"Disable four-eyes authorization\",\r\n _operationId = \"104\", \"Delete snapshot\",\r\n _operationId = \"105\", \"Delete infrastructure object\",\r\n _operationId = \"106\", \"Delete service provider\",\r\n _operationId = \"107\", \"Delete storage\",\r\n _operationId = \"108\", \"Update Veeam Backup & Replication security settings\",\r\n _operationId = \"10000\", \"Other operations\"),\r\n _user=arrayindex(regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=\"Critical\"\r\n| filter _day = to_timestamp($x_axis.value, \"MILLIS\") and _operationColumn = $y_axis.name\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } } ] } ], "default_dashboard_id": 1, "global_id": "fe984e4ee65345ea837a955d65a6c3f2", "metadata": { "params": [ { "name": "vbr_hosts", "type": "DYNAMIC", "title": "Veeam Backup & Replication Data Sources", "value": [], "executionID": "9543fce53c9543_624792_inv", "valueOptions": [], "investigation": { "ttl": "0", "source": "investigation", "timeframe": { "relativeTime": 2592000000 }, "input_dict": { "xql": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter \r\n _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| dedup _host \r\n| fields\r\n _host", "tenants": [], "schedule": null, "query_editor": "xql", "notification_link": "xql/xql-search/_EXECUTION_ID_", "run_in_background": false, "query_definition_name": "XQL-QUERY-139162" }, "dashboard_id": null }, "investigationError": null, "filterComponentType": "MULTI_SELECT", "investigationColumn": "_host" }, { "name": "one_hosts", "type": "DYNAMIC", "title": "Veeam One Data Sources", "value": [], "executionID": "b2328d3344e64f_624793_inv", "valueOptions": [], "investigation": { "ttl": "0", "source": "investigation", "timeframe": { "relativeTime": 2592000000 }, "input_dict": { "xql": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _oneInstanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _oneInstanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\")\r\n| alter \r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0)\r\n| dedup _host \r\n| fields\r\n _host", "tenants": [], "schedule": null, "query_editor": "xql", "notification_link": "xql/xql-search/_EXECUTION_ID_", "run_in_background": false, "query_definition_name": "XQL-QUERY-139163" }, "dashboard_id": null }, "investigationError": null, "filterComponentType": "MULTI_SELECT", "investigationColumn": "_host" } ] } } ], "widgets_data": [ { "widget_key": "xql_1715781920209", "title": "Veeam Backup & Replication Security Events", "creation_time": 1727085304736, "description": "The total amount of Veeam Backup & Replication security events.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter _status=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\"),\r\n _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId ) as _count by _status\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _status yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "valuecolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "valuecolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "valuecolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "valuecolor" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782110514", "title": "All Security Activities", "creation_time": 1727085302876, "description": "The total amount of security events created on Veeam Backup & Replication servers and alarms triggered on Veeam ONE servers.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" }, { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0),\r\n _oneInstanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n OR _oneInstanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter _host=if(_instanceId != null, arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0), \r\n _oneInstanceId != null, arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0))\r\n| filter _host in ($vbr_hosts) OR _host in ($one_hosts)\r\n| comp count(1) as _count\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782213232", "title": "Marked as Infected", "creation_time": 1727085304545, "description": "The total amount of Veeam Backup & Replication objects marked as Infected.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782276516", "title": "Marked as Suspicious", "creation_time": 1727085304626, "description": "The total amount of Veeam Backup & Replication objects marked as Suspicious.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782338600", "title": "Four-Eyes Authorization Events", "creation_time": 1727085303502, "description": "The total amount of Veeam Backup & Replication four-eyes authorization events.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782419912", "title": "Daily Veeam Backup & Replication Security Events", "creation_time": 1727085303120, "description": "Daily statistics on Veeam Backup & Replication security events by severity level.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n_day=date_floor(_time ,\"d\")\r\n| filter _host in ($vbr_hosts)\r\n| comp \r\n count(if(_instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), 1)) as Critical, \r\n count(if(_instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), 1)) as High,\r\n count(if(_instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), 1)) as Medium,\r\n count(if(_instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), 1)) as Information by _day\r\n| sort asc _day\r\n\r\n\r\n\n| view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor(\"Critical\",\"#D10000\") seriescolor(\"Medium\",\"#0084D1\") seriescolor(\"High\",\"#FF8F2E\") seriescolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "area", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "show_percentage", "value": "false" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "Critical,High,Medium,Information" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "seriescolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "seriescolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "seriescolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "seriescolor" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782512114", "title": "Latest Veeam Backup & Replication Security Events", "creation_time": 1727085304210, "description": "Information about the latest security events triggered on each Veeam Backup & Replication server.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| filter _host in ($vbr_hosts) \r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1719413377594", "title": "Latest Veeam One Alarms", "creation_time": 1727085304464, "description": "Information about the latest alarms triggered on each Veeam ONE server.", "data": { "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _host in ($one_hosts)\r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`\r\n| limit 100", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1719484549012", "title": "Daily Veeam One Alarms", "creation_time": 1727085303425, "description": "Daily statistics on Veeam ONE alarms by severity level.", "data": { "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter _day=date_floor(_time ,\"d\"),\r\n _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp \r\n count(if(_severity = \"Critical\", 1)) as Critical, \r\n count(if(_severity = \"High\", 1)) as High,\r\n count(if(_severity = \"Medium\", 1)) as Medium,\r\n count(if(_severity = \"Information\", 1)) as Information by _day\r\n| sort asc _day\r\n\r\n\r\n\r\n\n| view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor(\"Critical\",\"#D10000\") seriescolor(\"Medium\",\"#0084D1\") seriescolor(\"High\",\"#FF8F2E\") seriescolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "area", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "show_percentage", "value": "false" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "Critical,High,Medium,Information" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "seriescolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "seriescolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "seriescolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "seriescolor" } } ] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1719488295523", "title": "Veeam ONE Alarms", "creation_time": 1727085304948, "description": "The total amount of Veeam ONE alarms.", "data": { "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp count(_instanceId ) as _count by _severity\r\n\r\n\r\n\r\n| view graph type = pie subtype = full xaxis = _severity yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_severity" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } }, { "func": { "args": [ "\"Critical\"", "\"#D10000\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"High\"", "\"#FF8F2E\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Medium\"", "\"#0084D1\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Information\"", "\"#00D15F\"" ], "name": "valuecolor" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1719493861066", "title": "Veeam One Alarms by Name", "creation_time": 1727085305148, "description": "The breakdown of Veeam ONE alarms by name.", "data": { "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| comp count(_instanceId ) as _count by _alarmName\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _alarmName yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_alarmName" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1721205591354", "title": "Four-Eyes Authorization Events\u00a0by Operation", "creation_time": 1727085303785, "description": "The breakdown of Veeam Backup & Replication four-eyes authorization events by operation.", "data": { "params": [ { "name": "hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n _day=date_floor(_time ,\"d\"),\r\n _operationId=arrayindex(regextract(_raw_log, \"OperationId\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($hosts)\r\n| comp \r\n count(if(_operationId = \"0\", 1)) as _MDAEnabled,\r\n count(if(_operationId = \"1\", 1)) as _MDADisabled,\r\n count(if(_operationId = \"100\", 1)) as _MDABackupDeletion,\r\n count(if(_operationId = \"101\", 1)) as _MDALogBackupDeletion,\r\n count(if(_operationId = \"102\", 1)) as _MDAConfigurationBackupDeletion,\r\n count(if(_operationId = \"103\", 1)) as _MDAAdminApproval,\r\n count(if(_operationId = \"104\", 1)) as _MDASanSnapshotDeletion,\r\n count(if(_operationId = \"105\", 1)) as _MDAInfraItemDeletion,\r\n count(if(_operationId = \"106\", 1)) as _MDAServiceProviderDeletion,\r\n count(if(_operationId = \"107\", 1)) as _MDAStorageDeletion,\r\n count(if(_operationId = \"108\", 1)) as _MDAVbrSecuritySettingsChange,\r\n count(if(_operationId = \"10000\", 1)) as _MDAStaticInfo by _day\r\n| sort asc _day\r\n\r\n\n| view graph type = column subtype = stacked xaxis = _day yaxis = _MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo seriestitle(\"_MDAEnabled\",\"Four-eyes authorization has been enabled\") seriestitle(\"_MDADisabled\",\"Four-eyes authorization has been disabled\") seriestitle(\"_MDABackupDeletion\",\"Delete backup\") seriestitle(\"_MDALogBackupDeletion\",\"Delete log backup\") seriestitle(\"_MDAConfigurationBackupDeletion\",\"Delete configuration backup\") seriestitle(\"_MDAAdminApproval\",\"Disable four-eyes authorization\") seriestitle(\"_MDASanSnapshotDeletion\",\"Delete snapshot\") seriestitle(\"_MDAInfraItemDeletion\",\"Delete infrastructure object\") seriestitle(\"_MDAServiceProviderDeletion\",\"Delete service provider\") seriestitle(\"_MDAStorageDeletion\",\"Delete storage\") seriestitle(\"_MDAVbrSecuritySettingsChange\",\"Update Veeam Backup & Replication security settings\") seriestitle(\"_MDAStaticInfo\",\"Other operations\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "stacked" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "_MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo" } }, { "func": { "args": [ "_MDAEnabled", "Four-eyes authorization has been enabled" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDADisabled", "Four-eyes authorization has been disabled" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDABackupDeletion", "Delete backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDALogBackupDeletion", "Delete log backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAConfigurationBackupDeletion", "Delete configuration backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAAdminApproval", "Disable four-eyes authorization" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDASanSnapshotDeletion", "Delete snapshot" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAInfraItemDeletion", "Delete infrastructure object" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAServiceProviderDeletion", "Delete service provider" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAStorageDeletion", "Delete storage" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAVbrSecuritySettingsChange", "Update Veeam Backup & Replication security settings" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAStaticInfo", "Other operations" ], "name": "seriestitle" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } } ], "fromVersion": "8.9.0", "supportedModules": [ "xsiam" ] }