All Veeam malware detection events for the last 24h

Provides an overview of Veeam Backup & Replication malware detection events created for the last 24 hours.

Veeam App Last 24h

Details

IDe4ace68a9e854adea581c694d85fb2fc
Time FrameLast 24h
From Version8.4.0
Supported Modulesxsiam

Widgets (4)

Marked as Infected

The total amount of Veeam Backup & Replication objects marked as Infected.

Custom XQL single 

dataset in (veeam_*) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("42220")
| alter _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0)
| filter _host in ($vbr_hosts)
| comp count(_instanceId) as _count






| view graph type = single subtype = standard yaxis = _count

Marked as Suspicious

The total amount of Veeam Backup & Replication objects marked as Suspicious.

Custom XQL single 

dataset in (veeam_*) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("41600")
| alter _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0)
| filter _host in ($vbr_hosts)
| comp count(_instanceId) as _count




| view graph type = single subtype = standard yaxis = _count

Malware Detection Events by Type

Custom XQL pie 

dataset in (veeam_*) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("42220", "41600")
| alter _host=arrayindex(regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"), 0),
        _type=if(_instanceId = "42220", "Infected", "Suspicious")
| comp count(_instanceId) as _count by _type
| view graph type = pie subtype = full xaxis = _type yaxis = _count

Latest Malware Detection Events

Custom XQL table 

dataset in (veeam_*) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("41600", "42220")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0)
| sort desc _time
| fields
    _host as `Data Source`, _time as `Date`, _instanceId as `Event ID`, _user as `User`, _description as `Message Details`, _severity as `Severity`

Source

Veeam_All_Veeam_malware_detection_events_for_the_last_24h.json
Download History Raw 
{
  "templates_data": [
    {
      "id": "e4ace68a9e854adea581c694d85fb2fc",
      "name": "All Veeam malware detection events for the last 24h",
      "report_name": "All Veeam malware detection events for the last 24h",
      "report_description": "Provides an overview of Veeam Backup & Replication malware detection events created for the last 24 hours.",
      "layout": [
        {
          "id": "Row 1",
          "data": [
            {
              "key": "header",
              "data": {
                "name": "All malware detection events for the last 24h",
                "type": "",
                "width": 100,
                "height": 140,
                "tenantId": "2209138820274",
                "description": "Provides an overview of Veeam Backup & Replication malware detection events created for the last 24 hours.",
                "customerName": "Veeam Software Corporation (Tech Partner Only)"
              }
            }
          ]
        },
        {
          "id": "row-6109",
          "data": [
            {
              "key": "xql_1715782213232",
              "data": {
                "type": "Custom XQL",
                "width": 33.333332,
                "height": 366,
                "params": [
                  {
                    "name": "vbr_hosts",
                    "value": "*"
                  }
                ],
                "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ",
                "time_frame": {
                  "relativeTime": 86400000
                },
                "viewOptions": {
                  "type": "single",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "standard"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "_count"
                      }
                    }
                  ]
                }
              }
            },
            {
              "key": "xql_1715782276516",
              "data": {
                "type": "Custom XQL",
                "width": 33.333332,
                "height": 366,
                "params": [
                  {
                    "name": "vbr_hosts",
                    "value": "*"
                  }
                ],
                "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ",
                "time_frame": {
                  "relativeTime": 86400000
                },
                "viewOptions": {
                  "type": "single",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "standard"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "_count"
                      }
                    }
                  ]
                }
              }
            },
            {
              "key": "xql",
              "data": {
                "type": "Custom XQL",
                "title": "Malware Detection Events by Type",
                "width": null,
                "height": 366,
                "params": [],
                "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\", \"41600\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0),\r\n        _type=if(_instanceId = \"42220\", \"Infected\", \"Suspicious\")\r\n| comp count(_instanceId) as _count by _type\r\n| view graph type = pie subtype = full xaxis = _type yaxis = _count ",
                "time_frame": {
                  "relativeTime": 86400000
                },
                "viewOptions": {
                  "type": "pie",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "full"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "xaxis",
                        "value": "_type"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "_count"
                      }
                    }
                  ]
                }
              }
            }
          ]
        },
        {
          "id": "row-4448",
          "data": [
            {
              "key": "xql",
              "data": {
                "type": "Custom XQL",
                "title": "Latest Malware Detection Events",
                "width": 100,
                "height": 848,
                "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\", \"42220\")\r\n| alter\r\n    _time= parse_timestamp(\"%FT%H:%M:%E6S%Ez\", arrayindex(regextract(_raw_log, \"<\\d+>1\\s+(\\S+)\\s\"), 0)),\r\n    _host=regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"),\r\n    _description=arrayindex(regextract(_raw_log, \"Description\\=\\\"([^\\\"]*)(?:\\\"|$)\"),0),\r\n    _severity=\"Critical\",\r\n    _user=arrayindex(regextract(_raw_log, \"UserName\\=\\\"([^\\\"]*)\\\"\"), 0)\r\n| sort desc _time\r\n| fields\r\n    _host as `Data Source`, _time as `Date`, _instanceId as `Event ID`, _user as `User`, _description as `Message Details`, _severity as `Severity`",
                "time_frame": {
                  "relativeTime": 86400000
                },
                "viewOptions": {
                  "type": "table",
                  "commands": []
                }
              }
            }
          ]
        }
      ],
      "default_template_id": 1,
      "time_frame": {
        "relativeTime": 86400000
      },
      "global_id": "e4ace68a9e854adea581c694d85fb2fc",
      "time_offset": 10800,
      "metadata": "{\"params\": []}"
    }
  ],
  "fromVersion": "8.4.0",
  "widgets_data": [
    {
      "widget_key": "xql_1715782213232",
      "title": "Marked as Infected",
      "creation_time": 1727085304545,
      "description": "The total amount of Veeam Backup & Replication objects marked as Infected.",
      "data": {
        "params": [
          {
            "name": "vbr_hosts",
            "value": "*"
          }
        ],
        "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"42220\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ",
        "time_frame": {
          "relativeTime": 86400000
        },
        "viewOptions": {
          "type": "single",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "subtype",
                "value": "standard"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "_count"
              }
            }
          ]
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [
          "veeam_*"
        ],
        "query_uses_library": false
      }
    },
    {
      "widget_key": "xql_1715782276516",
      "title": "Marked as Suspicious",
      "creation_time": 1727085304626,
      "description": "The total amount of Veeam Backup & Replication objects marked as Suspicious.",
      "data": {
        "params": [
          {
            "name": "vbr_hosts",
            "value": "*"
          }
        ],
        "phrase": "dataset in (veeam_*) \r\n| filter _vendor=\"Veeam\"\r\n| alter \r\n    _instanceId=arrayindex(regextract(_raw_log, \"instanceId\\=(\\d+)\\s\"), 0)\r\n| filter _instanceId in (\"41600\")\r\n| alter _host=arrayindex(regextract(_raw_log , \"\\s(\\S+)\\s(?:Veeam_MP|Veeam_Backup)\"), 0)\r\n| filter _host in ($vbr_hosts)\r\n| comp count(_instanceId) as _count\r\n\r\n\r\n\r\n\n| view graph type = single subtype = standard yaxis = _count ",
        "time_frame": {
          "relativeTime": 86400000
        },
        "viewOptions": {
          "type": "single",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "subtype",
                "value": "standard"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "_count"
              }
            }
          ]
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [
          "veeam_*"
        ],
        "query_uses_library": false
      }
    }
  ],
  "supportedModules": [
    "xsiam"
  ]
}