Veeam Security Activities
Aggregated information about security activities on Veeam Backup & Replication and Veeam ONE servers.
Veeam App ENABLED
Details
| ID | fe984e4ee65345ea837a955d65a6c3f2 |
|---|---|
| From Version | 8.9.0 |
| Supported Modules | xsiam |
Screenshot
Widgets (12)
Veeam Backup & Replication Security Events
The total amount of Veeam Backup & Replication security events.
Custom XQL pie
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0) | filter _instanceId in ("41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","41800","41810","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42403","42500","27000","24060","24030","24050","24070","24040","42290") | alter _status=if( _instanceId in ("21224","23090","25500","28200","28980","29900","30200","31400","31800","32200","40201","40204","40206","41402","41600","41800","41810","42220","42301","42401","42402"), "Critical", _instanceId in ("115","23420","24030","24050","24080","27000","28500","28920","28950","29120","29150","30100","31200","31700","31900","32120","40205","40400","40600","42260","42280","42290","42302","42405"), "High", _instanceId in ("24040","24060","24070","26100","26110","28100","28970","29800","31210","36013","40500"), "Medium", _instanceId in ("24020","30400","30500","31500","31600","41610","42210","42230","42270","42404","42500"), "Information"), _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0) | filter _host in ($vbr_hosts) | comp count(_instanceId ) as _count by _status | view graph type = pie subtype = full xaxis = _status yaxis = _count valuecolor("Critical","#D10000") valuecolor("High","#FF8F2E") valuecolor("Medium","#0084D1") valuecolor("Information","#00D15F")
All Security Activities
The total amount of security events created on Veeam Backup & Replication servers and alarms triggered on Veeam ONE servers.
Custom XQL single
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0), _oneInstanceId=arrayindex(regextract(_raw_log, "predefined_alarm_id\=\"(\d+)\""),0) | filter _instanceId in ("41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","41800","41810","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42403","42500","27000","24060","24030","24050","24070","24040","42290") OR _oneInstanceId in ("395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378") | alter _host=if(_instanceId != null, arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0), _oneInstanceId != null, arrayindex(regextract(_raw_log , "<\d+>\d\s+\S+\s+(\S+)\s"), 0)) | filter _host in ($vbr_hosts) OR _host in ($one_hosts) | comp count(1) as _count | view graph type = single subtype = standard yaxis = _count
Veeam ONE Alarms
The total amount of Veeam ONE alarms.
Custom XQL pie
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "predefined_alarm_id\=\"(\d+)\""),0) | filter _instanceId in ("395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378") | alter _host=arrayindex(regextract(_raw_log , "<\d+>\d\s+\S+\s+(\S+)\s"), 0), _description=arrayindex(regextract(_raw_log, "alarm_details\=\"([^\"]*)(?:\"|$)"),0), _alarmName=arrayindex(regextract(_raw_log, "alarm_name\=\"([^\"]*)(?:\"|$)"),0), _alarmType=arrayindex(regextract(_raw_log, "alarm_type\=\"([^\"]*)(?:\"|$)"),0), _objectName=arrayindex(regextract(_raw_log, "object_name\=\"([^\"]*)(?:\"|$)"),0), _statusNew=arrayindex(regextract(_raw_log, "status_new\=\"([^\"]*)(?:\"|$)"),0), _statusOld=arrayindex(regextract(_raw_log, "status_old\=\"([^\"]*)(?:\"|$)"),0), _objectPath=arrayindex(regextract(_raw_log, "object_path\=\"([^\"]*)(?:\"|$)"),0) | filter _host in ($one_hosts) | alter _severity=if( _instanceId in ("364","391","365","370","314","331","403","342","315","332","344"), "Critical", _instanceId in ("395","369","376","377","316","381","378"), "Medium") | comp count(_instanceId ) as _count by _severity | view graph type = pie subtype = full xaxis = _severity yaxis = _count valuecolor("Critical","#D10000") valuecolor("High","#FF8F2E") valuecolor("Medium","#0084D1") valuecolor("Information","#00D15F")
Marked as Infected
The total amount of Veeam Backup & Replication objects marked as Infected.
Custom XQL single
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0) | filter _instanceId in ("42220") | alter _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0) | filter _host in ($vbr_hosts) | comp count(_instanceId) as _count | view graph type = single subtype = standard yaxis = _count
Four-Eyes Authorization Events
The total amount of Veeam Backup & Replication four-eyes authorization events.
Custom XQL single
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0) | filter _instanceId in ("42402") | alter _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0) | filter _host in ($vbr_hosts) | comp count(_instanceId) as _count | view graph type = single subtype = standard yaxis = _count
Marked as Suspicious
The total amount of Veeam Backup & Replication objects marked as Suspicious.
Custom XQL single
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0) | filter _instanceId in ("41600") | alter _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0) | filter _host in ($vbr_hosts) | comp count(_instanceId) as _count | view graph type = single subtype = standard yaxis = _count
Veeam One Alarms by Name
The breakdown of Veeam ONE alarms by name.
Custom XQL pie
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "predefined_alarm_id\=\"(\d+)\""),0) | filter _instanceId in ("395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378") | alter _host=arrayindex(regextract(_raw_log , "<\d+>\d\s+\S+\s+(\S+)\s"), 0), _description=arrayindex(regextract(_raw_log, "alarm_details\=\"([^\"]*)(?:\"|$)"),0), _alarmName=arrayindex(regextract(_raw_log, "alarm_name\=\"([^\"]*)(?:\"|$)"),0), _alarmType=arrayindex(regextract(_raw_log, "alarm_type\=\"([^\"]*)(?:\"|$)"),0), _objectName=arrayindex(regextract(_raw_log, "object_name\=\"([^\"]*)(?:\"|$)"),0), _statusNew=arrayindex(regextract(_raw_log, "status_new\=\"([^\"]*)(?:\"|$)"),0), _statusOld=arrayindex(regextract(_raw_log, "status_old\=\"([^\"]*)(?:\"|$)"),0), _objectPath=arrayindex(regextract(_raw_log, "object_path\=\"([^\"]*)(?:\"|$)"),0) | filter _host in ($one_hosts) | comp count(_instanceId ) as _count by _alarmName | view graph type = pie subtype = full xaxis = _alarmName yaxis = _count
Daily Veeam Backup & Replication Security Events
Daily statistics on Veeam Backup & Replication security events by severity level.
Custom XQL area
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0) | filter _instanceId in ("41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","41800","41810","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42403","42500","27000","24060","24030","24050","24070","24040","42290") | alter _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)) | alter _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0), _day=date_floor(_time ,"d") | filter _host in ($vbr_hosts) | comp count(if(_instanceId in ("21224","23090","25500","28200","28980","29900","30200","31400","31800","32200","40201","40204","40206","41402","41600","41800","41810","42220","42301","42401","42402"), 1)) as Critical, count(if(_instanceId in ("115","23420","24030","24050","24080","27000","28500","28920","28950","29120","29150","30100","31200","31700","31900","32120","40205","40400","40600","42260","42280","42290","42302","42405"), 1)) as High, count(if(_instanceId in ("24040","24060","24070","26100","26110","28100","28970","29800","31210","36013","40500"), 1)) as Medium, count(if(_instanceId in ("24020","30400","30500","31500","31600","41610","42210","42230","42270","42404","42500"), 1)) as Information by _day | sort asc _day | view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor("Critical","#D10000") seriescolor("Medium","#0084D1") seriescolor("High","#FF8F2E") seriescolor("Information","#00D15F")
Daily Veeam One Alarms
Daily statistics on Veeam ONE alarms by severity level.
Custom XQL area
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "predefined_alarm_id\=\"(\d+)\""),0) | filter _instanceId in ("395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378") | alter _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)), _host=arrayindex(regextract(_raw_log , "<\d+>\d\s+\S+\s+(\S+)\s"), 0), _description=arrayindex(regextract(_raw_log, "alarm_details\=\"([^\"]*)(?:\"|$)"),0), _alarmName=arrayindex(regextract(_raw_log, "alarm_name\=\"([^\"]*)(?:\"|$)"),0), _alarmType=arrayindex(regextract(_raw_log, "alarm_type\=\"([^\"]*)(?:\"|$)"),0), _objectName=arrayindex(regextract(_raw_log, "object_name\=\"([^\"]*)(?:\"|$)"),0), _statusNew=arrayindex(regextract(_raw_log, "status_new\=\"([^\"]*)(?:\"|$)"),0), _statusOld=arrayindex(regextract(_raw_log, "status_old\=\"([^\"]*)(?:\"|$)"),0), _objectPath=arrayindex(regextract(_raw_log, "object_path\=\"([^\"]*)(?:\"|$)"),0) | filter _host in ($one_hosts) | alter _day=date_floor(_time ,"d"), _severity=if( _instanceId in ("364","391","365","370","314","331","403","342","315","332","344"), "Critical", _instanceId in ("395","369","376","377","316","381","378"), "Medium") | comp count(if(_severity = "Critical", 1)) as Critical, count(if(_severity = "High", 1)) as High, count(if(_severity = "Medium", 1)) as Medium, count(if(_severity = "Information", 1)) as Information by _day | sort asc _day | view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor("Critical","#D10000") seriescolor("Medium","#0084D1") seriescolor("High","#FF8F2E") seriescolor("Information","#00D15F")
Latest Veeam Backup & Replication Security Events
Information about the latest security events triggered on each Veeam Backup & Replication server.
Custom XQL table
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0) | filter _instanceId in ("41600","42220","25500","26100","28100","28970","29800","30100","30400","31500","31600","31700","31800","31900","40204","40400","40500","40600","42260","42270","42302","23090","23420","24080","28200","28500","28920","28950","28980","29120","29150","29900","30200","30500","32120","32200","41402","115","31210","31400","40201","40205","40206","41610","41800","41810","42230","42301","42401","42402","42404","42405","21224","26110","31200","36013","42210","42403","42500","27000","24060","24030","24050","24070","24040","42290") | alter _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)), _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0), _severity=if( _instanceId in ("21224","23090","25500","28200","28980","29900","30200","31400","31800","32200","40201","40204","40206","41402","41600","41800","41810","42220","42301","42401","42402"), "Critical", _instanceId in ("115","23420","24030","24050","24080","27000","28500","28920","28950","29120","29150","30100","31200","31700","31900","32120","40205","40400","40600","42260","42280","42290","42302","42405"), "High", _instanceId in ("24040","24060","24070","26100","26110","28100","28970","29800","31210","36013","40500"), "Medium", _instanceId in ("24020","30400","30500","31500","31600","41610","42210","42230","42270","42404","42500"), "Information", ""), _user=arrayindex(if( _instanceId in ("40201","42402","42404","42405","40204","40400","40500","40600","40700","42400","42401","42403"), regextract(_raw_log, "fullName\=\"([^\"]*)\""), _instanceId in ("36013"), regextract(_raw_log, "InitiatorName\=\"([^\"]*)\""), _instanceId in ("41800","41810"), regextract(_raw_log, "param3\=\"([^\"]*)\""), _instanceId in ("23090","23420","41402"), regextract(_raw_log, "param6\=\"([^\"]*)\""), _instanceId in ("40205","40206","41610","42301","24080","28200","28500","28920","28950","29120","29150","29900","30200","30500","32120","32200","25500","28100","29800","31600","31700","31800","31900","42260","42270","42280","42302","30100","30400","31500","31210","31400","41600", "31200","28970","28980","42230","42220","42290"), regextract(_raw_log, "UserName\=\"([^\"]*)\""), regextract(_raw_log, "user\=\"([^\"]*)\"") ), 0) | filter _host in ($vbr_hosts) | sort desc _time | fields _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`
Latest Veeam One Alarms
Information about the latest alarms triggered on each Veeam ONE server.
Custom XQL table
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "predefined_alarm_id\=\"(\d+)\""),0) | filter _instanceId in ("395", "364", "369", "391", "365", "370", "314", "331", "376", "377", "403", "316", "342", "381", "315", "332", "344", "378") | alter _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)), _host=arrayindex(regextract(_raw_log , "<\d+>\d\s+\S+\s+(\S+)\s"), 0), _description=arrayindex(regextract(_raw_log, "alarm_details\=\"([^\"]*)(?:\"|$)"),0), _alarmName=arrayindex(regextract(_raw_log, "alarm_name\=\"([^\"]*)(?:\"|$)"),0), _alarmType=arrayindex(regextract(_raw_log, "alarm_type\=\"([^\"]*)(?:\"|$)"),0), _objectName=arrayindex(regextract(_raw_log, "object_name\=\"([^\"]*)(?:\"|$)"),0), _statusNew=arrayindex(regextract(_raw_log, "status_new\=\"([^\"]*)(?:\"|$)"),0), _statusOld=arrayindex(regextract(_raw_log, "status_old\=\"([^\"]*)(?:\"|$)"),0), _objectPath=arrayindex(regextract(_raw_log, "object_path\=\"([^\"]*)(?:\"|$)"),0) | alter _severity=if( _instanceId in ("364","391","365","370","314","331","403","342","315","332","344"), "Critical", _instanceId in ("395","369","376","377","316","381","378"), "Medium") | filter _host in ($one_hosts) | sort desc _time | fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path` | limit 100
Four-Eyes Authorization Events by Operation
The breakdown of Veeam Backup & Replication four-eyes authorization events by operation.
Custom XQL column
dataset in (veeam_*) | filter _vendor="Veeam" | alter _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0) | filter _instanceId in ("42402") | alter _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)) | alter _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0), _day=date_floor(_time ,"d"), _operationId=arrayindex(regextract(_raw_log, "OperationId\=\"([^\"]*)(?:\"|$)"),0) | filter _host in ($hosts) | comp count(if(_operationId = "0", 1)) as _MDAEnabled, count(if(_operationId = "1", 1)) as _MDADisabled, count(if(_operationId = "100", 1)) as _MDABackupDeletion, count(if(_operationId = "101", 1)) as _MDALogBackupDeletion, count(if(_operationId = "102", 1)) as _MDAConfigurationBackupDeletion, count(if(_operationId = "103", 1)) as _MDAAdminApproval, count(if(_operationId = "104", 1)) as _MDASanSnapshotDeletion, count(if(_operationId = "105", 1)) as _MDAInfraItemDeletion, count(if(_operationId = "106", 1)) as _MDAServiceProviderDeletion, count(if(_operationId = "107", 1)) as _MDAStorageDeletion, count(if(_operationId = "108", 1)) as _MDAVbrSecuritySettingsChange, count(if(_operationId = "10000", 1)) as _MDAStaticInfo by _day | sort asc _day | view graph type = column subtype = stacked xaxis = _day yaxis = _MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo seriestitle("_MDAEnabled","Four-eyes authorization has been enabled") seriestitle("_MDADisabled","Four-eyes authorization has been disabled") seriestitle("_MDABackupDeletion","Delete backup") seriestitle("_MDALogBackupDeletion","Delete log backup") seriestitle("_MDAConfigurationBackupDeletion","Delete configuration backup") seriestitle("_MDAAdminApproval","Disable four-eyes authorization") seriestitle("_MDASanSnapshotDeletion","Delete snapshot") seriestitle("_MDAInfraItemDeletion","Delete infrastructure object") seriestitle("_MDAServiceProviderDeletion","Delete service provider") seriestitle("_MDAStorageDeletion","Delete storage") seriestitle("_MDAVbrSecuritySettingsChange","Update Veeam Backup & Replication security settings") seriestitle("_MDAStaticInfo","Other operations")
{ "dashboards_data": [ { "id": "fe984e4ee65345ea837a955d65a6c3f2", "name": "Veeam Security Activities", "description": "Aggregated information about security activities on Veeam Backup & Replication and Veeam ONE servers.", "status": "ENABLED", "layout": [ { "id": "row-2323", "data": [ { "key": "xql_1715781920209", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter _status=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\"),\r\n _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId ) as _count by _status\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _status yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "valuecolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "valuecolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "valuecolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "valuecolor" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| filter _severity = $x_axis.value \r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1715782110514", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" }, { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0),\r\n _oneInstanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n OR _oneInstanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter _host=if(_instanceId != null, arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0), \r\n _oneInstanceId != null, arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0))\r\n| filter _host in ($vbr_hosts) OR _host in ($one_hosts)\r\n| comp count(1) as _count\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } } }, { "key": "xql_1719488295523", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp count(_instanceId ) as _count by _severity\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _severity yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_severity" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } }, { "func": { "args": [ "\"Critical\"", "\"#D10000\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"High\"", "\"#FF8F2E\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Medium\"", "\"#0084D1\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Information\"", "\"#00D15F\"" ], "name": "valuecolor" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _severity = $x_axis.value \r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } } ] }, { "id": "row-6498", "data": [ { "key": "xql_1715782213232", "data": { "type": "Custom XQL", "width": 25, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1715782338600", "data": { "type": "Custom XQL", "width": 25, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1715782276516", "data": { "type": "Custom XQL", "width": 25, "height": 400, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1719493861066", "data": { "type": "Custom XQL", "width": 25, "height": 400, "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| comp count(_instanceId ) as _count by _alarmName\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _alarmName yaxis = _count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_alarmName" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _alarmName = $x_axis.value \r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } } ] }, { "id": "row-772", "data": [ { "key": "xql_1715782419912", "data": { "type": "Custom XQL", "width": 50, "height": 570, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n_day=date_floor(_time ,\"d\")\r\n| filter _host in ($vbr_hosts)\r\n| comp \r\n count(if(_instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), 1)) as Critical, \r\n count(if(_instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), 1)) as High,\r\n count(if(_instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), 1)) as Medium,\r\n count(if(_instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), 1)) as Information by _day\r\n| sort asc _day\r\n\r\n\r\n\n| view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor(\"Critical\",\"#D10000\") seriescolor(\"Medium\",\"#0084D1\") seriescolor(\"High\",\"#FF8F2E\") seriescolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "area", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "show_percentage", "value": "false" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "Critical,High,Medium,Information" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "seriescolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "seriescolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "seriescolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "seriescolor" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter\r\n _day=date_floor(_time ,\"d\"),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| filter _day = to_timestamp($x_axis.value, \"MILLIS\") AND _severity = $y_axis.name \r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } }, { "key": "xql_1719484549012", "data": { "type": "Custom XQL", "width": 50, "height": 570, "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter _day=date_floor(_time ,\"d\"),\r\n _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp \r\n count(if(_severity = \"Critical\", 1)) as Critical, \r\n count(if(_severity = \"High\", 1)) as High,\r\n count(if(_severity = \"Medium\", 1)) as Medium,\r\n count(if(_severity = \"Information\", 1)) as Information by _day\r\n| sort asc _day\r\n\r\n\r\n\r\n\n| view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor(\"Critical\",\"#D10000\") seriescolor(\"Medium\",\"#0084D1\") seriescolor(\"High\",\"#FF8F2E\") seriescolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "area", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "show_percentage", "value": "false" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "Critical,High,Medium,Information" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "seriescolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "seriescolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "seriescolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "seriescolor" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter\r\n _day=date_floor(_time ,\"d\"),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _day = to_timestamp($x_axis.value, \"MILLIS\") AND _severity = $y_axis.name \r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } } ] }, { "id": "row-799", "data": [ { "key": "xql_1715782512114", "data": { "type": "Custom XQL", "width": 50, "height": 570, "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| filter _host in ($vbr_hosts) \r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "entityType": "xql-widget-table-e56e365c-5f88-4e5c-b983-6653dfc566e0", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } }, { "key": "xql_1719413377594", "data": { "type": "Custom XQL", "width": 50, "height": 570, "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _host in ($one_hosts)\r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`\r\n| limit 100", "entityType": "xql-widget-table-a5d3d14d-bf13-4220-a9f0-6c5dbdbbe376", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } } } ] }, { "id": "row-7402", "data": [ { "key": "xql_1721205591354", "data": { "type": "Custom XQL", "width": 100, "height": 418, "params": [ { "name": "hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n _day=date_floor(_time ,\"d\"),\r\n _operationId=arrayindex(regextract(_raw_log, \"OperationId\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($hosts)\r\n| comp \r\n count(if(_operationId = \"0\", 1)) as _MDAEnabled,\r\n count(if(_operationId = \"1\", 1)) as _MDADisabled,\r\n count(if(_operationId = \"100\", 1)) as _MDABackupDeletion,\r\n count(if(_operationId = \"101\", 1)) as _MDALogBackupDeletion,\r\n count(if(_operationId = \"102\", 1)) as _MDAConfigurationBackupDeletion,\r\n count(if(_operationId = \"103\", 1)) as _MDAAdminApproval,\r\n count(if(_operationId = \"104\", 1)) as _MDASanSnapshotDeletion,\r\n count(if(_operationId = \"105\", 1)) as _MDAInfraItemDeletion,\r\n count(if(_operationId = \"106\", 1)) as _MDAServiceProviderDeletion,\r\n count(if(_operationId = \"107\", 1)) as _MDAStorageDeletion,\r\n count(if(_operationId = \"108\", 1)) as _MDAVbrSecuritySettingsChange,\r\n count(if(_operationId = \"10000\", 1)) as _MDAStaticInfo by _day\r\n| sort asc _day\r\n\r\n\n| view graph type = column subtype = stacked xaxis = _day yaxis = _MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo seriestitle(\"_MDAEnabled\",\"Four-eyes authorization has been enabled\") seriestitle(\"_MDADisabled\",\"Four-eyes authorization has been disabled\") seriestitle(\"_MDABackupDeletion\",\"Delete backup\") seriestitle(\"_MDALogBackupDeletion\",\"Delete log backup\") seriestitle(\"_MDAConfigurationBackupDeletion\",\"Delete configuration backup\") seriestitle(\"_MDAAdminApproval\",\"Disable four-eyes authorization\") seriestitle(\"_MDASanSnapshotDeletion\",\"Delete snapshot\") seriestitle(\"_MDAInfraItemDeletion\",\"Delete infrastructure object\") seriestitle(\"_MDAServiceProviderDeletion\",\"Delete service provider\") seriestitle(\"_MDAStorageDeletion\",\"Delete storage\") seriestitle(\"_MDAVbrSecuritySettingsChange\",\"Update Veeam Backup & Replication security settings\") seriestitle(\"_MDAStaticInfo\",\"Other operations\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "stacked" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "_MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo" } }, { "func": { "args": [ "_MDAEnabled", "Four-eyes authorization has been enabled" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDADisabled", "Four-eyes authorization has been disabled" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDABackupDeletion", "Delete backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDALogBackupDeletion", "Delete log backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAConfigurationBackupDeletion", "Delete configuration backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAAdminApproval", "Disable four-eyes authorization" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDASanSnapshotDeletion", "Delete snapshot" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAInfraItemDeletion", "Delete infrastructure object" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAServiceProviderDeletion", "Delete service provider" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAStorageDeletion", "Delete storage" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAVbrSecuritySettingsChange", "Update Veeam Backup & Replication security settings" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAStaticInfo", "Other operations" ], "name": "seriestitle" } } ] }, "drilldown_config": { "actionData": { "timeRange": "widget_timeframe", "xqlPhrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n _day=date_floor(_time ,\"d\"),\r\n _operationId=arrayindex(regextract(_raw_log, \"OperationId\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter \r\n _operationColumn=if(\r\n _operationId = \"0\", \"_MDAEnabled\",\r\n _operationId = \"1\", \"_MDADisabled\",\r\n _operationId = \"100\", \"_MDABackupDeletion\",\r\n _operationId = \"101\", \"_MDALogBackupDeletion\",\r\n _operationId = \"102\", \"_MDAConfigurationBackupDeletion\",\r\n _operationId = \"103\", \"_MDAAdminApproval\",\r\n _operationId = \"104\", \"_MDASanSnapshotDeletion\",\r\n _operationId = \"105\", \"_MDAInfraItemDeletion\",\r\n _operationId = \"106\", \"_MDAServiceProviderDeletion\",\r\n _operationId = \"107\", \"_MDAStorageDeletion\",\r\n _operationId = \"108\", \"_MDAVbrSecuritySettingsChange\",\r\n _operationId = \"10000\", \"_MDAStaticInfo\"),\r\n _operation = if(\r\n _operationId = \"0\", \"Four-eyes authorization has been enabled\",\r\n _operationId = \"1\", \"Four-eyes authorization has been disabled\",\r\n _operationId = \"100\", \"Delete backup\",\r\n _operationId = \"101\", \"Delete log backup\",\r\n _operationId = \"102\", \"Delete configuration backup\",\r\n _operationId = \"103\", \"Disable four-eyes authorization\",\r\n _operationId = \"104\", \"Delete snapshot\",\r\n _operationId = \"105\", \"Delete infrastructure object\",\r\n _operationId = \"106\", \"Delete service provider\",\r\n _operationId = \"107\", \"Delete storage\",\r\n _operationId = \"108\", \"Update Veeam Backup & Replication security settings\",\r\n _operationId = \"10000\", \"Other operations\"),\r\n _user=arrayindex(regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=\"Critical\"\r\n| filter _day = to_timestamp($x_axis.value, \"MILLIS\") and _operationColumn = $y_axis.name\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "timePicker": [], "openInNewTab": true }, "actionType": "open_xql_search" } } } ] } ], "default_dashboard_id": 1, "global_id": "fe984e4ee65345ea837a955d65a6c3f2", "metadata": { "params": [ { "name": "vbr_hosts", "type": "DYNAMIC", "title": "Veeam Backup & Replication Data Sources", "value": [], "executionID": "9543fce53c9543_624792_inv", "valueOptions": [], "investigation": { "ttl": "0", "source": "investigation", "timeframe": { "relativeTime": 2592000000 }, "input_dict": { "xql": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter \r\n _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| dedup _host \r\n| fields\r\n _host", "tenants": [], "schedule": null, "query_editor": "xql", "notification_link": "xql/xql-search/_EXECUTION_ID_", "run_in_background": false, "query_definition_name": "XQL-QUERY-139162" }, "dashboard_id": null }, "investigationError": null, "filterComponentType": "MULTI_SELECT", "investigationColumn": "_host" }, { "name": "one_hosts", "type": "DYNAMIC", "title": "Veeam One Data Sources", "value": [], "executionID": "b2328d3344e64f_624793_inv", "valueOptions": [], "investigation": { "ttl": "0", "source": "investigation", "timeframe": { "relativeTime": 2592000000 }, "input_dict": { "xql": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _oneInstanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _oneInstanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\")\r\n| alter \r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0)\r\n| dedup _host \r\n| fields\r\n _host", "tenants": [], "schedule": null, "query_editor": "xql", "notification_link": "xql/xql-search/_EXECUTION_ID_", "run_in_background": false, "query_definition_name": "XQL-QUERY-139163" }, "dashboard_id": null }, "investigationError": null, "filterComponentType": "MULTI_SELECT", "investigationColumn": "_host" } ] } } ], "widgets_data": [ { "widget_key": "xql_1715781920209", "title": "Veeam Backup & Replication Security Events", "creation_time": 1727085304736, "description": "The total amount of Veeam Backup & Replication security events.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter _status=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\"),\r\n _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId ) as _count by _status\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _status yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "valuecolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "valuecolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "valuecolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "valuecolor" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782110514", "title": "All Security Activities", "creation_time": 1727085302876, "description": "The total amount of security events created on Veeam Backup & Replication servers and alarms triggered on Veeam ONE servers.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" }, { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0),\r\n _oneInstanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n OR _oneInstanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter _host=if(_instanceId != null, arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0), \r\n _oneInstanceId != null, arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0))\r\n| filter _host in ($vbr_hosts) OR _host in ($one_hosts)\r\n| comp count(1) as _count\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782213232", "title": "Marked as Infected", "creation_time": 1727085304545, "description": "The total amount of Veeam Backup & Replication objects marked as Infected.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782276516", "title": "Marked as Suspicious", "creation_time": 1727085304626, "description": "The total amount of Veeam Backup & Replication objects marked as Suspicious.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782338600", "title": "Four-Eyes Authorization Events", "creation_time": 1727085303502, "description": "The total amount of Veeam Backup & Replication four-eyes authorization events.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782419912", "title": "Daily Veeam Backup & Replication Security Events", "creation_time": 1727085303120, "description": "Daily statistics on Veeam Backup & Replication security events by severity level.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n_day=date_floor(_time ,\"d\")\r\n| filter _host in ($vbr_hosts)\r\n| comp \r\n count(if(_instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), 1)) as Critical, \r\n count(if(_instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), 1)) as High,\r\n count(if(_instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), 1)) as Medium,\r\n count(if(_instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), 1)) as Information by _day\r\n| sort asc _day\r\n\r\n\r\n\n| view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor(\"Critical\",\"#D10000\") seriescolor(\"Medium\",\"#0084D1\") seriescolor(\"High\",\"#FF8F2E\") seriescolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "area", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "show_percentage", "value": "false" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "Critical,High,Medium,Information" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "seriescolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "seriescolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "seriescolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "seriescolor" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1715782512114", "title": "Latest Veeam Backup & Replication Security Events", "creation_time": 1727085304210, "description": "Information about the latest security events triggered on each Veeam Backup & Replication server.", "data": { "params": [ { "name": "vbr_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\",\"42220\",\"25500\",\"26100\",\"28100\",\"28970\",\"29800\",\"30100\",\"30400\",\"31500\",\"31600\",\"31700\",\"31800\",\"31900\",\"40204\",\"40400\",\"40500\",\"40600\",\"42260\",\"42270\",\"42302\",\"23090\",\"23420\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"28980\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"41402\",\"115\",\"31210\",\"31400\",\"40201\",\"40205\",\"40206\",\"41610\",\"41800\",\"41810\",\"42230\",\"42301\",\"42401\",\"42402\",\"42404\",\"42405\",\"21224\",\"26110\",\"31200\",\"36013\",\"42210\",\"42403\",\"42500\",\"27000\",\"24060\",\"24030\",\"24050\",\"24070\",\"24040\",\"42290\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _severity=if(\r\n _instanceId in (\"21224\",\"23090\",\"25500\",\"28200\",\"28980\",\"29900\",\"30200\",\"31400\",\"31800\",\"32200\",\"40201\",\"40204\",\"40206\",\"41402\",\"41600\",\"41800\",\"41810\",\"42220\",\"42301\",\"42401\",\"42402\"), \"Critical\", \r\n _instanceId in (\"115\",\"23420\",\"24030\",\"24050\",\"24080\",\"27000\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"30100\",\"31200\",\"31700\",\"31900\",\"32120\",\"40205\",\"40400\",\"40600\",\"42260\",\"42280\",\"42290\",\"42302\",\"42405\"), \"High\",\r\n _instanceId in (\"24040\",\"24060\",\"24070\",\"26100\",\"26110\",\"28100\",\"28970\",\"29800\",\"31210\",\"36013\",\"40500\"), \"Medium\",\r\n _instanceId in (\"24020\",\"30400\",\"30500\",\"31500\",\"31600\",\"41610\",\"42210\",\"42230\",\"42270\",\"42404\",\"42500\"), \"Information\", \"\"),\r\n _user=arrayindex(if(\r\n _instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"36013\"), regextract(_raw_log, \"InitiatorName\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"41800\",\"41810\"), regextract(_raw_log, \"param3\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"23090\",\"23420\",\"41402\"), regextract(_raw_log, \"param6\\=\\\"([^\\\"]*)\\\"\"),\r\n _instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\", \"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), \r\n regextract(_raw_log, \"user\\=\\\"([^\\\"]*)\\\"\")\r\n ), 0)\r\n| filter _host in ($vbr_hosts) \r\n| sort desc _time\r\n| fields\r\n _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1719413377594", "title": "Latest Veeam One Alarms", "creation_time": 1727085304464, "description": "Information about the latest alarms triggered on each Veeam ONE server.", "data": { "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| filter _host in ($one_hosts)\r\n| sort desc _time\r\n| fields _host as `Data Source`, _time as `Date`, _alarmName as `Alarm Name`, _severity as `Severity`, _alarmType as `Alarm Type`, _description as `Message Details`, _statusOld as `Previous Status`, _statusNew as `Current Status`, _objectName as `Object Name`, _objectPath as `Object Path`\r\n| limit 100", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1719484549012", "title": "Daily Veeam One Alarms", "creation_time": 1727085303425, "description": "Daily statistics on Veeam ONE alarms by severity level.", "data": { "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter _day=date_floor(_time ,\"d\"),\r\n _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp \r\n count(if(_severity = \"Critical\", 1)) as Critical, \r\n count(if(_severity = \"High\", 1)) as High,\r\n count(if(_severity = \"Medium\", 1)) as Medium,\r\n count(if(_severity = \"Information\", 1)) as Information by _day\r\n| sort asc _day\r\n\r\n\r\n\r\n\n| view graph type = area subtype = standard show_percentage = `false` xaxis = _day yaxis = Critical,High,Medium,Information seriescolor(\"Critical\",\"#D10000\") seriescolor(\"Medium\",\"#0084D1\") seriescolor(\"High\",\"#FF8F2E\") seriescolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "area", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "show_percentage", "value": "false" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "Critical,High,Medium,Information" } }, { "func": { "args": [ "Critical", "#D10000" ], "name": "seriescolor" } }, { "func": { "args": [ "Medium", "#0084D1" ], "name": "seriescolor" } }, { "func": { "args": [ "High", "#FF8F2E" ], "name": "seriescolor" } }, { "func": { "args": [ "Information", "#00D15F" ], "name": "seriescolor" } } ] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}", "columnWidth": null } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1719488295523", "title": "Veeam ONE Alarms", "creation_time": 1727085304948, "description": "The total amount of Veeam ONE alarms.", "data": { "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| alter _severity=if(\r\n _instanceId in (\"364\",\"391\",\"365\",\"370\",\"314\",\"331\",\"403\",\"342\",\"315\",\"332\",\"344\"), \"Critical\", \r\n _instanceId in (\"395\",\"369\",\"376\",\"377\",\"316\",\"381\",\"378\"), \"Medium\")\r\n| comp count(_instanceId ) as _count by _severity\r\n\r\n\r\n\r\n| view graph type = pie subtype = full xaxis = _severity yaxis = _count valuecolor(\"Critical\",\"#D10000\") valuecolor(\"High\",\"#FF8F2E\") valuecolor(\"Medium\",\"#0084D1\") valuecolor(\"Information\",\"#00D15F\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_severity" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } }, { "func": { "args": [ "\"Critical\"", "\"#D10000\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"High\"", "\"#FF8F2E\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Medium\"", "\"#0084D1\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Information\"", "\"#00D15F\"" ], "name": "valuecolor" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1719493861066", "title": "Veeam One Alarms by Name", "creation_time": 1727085305148, "description": "The breakdown of Veeam ONE alarms by name.", "data": { "params": [ { "name": "one_hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"predefined_alarm_id\\=\\\"(\\d+)\\\"\"),0)\r\n| filter _instanceId in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\r\n| alter\r\n _host=arrayindex(regextract(_raw_log , \"<\\d+>\\d\\s+\\S+\\s+(\\S+)\\s\"), 0),\r\n _description=arrayindex(regextract(_raw_log, \"alarm_details\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmName=arrayindex(regextract(_raw_log, \"alarm_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _alarmType=arrayindex(regextract(_raw_log, \"alarm_type\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectName=arrayindex(regextract(_raw_log, \"object_name\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusNew=arrayindex(regextract(_raw_log, \"status_new\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _statusOld=arrayindex(regextract(_raw_log, \"status_old\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n _objectPath=arrayindex(regextract(_raw_log, \"object_path\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($one_hosts)\r\n| comp count(_instanceId ) as _count by _alarmName\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = pie subtype = full xaxis = _alarmName yaxis = _count ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "full" } }, { "command": { "op": "=", "name": "xaxis", "value": "_alarmName" } }, { "command": { "op": "=", "name": "yaxis", "value": "_count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } }, { "widget_key": "xql_1721205591354", "title": "Four-Eyes Authorization Events\u00a0by Operation", "creation_time": 1727085303785, "description": "The breakdown of Veeam Backup & Replication four-eyes authorization events by operation.", "data": { "params": [ { "name": "hosts", "value": "*" } ], "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter \r\n _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0))\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n _day=date_floor(_time ,\"d\"),\r\n _operationId=arrayindex(regextract(_raw_log, \"OperationId\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| filter _host in ($hosts)\r\n| comp \r\n count(if(_operationId = \"0\", 1)) as _MDAEnabled,\r\n count(if(_operationId = \"1\", 1)) as _MDADisabled,\r\n count(if(_operationId = \"100\", 1)) as _MDABackupDeletion,\r\n count(if(_operationId = \"101\", 1)) as _MDALogBackupDeletion,\r\n count(if(_operationId = \"102\", 1)) as _MDAConfigurationBackupDeletion,\r\n count(if(_operationId = \"103\", 1)) as _MDAAdminApproval,\r\n count(if(_operationId = \"104\", 1)) as _MDASanSnapshotDeletion,\r\n count(if(_operationId = \"105\", 1)) as _MDAInfraItemDeletion,\r\n count(if(_operationId = \"106\", 1)) as _MDAServiceProviderDeletion,\r\n count(if(_operationId = \"107\", 1)) as _MDAStorageDeletion,\r\n count(if(_operationId = \"108\", 1)) as _MDAVbrSecuritySettingsChange,\r\n count(if(_operationId = \"10000\", 1)) as _MDAStaticInfo by _day\r\n| sort asc _day\r\n\r\n\n| view graph type = column subtype = stacked xaxis = _day yaxis = _MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo seriestitle(\"_MDAEnabled\",\"Four-eyes authorization has been enabled\") seriestitle(\"_MDADisabled\",\"Four-eyes authorization has been disabled\") seriestitle(\"_MDABackupDeletion\",\"Delete backup\") seriestitle(\"_MDALogBackupDeletion\",\"Delete log backup\") seriestitle(\"_MDAConfigurationBackupDeletion\",\"Delete configuration backup\") seriestitle(\"_MDAAdminApproval\",\"Disable four-eyes authorization\") seriestitle(\"_MDASanSnapshotDeletion\",\"Delete snapshot\") seriestitle(\"_MDAInfraItemDeletion\",\"Delete infrastructure object\") seriestitle(\"_MDAServiceProviderDeletion\",\"Delete service provider\") seriestitle(\"_MDAStorageDeletion\",\"Delete storage\") seriestitle(\"_MDAVbrSecuritySettingsChange\",\"Update Veeam Backup & Replication security settings\") seriestitle(\"_MDAStaticInfo\",\"Other operations\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "stacked" } }, { "command": { "op": "=", "name": "xaxis", "value": "_day" } }, { "command": { "op": "=", "name": "yaxis", "value": "_MDAEnabled,_MDADisabled,_MDABackupDeletion,_MDALogBackupDeletion,_MDAConfigurationBackupDeletion,_MDAAdminApproval,_MDASanSnapshotDeletion,_MDAInfraItemDeletion,_MDAServiceProviderDeletion,_MDAStorageDeletion,_MDAVbrSecuritySettingsChange,_MDAStaticInfo" } }, { "func": { "args": [ "_MDAEnabled", "Four-eyes authorization has been enabled" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDADisabled", "Four-eyes authorization has been disabled" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDABackupDeletion", "Delete backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDALogBackupDeletion", "Delete log backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAConfigurationBackupDeletion", "Delete configuration backup" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAAdminApproval", "Disable four-eyes authorization" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDASanSnapshotDeletion", "Delete snapshot" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAInfraItemDeletion", "Delete infrastructure object" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAServiceProviderDeletion", "Delete service provider" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAStorageDeletion", "Delete storage" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAVbrSecuritySettingsChange", "Update Veeam Backup & Replication security settings" ], "name": "seriestitle" } }, { "func": { "args": [ "_MDAStaticInfo", "Other operations" ], "name": "seriestitle" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "veeam_*" ], "query_uses_library": false } } ], "fromVersion": "8.9.0", "supportedModules": [ "xsiam" ] }