Working with Data Model Rules
Veeam App for Palo Alto Networks XSIAM provides predefined Cortex Data Model (XDM) Rules that map the data received from Veeam Backup & Replication or Veeam ONE servers to the XSIAM Data Model Schema. This allows you to use the data across all Cortex XSIAM data sources.
For more information on Data Model Rules and XSIAM Data Model Schema, see this section in the Cortex XSIAM documentation.
Viewing Data Model Rules
You can find Veeam Data Model Rules in the Settings > Configurations > Data Management > Data Model Rules section, on the Default Rules tab. Data mapping is based on the veeam_veeam_raw dataset.
Using Search Queries
This section contains examples of XQL search queries that include Veeam data and XSIAM Data Model Schema. You can display required information on specific Veeam Backup & Replication events and Veeam ONE alarms filtering data by any parameter available in the dataset, for example, event ID, severity, and so on.
Viewing Events with Critical Severity
|
The query displays all Veeam Backup & Replication events and Veeam ONE alarms with the Critical severity. XQL Query:
|
Viewing Malware Activity Detected Events
|
The query displays all Veeam Backup & Replication events with ID 41600 (Malware Activity Detected). The event is sent when malware activity detected on the backup infrastructure. Highest-severity ransomware indicator in the data model. XQL Query:
|
Viewing Four-Eyes Authorization Disabled Events
|
The query displays all Veeam Backup & Replication events with ID 42401 (Four-Eyes Authorization Disabled). The event is sent when a user disables four-eyes authorization. This removes a key approval control and is often a step taken just before a destructive or malicious action. XQL Query:
|
Viewing Backup Repository Deleted Events
|
The query displays all Veeam Backup & Replication events with ID 28200 (Backup Repository Deleted). The event is sent when a user deletes a backup repository from the backup infrastructure. Directly targets the last line of defense against ransomware and data loss. XQL Query:
|
Viewing Microsoft 365 Backup Job Disabled Alarms
|
The query displays all Veeam ONE triggered alarms with ID 378 (Microsoft 365 Backup Job Disabled). The alarm is triggered when a Microsoft 365 backup job is disabled. Flags a gap in backup coverage that an attacker or an unauthorized user could use to stop protection before an attack. XQL Query:
|