mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
45 lines
1.4 KiB
JSON
45 lines
1.4 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-08-24",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"Backup Logs"
|
|
],
|
|
"data_sourcetypes": [
|
|
"netbackup_logs"
|
|
],
|
|
"providing_technologies": [
|
|
"Netbackup"
|
|
]
|
|
},
|
|
"eli5": "This search gives you the count and the hostname of all the systems that had a successful backup each day.",
|
|
"how_to_implement": "To successfully implement this search you must be ingesting your backup logs.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-12",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"earliest_time": "-30d@d",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "sourcetype=\"netbackup_logs\" \"Disk/Partition backup completed successfully.\" | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE",
|
|
"search_description": "This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate.",
|
|
"search_id": "b4d0dfb2-2195-4f6e-93a3-48468ed9734e",
|
|
"search_name": "Monitor Successful Backups",
|
|
"search_type": "support",
|
|
"spec_version": 1,
|
|
"status": "production",
|
|
"version": "1.0"
|
|
}
|