Add Veeam data connector - Public Preview

[v-hectorarv]

This PR adds the Veeam data connector to Microsoft Sentinel using the Codeless Connector Framework (CCF).

Data Streams

• VeeamMalwareEvents_CL: Malware detection events from Veeam Backup and Replication.
• VeeamSecurityComplianceAnalyzer_CL: Security and compliance analyzer results from Veeam backup infrastructure.
• VeeamAuthorizationEvents_CL: Authorization and authentication events.
• VeeamOneTriggeredAlarms_CL: Triggered alarms from Veeam ONE.
• VeeamCovewareFindings_CL: Security findings from Coveware integration.
• VeeamSessions_CL: Veeam session telemetry for backup and restore operations.

Changes
Added CCF connector definition with 6 polling configurations (Malware Events, Security Compliance Analyzer, Authorization Events, Veeam ONE Triggered Alarms, Coveware Findings, Sessions)
Created Data Collection Rules (DCR) for ingestion into custom tables
Implemented and updated parsers for data transformation, including Veeam session resource ID parsing
Updated release notes for version 3.0.3
Generated solution package for deployment (3.0.3)

Testing

• ✅ Connector tested in private preview environment
• ✅ All data streams validated
• ✅ ARM template validation passed

Release Stage
This connector is being promoted from Private Preview to Public Preview.

Related Documentation
TSG Wiki: [Link to your wiki page]
Vendor Documentation: https://helpcenter.veeam.com

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a Veeam Codeless Connector Framework (CCF) data connector (public preview) to the Microsoft Sentinel Veeam solution, including new custom tables and ingestion via DCR/DCE, along with version/package updates.

Changes:

• Added CCF connector definition + poller configs and created custom table resources for six Veeam data streams.
• Added a DCR with KQL transforms to map REST payloads into the custom tables.
• Bumped solution versioning and updated package/UI + release notes accordingly.

Reviewed changes

Copilot reviewed 14 out of 16 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
Solutions/Veeam/SolutionMetadata.json	Version bump to 3.0.3 to align solution metadata with the new release.
Solutions/Veeam/ReleaseNotes.md	Adds a 3.0.3 release-note entry describing the new CCF connector/data streams.
Solutions/Veeam/Package/testParameters.json	Adds RG/subscription parameters for package deployment/testing.
Solutions/Veeam/Package/createUiDefinition.json	Updates solution description counts + adds UI text blocks for the additional connector.
Solutions/Veeam/Data/Solution_Veeam.json	Adds the CCF connector to solution content list; bumps version and adds CCF version field.
Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessions.json	Adds custom Log Analytics table resource for session telemetry.
Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzer.json	Adds custom table resource for security/compliance analyzer.
Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarms.json	Adds custom table resource for Veeam ONE triggered alarms.
Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEvents.json	Adds custom table resource for malware events.
Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindings.json	Adds custom table resource for Coveware findings.
Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEvents.json	Adds custom table resource for authorization/audit events.
Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json	Defines six RestApiPoller configurations for the data connector.
Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json	Adds DCR stream declarations + transforms for ingestion into the custom tables.
Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json	Adds the CCF connector definition, UI instructions, queries, permissions, and dataTypes.

[v-maheshbh]

Hi @v-hectorarv

Kindly accept CLA and address the above review comments if required.

Thanks!

[v-maheshbh]

Hi @v-hectorarv

Kindly confirm CLA acceptance by adding a comment on the PR.
@microsoft-github-policy-service agree company="company name"

Thanks!

[v-hectorarv]

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

Pull request overview

Copilot reviewed 20 out of 22 changed files in this pull request and generated 17 comments.

[TwistedAlex]

have you copied exactly what from the /ConnectorsGenerator/GeneratedDataConnectors/VeeamConnector/PollingConfig.json? They are different and this additional "]" will give errors I believe.
Please follow the wiki guidance and test the mainTemplate.json by deploy it and test the connection.