CiscoISEBackupFailed.yaml

id: 4eddd44a-25e4-41af-930d-0c17218bec74
name: CiscoISE - Backup failed
description: |
  'Detects when backup activity failed.'
severity: Medium
requiredDataConnectors:
  - connectorId: CiscoISE
    dataTypes:
      - Syslog
queryFrequency: 6h
queryPeriod: 6h
triggerOperator: gt
triggerThreshold: 0
query: |
  let lbtime = 6h;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where EventId in ('60095', '60098')
  | project TimeGenerated, DvcHostname, DvcIpAddr
  | extend HostCustomEntity = DvcHostname
  | extend IPCustomEntity = DvcIpAddr
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity