Backup Monitoring

What it does

Most SaaS-backup vendors can stream job and audit events to a SIEM. TATER acts as that receiver: a backup provider pushes job-monitor (backup/restore results) and audit-log events to TATER, and TATER turns them into:

• Backup health reporting — a Backup Monitoring page with per-provider, per-connector job status, success rate, and history.
• Monitoring findings — a failed or missed backup auto-files a deduped finding that auto-closes when the next backup succeeds.
• Ops tasks — one task is auto-created per failure episode so the issue is owned and tracked closed-loop.

Backup is provider-specific per client. TATER supports several providers today and lists more on the connector roadmap — pick the right one for each organization in the Setup panel.

Supported providers

Vendors differ in how they expose events. Push providers POST events to TATER's receiver (works today — you just point the vendor at the URI). Pull providers only expose a REST API, so TATER must poll them with stored credentials — those connectors are on the roadmap and appear in Setup as “Connector planned.”

Connecting a provider

Open TATER Security → Backup Monitoring → Setup (Admin). You can add any number of connections — including several of the same provider (e.g. two Keepit tenants, multiple Rubrik clusters, or separate Datto sites). To add one:

1. Pick a push provider, give the connection a name (e.g. “Keepit — M365 tenant”), and click Add connection.
2. On that connection's card, click Generate token — TATER creates a push token (shown once; copy it).
3. Copy the Receiver URI from the card.
4. In the vendor's console, point its SIEM / webhook output at the Receiver URI and supply that connection's token (see per-vendor notes below).
5. Back on the card, select the data sources you want (Job events and/or Audit events) and toggle Enabled.

Each connection has its own token — that token is how TATER knows which connection (and which org + provider) a push belongs to. Tokens are stored only as a hash, shown once, and can be regenerated per connection (which invalidates that connection's old one). Keep them secret. Repeat the steps above for each backup you want to monitor.

Per-vendor setup notes

• Keepit — Account info → Security → SIEM integration. Paste the Receiver URI as the HEC URI and the token, select Job monitor + Audit log, and enable.
• Rubrik Security Cloud — Settings → Notifications and Webhooks → Add Webhook. Set the URL to the Receiver URI and add an Authorization: Splunk <token> header (or append ?token=<token>). Select the backup/job + audit event types. Default PD-CEF or a custom JSON template both work.
• Cohesity DataProtect — Monitoring → Alerts → Configure Alert Notification Rule → add a Webhook output. Set the webhook URL to the Receiver URI, add header Authorization: Splunk <token>, and select the backup/restore run alert categories.
• Generic / Custom — any product that can POST JSON job events to a Splunk HTTP Event Collector or a generic webhook. Point it at the Receiver URI with the token (Authorization: Splunk <token> or ?token=). TATER extracts connector / job / status / error defensively and stores the raw event.

TATER classifies events defensively (it tries many common field names and stores the raw event regardless), so a vendor whose schema differs slightly still produces usable job records.

Backup jobs & findings

Each job event updates a per-job record keyed by connection + connector + job (so two connections of the same provider never collide): last status (Healthy / Failed / Warning / Running), last run, success rate, and consecutive failures. On a failure, TATER files a keepit-backup monitoring finding (severity escalates to Critical after 3 consecutive failures) and auto-creates an Ops task; on the next success, the finding auto-closes and the failure episode resets. Findings also appear in Application Monitoring alongside your other signals.

From your AI (MCP)

• list_backup_jobs — per provider/connector/job: status, last run, success rate, consecutive failures, linked task.
• get_backup_summary — KPI roll-up (connectors, jobs, healthy/failed, success rate, open tasks) + the currently-failed jobs, each tagged with its provider.

Related

• Application Monitoring — the findings surface backup failures share, and the finding→task bridge.
• App registrations & permissions
• MCP setup