security-content/detections/netbackup_failed_backup.yml at develop · jwindley-splunk/security-content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
asset_type: Endpoint
baselines:
  - id: b2178fed-592f-492b-b851-74161678aa56
    name: Monitor Unsuccessful Backups
    type: splunk
  - id: b4d0dfb2-2195-4f6e-93a3-48468ed9734e
    name: Monitor Successful Backups
    type: splunk
confidence: high
creation_date: '2017-06-15'
data_metadata:
  data_source:
    - Backup Systems
  data_sourcetypes:
    - netbackup_logs
  providing_technologies:
    - Netbackup
description: This search gives you the hosts where a backup was attempted and then
  failed.
detect:
  splunk:
    correlation_rule:
      notable:
        nes_fields: dest
        rule_description: The system $dest$ attempted a backup but encountered an
          error.
        rule_title: Failed backup attempt by $dest$
      risk:
        risk_object: dest
        risk_object_type:
          - system
        risk_score: 10
      schedule:
        cron_schedule: 0 7 * * *
        earliest_time: -24h@h
        latest_time: -10m@m
      search: sourcetype="netbackup_logs" | stats latest(_time) as latestTime by COMPUTERNAME,
        MESSAGE | search MESSAGE="An error occurred, failed to backup." | `security_content_ctime(latestTime)`
        | rename COMPUTERNAME as dest, MESSAGE as signature | table latestTime, dest,
        signature
      suppress:
        suppress_fields: dest
        suppress_period: 86400s
eli5: This search looks across the most recent backup events for each host, and returns
  those messages that indicate there was a backup failure.
entities:
  - dest
how_to_implement: To successfully implement this search you need to obtain data from
  your backup solution, either from the backup logs on your endpoints or from a central
  server responsible for performing the backups. If you do not use Netbackup, you
  can modify this search for your specific backup solution.
id: a34aae96-ccf8-4aaa-952c-3ea21444444f
investigations:
  - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
    name: Get Notable History
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d65
    name: Get Risk Modifiers For Endpoint
    type: splunk
  - id: bc91a8cf-aaaa-4bb2-8140-e756cc06fd72
    name: All backup logs for host
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d55
    name: Get Risk Modifiers For User
    type: splunk
known_false_positives: None identified
maintainers:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
mappings:
  cis20:
    - CIS 10
  nist:
    - PR.IP
modification_date: '2017-09-12'
name: Unsuccessful Netbackup backups
original_authors:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '1.0'