Veeam App for Microsoft Sentinel
Solution: Veeam
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
| Attribute | Value |
|---|---|
| Publisher | Veeam Software |
| Support Tier | Partner |
| Support Link | https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/ |
| Categories | domains |
| Version | 3.0.1 |
| Author | Veeam Software - microsoftappsupport@veeam.com |
| First Published | 2025-08-26 |
| Solution Folder | Veeam |
| Marketplace | Azure Marketplace · Popularity: ⚪ Very Low (0%) |
Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.
Underlying Microsoft Technologies used:
This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:
a. Azure Monitor Ingestion API
e. Azure Relays
Contents
Data Connectors
This solution provides 1 data connector(s):
Tables Used
This solution uses 8 table(s):
| Table | Used By Connectors | Used By Content |
|---|---|---|
Event |
- | Workbooks |
Syslog |
- | Analytics, Workbooks |
VeeamAuthorizationEvents_CL |
Veeam Data Connector (using Azure Functions) | Workbooks |
VeeamCovewareFindings_CL |
Veeam Data Connector (using Azure Functions) | - |
VeeamMalwareEvents_CL |
Veeam Data Connector (using Azure Functions) | Analytics, Workbooks |
VeeamOneTriggeredAlarms_CL |
Veeam Data Connector (using Azure Functions) | Analytics, Workbooks |
VeeamSecurityComplianceAnalyzer_CL |
Veeam Data Connector (using Azure Functions) | Analytics, Workbooks |
VeeamSessions_CL |
Veeam Data Connector (using Azure Functions) | Analytics |
Content Items
This solution includes 164 content item(s):
| Content Type | Count |
|---|---|
| Analytic Rules | 132 |
| Playbooks | 15 |
| Watchlists | 11 |
| Parsers | 4 |
| Workbooks | 2 |
Analytic Rules
Workbooks
| Name | Tables Used |
|---|---|
| VeeamDataPlatformMonitoring | Syslog |
| VeeamSecurityActivities | EventSyslogVeeamAuthorizationEvents_CLVeeamMalwareEvents_CLVeeamOneTriggeredAlarms_CLVeeamSecurityComplianceAnalyzer_CL |
Playbooks
| Name | Description | Tables Used |
|---|---|---|
| Veeam-ChangeCollectionTime | This Microsoft Sentinel playbook adjusts the recurrence intervals for Veeam collection playbooks bas... | - |
| Veeam-CollectConfigurationBackups | A Microsoft Sentinel playbook that automatically runs configuration backup sessions on Veeam Backup ... | - |
| Veeam-CollectCovewareFindings | This Microsoft Sentinel playbook automatically collects Coveware findings on a schedule. Retrieves C... | - |
| Veeam-CollectMalwareEvents | A Microsoft Sentinel playbook that automatically collects malware events from Veeam Backup & Replica... | - |
| Veeam-CollectSecurityComplianceAnalyzerResult | A Microsoft Sentinel playbook that automatically collects Veeam Security Compliance Analyzer results... | - |
| Veeam-CollectVeeamAuthorizationEvents | This Microsoft Sentinel playbook automatically collects Veeam authorization events Veeam Backup & Re... | - |
| Veeam-CollectVeeamONEAlarms | This Microsoft Sentinel playbook automatically collects Veeam ONE alarms on a schedule. Retrieves Ve... | - |
| Veeam-FindCleanRestorePoints | A Microsoft Sentinel playbook with the incident trigger, that finds the last clean restore point for... | - |
| Veeam-PerformConfigurationBackupOnIncident | A Microsoft Sentinel playbook that automatically runs configuration backup session when triggered by... | - |
| Veeam-PerformInstantVMRecovery | This Microsoft Sentinel playbook performs instant VM recovery on the vm specified by MachineDisplayN... | - |
| Veeam-PerformScanBackup | This Microsoft Sentinel playbook with an incident trigger performs antivirus scan on Veeam backup us... | - |
| Veeam-ResolveTriggeredAlarm | A Microsoft Sentinel playbook with an incident trigger that resolves Veeam ONE alarms (identified by... | - |
| Veeam-SetupConnections | A Microsoft Sentinel playbook that configures Key Vault secrets and hybrid connections for Veeam ser... | - |
| Veeam-StartQuickBackup | A Microsoft Sentinel playbook with an incident trigger, that performs quick backup support for affec... | - |
| Veeam-StartSecurityComplianceAnalyzer | This Microsoft Sentinel playbook initiates and monitors Veeam Security and Compliance Analyzer sessi... | - |
Parsers
| Name | Description | Tables Used |
|---|---|---|
| Veeam_GetFinishedConfigurationBackupSessions | - | Syslog (read) |
| Veeam_GetJobFinished | - | Syslog (read) |
| Veeam_GetSecurityEvents | - | Syslog (read) |
| Veeam_GetVeeamONEAlarms | - | Syslog (read) |
Watchlists
| Name | Description | Tables Used |
|---|---|---|
| action_results_lookup | - | - |
| collection_schedule_settings | - | - |
| coveware_settings | - | - |
| job_types_lookup | - | - |
| license_editions_lookup | - | - |
| license_types_lookup | - | - |
| operation_names_lookup | - | - |
| session_states_lookup | - | - |
| vbr_events_lookup | - | - |
| vbr_settings | - | - |
| vone_settings | - | - |
Release Notes
| Version | Date Modified (DD-MM-YYYY) | Change History |
|---|---|---|
| 3.0.2 | 15-10-2025 | Updated author to Veeam Software |
| 3.0.1 | 03-10-2025 | Updated Coveware security findings integration; Removed irrelevant mappings from all analytic rules; Updated Workbooks' drilldown capabilities |
| 3.0.0 | 26-08-2025 | Initial Solution Release |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊