---
title: "Threat Detected"
description: "Sent when a ransomware or malware threat is detected on a workload tenant. Event ID: vdc.workload_v0.tenant_v0.threat.threatDetected_v0 Event message details: Sent once for each threat, when the threat becomes visible to the customer."
canonical: "https://helpcenter.veeam.com/docs/vdc/events/vdc_events_threat_detected.html"
breadcrumb: "Event Reference > Threat Detection > Threat Detected"
dateModified: "2026-11-02"
---

# Threat Detected

Sent when a ransomware or malware threat is detected on a workload tenant.

## General Information

**Event ID**: `vdc.workload_v0.tenant_v0.threat.threatDetected_v0`

**Event message details**: Sent once for each threat, when the threat becomes visible to the customer.

**Severity**: High

**Workloads**: Veeam Data Cloud for Microsoft 365

## Parameters

<table class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>Parameter Name</p>
    </th>
    <th>
      <p>Description</p>
    </th>
    <th>
      <p>Example</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">specversion</span></p>
    </td>
    <td>
      Event schema version.
    </td>
    <td>
      <p><span class="T_Filenames">ev20260814</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">source</span></p>
    </td>
    <td>
      System that sent the event. Possible values: `CONTROLPLANE`, `M365`, `AZURE`.
    </td>
    <td>
      <p><span class="T_Filenames">M365</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">timestamp</span></p>
    </td>
    <td>
      Time when the event happened, in RFC3339Nano format and the UTC time zone.
    </td>
    <td>
      <p><span class="T_Filenames">2026-09-28T03:20:00Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">type</span></p>
    </td>
    <td>
      Event ID.
    </td>
    <td>
      <p><span class="T_Filenames">vdc.workload_v0.tenant_v0.threat.threatDetected_v0</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">severity</span></p>
    </td>
    <td>
      Event severity. Possible values: `INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.
    </td>
    <td>
      <p><span class="T_Filenames">HIGH</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">visibility</span></p>
    </td>
    <td>
      Intended visibility scope of the event. Only events with the `CUSTOMER_ACCESSIBLE` value are forwarded to SIEM platforms, so a forwarded event always carries this value.
    </td>
    <td>
      <p><span class="T_Filenames">CUSTOMER_ACCESSIBLE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">category</span></p>
    </td>
    <td>
      Event category. Possible values: `BACKUP`, `RESTORE`, `LOGIN`, `USER_MANAGEMENT`, `TENANT_MANAGEMENT`, `ORGANIZATION_MANAGEMENT`, `SUBSCRIPTION_MANAGEMENT`, `SECURITY_ALERT`, `INTERNAL`.
    </td>
    <td>
      <p><span class="T_Filenames">SECURITY_ALERT</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.kind</span></p>
    </td>
    <td>
      Actor type that triggered the event. Possible values: `user`, `system`, `service_account`.
    </td>
    <td>
      <p><span class="T_Filenames">system</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">organizationReference.workloadTenantId</span></p>
    </td>
    <td>
      Workload tenant ID.
    </td>
    <td>
      <p><span class="T_Filenames">tenant_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">orgId</span></p>
    </td>
    <td>
      ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.workload.type</span></p>
    </td>
    <td>
      <p>Workload type.</p>
    </td>
    <td>
      <p><span class="T_Filenames">M365</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.tenant.id</span></p>
    </td>
    <td>
      <p>Tenant ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">tenant_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.id</span></p>
    </td>
    <td>
      <p>Threat ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">b3f1c2a4-0000-0000-0000-000000000000</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.type</span></p>
    </td>
    <td>
      <p>Threat type. Possible values: <span class="T_Filenames">RANSOMWARE</span>, <span class="T_Filenames">MALWARE</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">RANSOMWARE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.entityId</span></p>
    </td>
    <td>
      <p>Affected entity ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">3f2504e0-4f89-11d3-9a0c-0305e82c3301</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.entityName</span></p>
    </td>
    <td>
      <p>Display name of the affected entity.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Contoso Engineering Hub</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.resourceType</span></p>
    </td>
    <td>
      <p>Resource type of the affected entity, for example, <span class="T_Filenames">SITE</span> or <span class="T_Filenames">ONEDRIVE</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">SITE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.entityUrl</span></p>
    </td>
    <td>
      <p>URL of the affected entity. Absent when the entity has no URL.</p>
    </td>
    <td>
      <p><span class="T_Filenames">https://contoso.sharepoint.com/sites/engineering</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.backupSessionId</span></p>
    </td>
    <td>
      <p>ID of the backup session in which the threat was detected.</p>
    </td>
    <td>
      <p><span class="T_Filenames">session_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.backupTime</span></p>
    </td>
    <td>
      <p>Date and time when the backup containing the threat was created.</p>
    </td>
    <td>
      <p><span class="T_Filenames">2026-09-28T03:15:22Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.reportedAt</span></p>
    </td>
    <td>
      <p>Date and time when the threat was first reported.</p>
    </td>
    <td>
      <p><span class="T_Filenames">2026-09-28T03:20:00Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.impactedObjectsCount</span></p>
    </td>
    <td>
      <p>Number of files affected by the threat.</p>
    </td>
    <td>
      <p><span class="T_Filenames">25</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.threatDetected.explanation</span></p>
    </td>
    <td>
      <p>Reason the threat was detected. Absent when no reason is available.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Potential ransomware activity detected: original files are being overwritten with encrypted content.</span></p>
    </td>
  </tr>
</table>

## Event Example

```json
{
  "specversion": "ev20260814",
  "source": "M365",
  "timestamp": "2026-09-28T03:20:00Z",
  "type": "vdc.workload_v0.tenant_v0.threat.threatDetected_v0",
  "severity": "HIGH",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "SECURITY_ALERT",
  "actor": {
    "kind": "system"
  },
  "organizationReference": {
    "workloadTenantId": "tenant_12345"
  },
  "orgId": "org_12345",
  "data": {
    "workload": {
      "type": "M365"
    },
    "tenant": {
      "id": "tenant_12345"
    },
    "threatDetected": {
      "id": "b3f1c2a4-0000-0000-0000-000000000000",
      "type": "RANSOMWARE",
      "entityId": "3f2504e0-4f89-11d3-9a0c-0305e82c3301",
      "entityName": "Contoso Engineering Hub",
      "resourceType": "SITE",
      "entityUrl": "https://contoso.sharepoint.com/sites/engineering",
      "backupSessionId": "session_12345",
      "backupTime": "2026-09-28T03:15:22Z",
      "reportedAt": "2026-09-28T03:20:00Z",
      "impactedObjectsCount": 25,
      "explanation": "Potential ransomware activity detected: original files are being overwritten with encrypted content."
    }
  }
}
```