All Veeam four-eyes authorization events for the last 24h

{
  "templates_data": [
    {
      "id": "96bfe2191cd64b818682ecbf6c94b55b",
      "name": "All Veeam four-eyes authorization events for the last 24h",
      "report_name": "All Veeam four-eyes authorization events for the last 24h",
      "report_description": "Provides an overview of Veeam Backup & Replication four-eyes authorization events created for the last 24 hours.",
      "layout": [
        {
          "id": "Row 1",
          "data": [
            {
              "key": "header",
              "data": {
                "name": "All four-eyes authorization events for the last 24h",
                "type": "",
                "width": 100,
                "height": 140,
                "tenantId": "2209138820274",
                "description": "Provides an overview of Veeam Backup & Replication four-eyes authorization events created for the last 24 hours.",
                "customerName": "Veeam Software Corporation (Tech Partner Only)"
              }
            }
          ]
        },
        {
          "id": "row-3556",
          "data": [
            {
              "key": "xql_1715782338600",
              "data": {
                "type": "Custom XQL",
                "width": 50,
                "height": 349,
                "params": [
                  {
                    "name": "vbr_hosts",
                    "value": "*"
                  }
                ],
                "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ",
                "time_frame": {
                  "relativeTime": 86400000
                },
                "viewOptions": {
                  "type": "single",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "standard"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "_count"
                      }
                    }
                  ]
                }
              }
            },
            {
              "key": "xql",
              "data": {
                "type": "Custom XQL",
                "title": "Four-Eyes Authorization Events by Type",
                "width": 50,
                "height": 349,
                "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in ( \"42402\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n        _operation=arrayindex(regextract(_raw_log, \"Operation\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0)\r\n| comp count(_instanceId ) as _count by _operation\r\n| view graph type = pie subtype = full xaxis = _operation yaxis = _count ",
                "time_frame": {
                  "relativeTime": 86400000
                },
                "viewOptions": {
                  "type": "pie",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "full"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "xaxis",
                        "value": "_operation"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "_count"
                      }
                    }
                  ]
                }
              }
            }
          ]
        },
        {
          "id": "row-6294",
          "data": [
            {
              "key": "xql",
              "data": {
                "type": "Custom XQL",
                "title": "Latest\u00a0Four-Eyes Authorization Events",
                "width": 100,
                "height": 844,
                "params": [],
                "phrase": " dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in ( \"42402\")\r\n| alter\r\n    _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n    _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n    _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _severity=\"Critical\",\r\n    _user=arrayindex(regextract(_raw_log, \"fullName\\=\\\"([^\\\"]*)\\\"\"), 0)\r\n| sort desc _time\r\n| fields\r\n    _host as `Data Source`, _time as `Date`, _user as `User`, _description as `Message Details`, _severity as `Severity`\r\n",
                "time_frame": {
                  "relativeTime": 86400000
                },
                "viewOptions": {
                  "type": "table",
                  "commands": []
                }
              }
            }
          ]
        }
      ],
      "default_template_id": 1,
      "time_frame": {
        "relativeTime": 86400000
      },
      "global_id": "96bfe2191cd64b818682ecbf6c94b55b",
      "time_offset": 10800,
      "metadata": "{\"params\": []}"
    }
  ],
  "fromVersion": "8.9.0",
  "widgets_data": [
    {
      "widget_key": "xql_1715782338600",
      "title": "Four-Eyes Authorization Events",
      "creation_time": 1727085303502,
      "description": "The total amount of Veeam Backup & Replication four-eyes authorization events.",
      "data": {
        "params": [
          {
            "name": "vbr_hosts",
            "value": "*"
          }
        ],
        "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42402\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ",
        "time_frame": {
          "relativeTime": 86400000
        },
        "viewOptions": {
          "type": "single",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "subtype",
                "value": "standard"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "_count"
              }
            }
          ]
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [
          "veeam_*"
        ],
        "query_uses_library": false
      }
    }
  ],
  "supportedModules": [
    "xsiam"
  ]
}