get_backup_logs_for_endpoint.yml

name: Get Backup Logs For Endpoint
id: fdcfb369-1725-4c24-824a-22972d7f0d44
version: 1
date: '2017-09-14'
author: David Dorsey, Splunk
type: Investigation
datamodel: []
description: This search will tell you the backup status from your netbackup_logs
  of a specific endpoint for the last week.
search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as
  signature | table _time, dest, signature'
how_to_implement: You must be ingesting your backup logs.
known_false_positives: ''
references: []
tags:
  analytic_story:
  - Ransomware
  - SamSam Ransomware
  product:
  - Splunk Phantom
  required_fields:
  - _time
  - COMPUTERNAME
  - MESSAGE
  security_domain: endpoint