---
title: "Correlation Rule Templates"
description: "This section contains the list of Veeam correlation rule templates with recommended settings and examples of XQL search queries. For more details on how to add a correlation, see Adding Correlations."
canonical: "https://helpcenter.veeam.com/docs/security_plugins_xsiam/guide/xsiam_correlations_templates.html"
breadcrumb: "User Guide > Configuring Veeam App for Palo Alto Networks XSIAM > Configuring Correlations > Correlation Rule Templates"
dateModified: "2026-08-21"
---

# Correlation Rule Templates

This section contains the list of Veeam correlation rule templates with recommended settings and examples of XQL search queries. For more details on how to add a correlation, see [Adding Correlations](xsiam_correlations_add.md).

::: dropdown
### Allowed Attempts for Multi-Factor Authentication Exceeded

**Rule Name**: Allowed Attempts for Multi-Factor Authentication Exceeded

**Rule Description**: Triggers an alert when search results include events with ID 40206 (Allowed Attempts for Multi-Factor Authentication Exceeded). The event is sent when a user exceeds the allowed number of attempts for multi-factor authentication.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("40206")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0),
    _endpoint=arrayindex(regextract(_raw_log, "Endpoint\=\"([^\"]*)\""), 0),
    _sid=arrayindex(regextract(_raw_log, "SID\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _endpoint as `Endpoint`, _sid as `User SID`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Archive Repository Deleted

**Rule Name**: Archive Repository Deleted

**Rule Description**: Triggers an alert when search results include events with ID 29900 (Archive Repository Deleted). The event is sent when a user deletes an archive repository from the backup infrastructure.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("29900")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0),
    _name=arrayindex(regextract(_raw_log, "Name\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _name as `Object Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Attempt to Delete Backup Failed

**Rule Name**: Attempt to Delete Backup Failed

**Rule Description**: Triggers an alert when search results include events with ID 41800 (Attempt to Delete Backup Failed). The event is sent when a user with insufficient privileges tries to delete a backup file.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("41800")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "param3\=\"([^\"]*)\""), 0),
    _endpoint=arrayindex(regextract(_raw_log, "param2\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _endpoint as `Endpoint`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Attempt to Update Security Object Failed

**Rule Name**: Attempt To Update Security Object Failed

**Rule Description**: Triggers an alert when search results include events with ID 41810 (Attempt To Update Security Object Failed). The event is sent when a user with insufficient privileges tries to update a security object including users and roles, credential records, certificates, or passwords.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("41810")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "param3\=\"([^\"]*)\""), 0),
    _endpoint=arrayindex(regextract(_raw_log, "param2\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _endpoint as `Endpoint`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Backup Repository Deleted

**Rule Name**: Backup Repository Deleted

**Rule Description**: Triggers an alert when search results include events with ID 28200 (Backup Repository Deleted). The event is sent when a user deletes a backup repository from the backup infrastructure.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("28200")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0),
    _repositoryName=arrayindex(regextract(_raw_log, "Name\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _repositoryName as `Object Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Connection to Backup Repository Lost

**Rule Name**: Connection to Backup Repository Lost

**Rule Description**: Triggers an alert when search results include events with ID 21224 (Connection to Backup Repository Lost). The event is sent when a backup server fails to connect to a backup repository.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("21224")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _hostName=arrayindex(regextract(_raw_log, "HostName\=\"([^\"]*)\""), 0),
    _objectName=arrayindex(regextract(_raw_log, "ObjectName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _hostName as `Data Source Name`, _objectName as `Object Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Credential Record Deleted

**Rule Name**: Credential Record Deleted

**Rule Description**: Triggers an alert when search results include events with ID 25500 (Credential Record Deleted). The event is sent when a user deletes a credential record.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("25500")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0),
    _accountName=arrayindex(regextract(_raw_log, "AccountName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _accountName as `Credential Record`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Encryption Password Deleted

**Rule Name**: Encryption Password Deleted

**Rule Description**: Triggers an alert when search results include events with ID 31800 (Encryption Password Deleted). The event is sent when a user deletes an encryption password.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("31800")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0),
    _hint=arrayindex(regextract(_raw_log, "Hint\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _hint as `Hint`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### External Repository Deleted

**Rule Name**: External Repository Deleted

**Rule Description**: Triggers an alert when search results include events with ID 32200 (External Repository Deleted). The event is sent when a user deletes an external repository from the backup infrastructure.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("32200")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0),
    _repositoryName=arrayindex(regextract(_raw_log, "RepositoryName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _repositoryName as `Object Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Four-Eyes Authorization Disabled

**Rule Name**: Four-Eyes Authorization Disabled

**Rule Description**: Triggers an alert when search results include events with ID 42401 (Four-Eyes Authorization Disabled). The event is sent when a user disables four-eyes authorization.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("42401")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _operation=arrayindex(regextract(_raw_log, "Operation\=\"([^\"]*)\""), 0),
_user=arrayindex(regextract(_raw_log, "FullName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, 
 _operation as `Operation Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Four-Eyes Authorization Request Created

**Rule Name**: Four-Eyes Authorization Request Created

**Rule Description**: Triggers an alert when search results include events with ID 42402 (Four-Eyes Authorization Request Created). The event is sent when a user creates a four-eyes authorization request.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("42402")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _operation=arrayindex(regextract(_raw_log, "Operation\=\"([^\"]*)\""), 0),
    _user=arrayindex(regextract(_raw_log, "FullName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _operation as `Operation Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Job Deleted

**Rule Name**: Job Deleted

**Rule Description**: Triggers an alert when search results include events with ID 23090 (Job Deleted). The event is sent when a user deletes a job.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("23090")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "param6\=\"([^\"]*)\""), 0),
    _jobName=arrayindex(regextract(_raw_log, "JobName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _jobName as `Job Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### KMS Server Deleted

**Rule Name**: KMS Server Deleted

**Rule Description**: Triggers an alert when search results include events with ID 42301 (KMS Server Deleted). The event is sent when a user deletes a KMS server.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("42301")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0),
    _name=arrayindex(regextract(_raw_log, "Name\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _name as `Object Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Malware Activity Detected

**Rule Name**: Malware Activity Detected

**Rule Description**: Triggers an alert when search results include events with ID 41600 (Malware Activity Detected). The event is sent when malware activity is detected.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("41600")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _activityType=arrayindex(regextract(_raw_log, "ActivityType\=\"([^\"]*)\""), 0),
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _activityType as `Malware Detection Method`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Malware Detection Settings Updated

**Rule Name**: Malware Detection Settings Updated

**Rule Description**: Triggers an alert when search results include events with ID 42290 (Malware Detection Settings Updated). The event is sent when a user updates malware detection settings.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("42290")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="High",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: High

**Category**: Other

:::

::: dropdown
### Multi-Factor Authentication Disabled

**Rule Name**: Multi-Factor Authentication Disabled

**Rule Description**: Triggers an alert when search results include events with ID 40201 (Multi-Factor Authentication Disabled). The event is sent when a user disables multi-factor authentication for all users.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("40201")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "fullName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Multi-Factor Authentication for User Disabled

**Rule Name**: Multi-Factor Authentication for User Disabled

**Rule Description**: Triggers an alert when search results include events with ID 40204 (Multi-Factor Authentication for User Disabled). The event is sent when a user disables multi-factor authentication for a service account.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("40204")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "fullName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Object Storage Deleted

**Rule Name**: Object Storage Deleted

**Rule Description**: Triggers an alert when search results include events with ID 28980 (Object Storage Deleted). The event is sent when a user deletes an object storage repository from the backup infrastructure.

**XQL Search**:

```
 dataset in (DATASET_NAME )
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("28980")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0),
    _name=arrayindex(regextract(_raw_log, "param4\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _name as `Object Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### Storage Deleted

**Rule Name**: Storage Deleted

**Rule Description**: Triggers an alert when search results include events with ID 41402 (Storage Deleted). The event is sent when a user deletes a storage appliance from the backup infrastructure.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("41402")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "param6\=\"([^\"]*)\""), 0),
    _name=arrayindex(regextract(_raw_log, "name\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _name as `Object Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::

::: dropdown
### User or Group Deleted

**Rule Name**: User or Group Deleted

**Rule Description**: Triggers an alert when search results include events with ID 31400 (User or Group Deleted). The event is sent when a user deletes a user or a user group.

**XQL Search**:

```
 dataset in (DATASET_NAME ) 
| filter _vendor="Veeam"
| alter 
    _instanceId=arrayindex(regextract(_raw_log, "instanceId\=(\d+)\s"), 0)
| filter _instanceId in ("31400")
| alter
    _time= parse_timestamp("%FT%H:%M:%E6S%Ez", arrayindex(regextract(_raw_log, "<\d+>1\s+(\S+)\s"), 0)),
    _host=regextract(_raw_log , "\s(\S+)\s(?:Veeam_MP|Veeam_Backup)"),
    _description=arrayindex(regextract(_raw_log, "Description\=\"([^\"]*)(?:\"|$)"),0),
    _severity="Critical",
    _user=arrayindex(regextract(_raw_log, "UserName\=\"([^\"]*)\""), 0)
| fields
     _time as `Date`, _host as `Data Source`, _instanceId as `Event ID`, _user as `User Name`, _description as `Message Details`, _severity as `Severity`
```

**Time Schedule**: Every 10 minutes

**Action**: Generate alert

**Alert Domain**: Security

**Severity**: Critical

**Category**: Other

:::