It should be based on the last 3 backups and based on thresholds of difference between the backups, are you backing up during times of low data change such as the weekend? Could be why you’re getting false flags.

Alarm definitions here:

Veeam Backup & Replication Alarms - Veeam ONE Monitoring Guide

Daily backups running every night.  I’ll look into why it’s triggering, because it’s nearly every VM, not just one or two.  

Hey there. By default, this alarm analyzes the latest 3 backups to set the baseline for expected behavior. My recommendation is to modify the Analysis Depth setting to allow veeam one to analyze a larger number of jobs in the history. This should result in a more accurate determination of whether a job is ‘suspicious’.

Let me know if you have any questions :)

Yes- like others have mentioned it looks at the latest three 3 incremental backup runs, and alerts you if they have increased substantially. This could easily be triggered if there is a lot of change rate on your machines before a backup run takes place. Like Christian mentioned, if this is being triggered frequently, it is better to edit and adjust the alarm for those jobs. 

Thanks all for the help.  I’ll have a look at this next week.