Threat Detected

Sent when a ransomware or malware threat is detected on a workload tenant.

General Information

Event ID: vdc.workload_v0.tenant_v0.threat.threatDetected_v0

Event message details: Sent once for each threat, when the threat becomes visible to the customer.

Severity: High

Workloads: Veeam Data Cloud for Microsoft 365

Parameters

Parameters
Parameter Name	Description	Example
specversion	Event schema version.	ev20260814
source	System that sent the event. Possible values: CONTROLPLANE, M365, AZURE.	M365
timestamp	Time when the event happened, in RFC3339Nano format and the UTC time zone.	2026-09-28T03:20:00Z
type	Event ID.	vdc.workload_v0.tenant_v0.threat.threatDetected_v0
severity	Event severity. Possible values: INFO, LOW, MEDIUM, HIGH, CRITICAL.	HIGH
visibility	Intended visibility scope of the event. Only events with the CUSTOMER_ACCESSIBLE value are forwarded to SIEM platforms, so a forwarded event always carries this value.	CUSTOMER_ACCESSIBLE
category	Event category. Possible values: BACKUP, RESTORE, LOGIN, USER_MANAGEMENT, TENANT_MANAGEMENT, ORGANIZATION_MANAGEMENT, SUBSCRIPTION_MANAGEMENT, SECURITY_ALERT, INTERNAL.	SECURITY_ALERT
actor.kind	Actor type that triggered the event. Possible values: user, system, service_account.	system
organizationReference.workloadTenantId	Workload tenant ID.	tenant_12345
orgId	ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.	org_12345
data.workload.type	Workload type.	M365
data.tenant.id	Tenant ID.	tenant_12345
data.threatDetected.id	Threat ID.	b3f1c2a4-0000-0000-0000-000000000000
data.threatDetected.type	Threat type. Possible values: RANSOMWARE, MALWARE.	RANSOMWARE
data.threatDetected.entityId	Affected entity ID.	3f2504e0-4f89-11d3-9a0c-0305e82c3301
data.threatDetected.entityName	Display name of the affected entity.	Contoso Engineering Hub
data.threatDetected.resourceType	Resource type of the affected entity, for example, SITE or ONEDRIVE.	SITE
data.threatDetected.entityUrl	URL of the affected entity. Absent when the entity has no URL.	https://contoso.sharepoint.com/sites/engineering
data.threatDetected.backupSessionId	ID of the backup session in which the threat was detected.	session_12345
data.threatDetected.backupTime	Date and time when the backup containing the threat was created.	2026-09-28T03:15:22Z
data.threatDetected.reportedAt	Date and time when the threat was first reported.	2026-09-28T03:20:00Z
data.threatDetected.impactedObjectsCount	Number of files affected by the threat.	25
data.threatDetected.explanation	Reason the threat was detected. Absent when no reason is available.	Potential ransomware activity detected: original files are being overwritten with encrypted content.

Event Example

{
  "specversion": "ev20260814",
  "source": "M365",
  "timestamp": "2026-09-28T03:20:00Z",
  "type": "vdc.workload_v0.tenant_v0.threat.threatDetected_v0",
  "severity": "HIGH",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "SECURITY_ALERT",
  "actor": {
    "kind": "system"
  },
  "organizationReference": {
    "workloadTenantId": "tenant_12345"
  },
  "orgId": "org_12345",
  "data": {
    "workload": {
      "type": "M365"
    },
    "tenant": {
      "id": "tenant_12345"
    },
    "threatDetected": {
      "id": "b3f1c2a4-0000-0000-0000-000000000000",
      "type": "RANSOMWARE",
      "entityId": "3f2504e0-4f89-11d3-9a0c-0305e82c3301",
      "entityName": "Contoso Engineering Hub",
      "resourceType": "SITE",
      "entityUrl": "https://contoso.sharepoint.com/sites/engineering",
      "backupSessionId": "session_12345",
      "backupTime": "2026-09-28T03:15:22Z",
      "reportedAt": "2026-09-28T03:20:00Z",
      "impactedObjectsCount": 25,
      "explanation": "Potential ransomware activity detected: original files are being overwritten with encrypted content."
    }
  }
}