All Apps and Add-ons

Veeam Monitor Input for "Malware_Detection_Logs"

marycordova
SplunkTrust
SplunkTrust

 There is extra contextual data for the Malware Detection events that is needed in order to properly start an investigation into the alerts

  • Some of the additional contextual elements needed are in the “C:\ProgramData\Veeam\Backup\Malware_Detection_Logs\” directory
  • When setting up a SOC to respond to these alerts you need this information embedded directly into the Detection Alert from your SIEM
  • This covers only the “Malware_Detection_Logs” directory, there are other contextual data sources needed that will be covered in another post

First ensure baseline logging and dashboards are setup.  Veeam has actually done a very good job of making this easy 😁

6ac00ae8-4171-4ff0-bf2f-785b0b848fdb.png

You then need to install a Splunk Universal Forwarder on the VBR server to collect the additional context data:

c3319ed0-0ec6-4d5c-a7a1-25dce7d545ef.png

Now you are ready to correlate the Malware Detection events with their contextual data in a custom Detection Alert for your SOC:

  • only the “ObjectName” field is present in both the Malware Detection event and the log files
  • you need to use the timestamp and the ObjectName to correlate these data sources together
  • THERE IS A LOT OF NUANCE IN THE <snip>ed SECTION BELOW (I can help if you need it, but it was too much to post and needed to be sanitized anyway)

8f6e8b50-108c-4539-8847-c06b2e4a3eee.png

You will now see contextual data embedded directly into the SOC alert (we were doing some testing and set .txt and .pdf as bad file extensions just to generate data 😋😞

90d9f24f-e592-4606-863c-a1b7ecce4b42.png

@marycordova
Tags (4)
1 Solution

marycordova
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...