Restore Status Changed

Sent when a restore execution starts, is aborted, or finishes with a success, warning or failure result.

General Information

Event ID: vdc.workload_v0.tenant_v0.restore.execution_v0.lifecycle_v0

Event message details: Sent with data.lifecycle.status set to STARTED, SUCCESS, WARNING, ABORTED or FAILED.

Severity: Varies depending on data.lifecycle.status.

General Information
data.lifecycle.status	Severity
STARTED	Info
SUCCESS	Info
WARNING	Low
ABORTED	Medium
FAILED	Critical

Workloads: Veeam Data Cloud for Microsoft 365

Parameters

The parameter set is the same for every source that sends this event.

Parameters
Parameter Name	Description	Example
specversion	Event schema version.	ev20260814
source	System that sent the event. Possible values: CONTROLPLANE, M365.	M365
timestamp	Time when the event happened, in RFC3339Nano format and the UTC time zone.	2026-08-04T09:18:42Z
type	Event ID.	vdc.workload_v0.tenant_v0.restore.execution_v0.lifecycle_v0
severity	Event severity. Possible values: INFO, LOW, MEDIUM, HIGH, CRITICAL.	INFO
visibility	Intended visibility scope of the event. Only events with the CUSTOMER_ACCESSIBLE value are forwarded to SIEM platforms, so a forwarded event always carries this value.	CUSTOMER_ACCESSIBLE
category	Event category. Possible values: BACKUP, RESTORE, LOGIN, USER_MANAGEMENT, TENANT_MANAGEMENT, ORGANIZATION_MANAGEMENT, SUBSCRIPTION_MANAGEMENT, SECURITY_ALERT, INTERNAL.	RESTORE
actor.identifier	Actor identifier.	alice@example.com
actor.kind	Actor type that triggered the event. Possible values: user, system, service_account.	user
organizationReference.workloadTenantId	Workload tenant ID.	tenant_12345
orgId	ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.	org_12345
data.workload.type	Workload type.	M365
data.tenant.id	Tenant ID.	tenant_12345
data.execution.id	Restore execution ID.	execution_12345
data.lifecycle.startTime	Time at which the restore execution started.	2026-08-04T09:12:00Z
data.lifecycle.endTime	Time at which the restore execution completed.	2026-08-04T09:18:42Z
data.lifecycle.status	Current restore execution status. Possible values: QUEUED, STARTED, SUCCESS, WARNING, FAILED, ABORTED.	STARTED

Event Example

Restore Started

{
  "specversion": "ev20260814",
  "source": "M365",
  "timestamp": "2026-08-04T09:18:42Z",
  "type": "vdc.workload_v0.tenant_v0.restore.execution_v0.lifecycle_v0",
  "severity": "INFO",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "RESTORE",
  "actor": {
    "identifier": "alice@example.com",
    "kind": "user"
  },
  "organizationReference": {
    "workloadTenantId": "tenant_12345"
  },
  "orgId": "org_12345",
  "data": {
    "workload": {
      "type": "M365"
    },
    "tenant": {
      "id": "tenant_12345"
    },
    "execution": {
      "id": "execution_12345"
    },
    "lifecycle": {
      "startTime": "2026-08-04T09:12:00Z",
      "status": "STARTED"
    }
  }
}

Restore Stopped

{
  "specversion": "ev20260814",
  "source": "M365",
  "timestamp": "2026-08-04T09:18:42Z",
  "type": "vdc.workload_v0.tenant_v0.restore.execution_v0.lifecycle_v0",
  "severity": "MEDIUM",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "RESTORE",
  "actor": {
    "identifier": "alice@example.com",
    "kind": "user"
  },
  "organizationReference": {
    "workloadTenantId": "tenant_12345"
  },
  "orgId": "org_12345",
  "data": {
    "workload": {
      "type": "M365"
    },
    "tenant": {
      "id": "tenant_12345"
    },
    "execution": {
      "id": "execution_12345"
    },
    "lifecycle": {
      "startTime": "2026-08-04T09:12:00Z",
      "endTime": "2026-08-04T09:18:42Z",
      "status": "ABORTED"
    }
  }
}

Restore Resulted in Success