YARA and Script Library

💡 The Challenge:Removing a backup proxy in Veeam Backup & Replication across a lot of backup jobs can be pretty annoying and time-consuming.🚀 The Solution:That's why I wanted to share a short PowerShell script that automates this task for you!I personally use it whenever I decommission a backup repository in large, shared Veeam environments - it's a real time-saver.⚠️ Right now, this script is built for the Windows-based Veeam version (12 & 13).A version for the Linux-based appliance is on my roadmap, so stay tuned!👉 You can grab the script here: 🔗 https://github.com/fabpapde/community/blob/main/veeam/veeam-backup-proxy-remove-v1_0.ps1

Hi all,Me again, I’ve been wanting to create a scanning tool to get detailed information about file systems to aid in the design of Veeam unstructured backups for a while. I created this tool a few years ago but I thought I’d dust it off and with the help of Claude make it something that the community can use. As always I’ve written it in Rust as it provides fast, multi-threaded scanning.https://github.com/shapedthought/fast-walkIt provides file system information in the following files:results-20260801-160000.csv           totals per extensionresults-20260801-160000-age.csv       totals per age bandresults-20260801-160000-size.csv      totals per size bandresults-20260801-160000-hotspots.csv  directories holding the most small filesresults-20260801-160000-largest.csv   the largest files foundIt also provides the information in the terminal:It also allows you to compare scans to get an idea of change rate over time:I’m looking for testing and feedback on different file systems of which

Hi all,Before I start this post I humbly request that if you like this project and want me to continue to develop this and other projects, to please share, give it a star on GitHub. It really helps with the motivation. I’ve been wanting an easy way to monitor logs from Veeam products in real-time.https://github.com/shapedthought/logwatchBinary download:https://github.com/shapedthought/logwatch/releasesSo I’ve put together just that, logwatch can monitoring all the files in a folder for changes and you can also recursively monitor all the files in sub-directories. If you enable ssh on your VSA v13 (do carefully!), you can then run the following to get all the first level directories:ssh -n user@server "tail -f /var/log/VeeamBackup/*.log" | logwatch --stdinTo monitor recursively:ssh -n user@server "while true; do find /var/log/VeeamBackup -type f -name '*.log' -print0 | xargs -0 -r tail -n0 -F 2>/dev/null; sleep 1; done" | logwatch --stdin -PYou can also use this with the cloud produc

Using YARA rules in the backup environment With the rise of cyber threats, particularly ransomware attacks, simply performing backups and restores is no longer sufficient. Restoring data without ensuring it is free of threats can lead to re-infection of the environment.Starting with version 12.1, Veeam Backup & Replication (VBR) has integrated native support for YARA rules into its Malware Detection ecosystem. This combination enables data integrity validation both before and during recovery processes. What are YARA rules?YARA (Yet Another Recursive Acronym) is an open-source tool widely adopted in incident response to identify and classify malicious artifacts.Unlike approaches based solely on the closed signatures of traditional antivirus software, YARA operates using customizable rules:Pattern-based signatures: Identification via specific strings, byte sequences, hashes, or file structures. Conditional logic: Precise rule definition to determine whether a file is malicious or ano

Hi,did anyone or maybe Veeam itself worked on skill for Claude Code (and others)? For diferenet API endpoint, but mainly VPSC.I found (but not tried) this one https://github.com/Servosity/msp-skills/tree/main/skills/veeam  Best regards

Hi, We are thrilled to announce the general availability of AsBuiltReport.Veeam.VBR 1.0.0 — a comprehensive PowerShell module that generates professional as-built documentation reports for Veeam Backup & Replication (VBR) infrastructure. What is AsBuiltReport.Veeam.VBR?AsBuiltReport.Veeam.VBR is a specialized report generator that plugs into the AsBuiltReport framework to automatically document your VBR environment. It produces multi-format reports (HTML, Word, Text) that capture the complete state of your backup infrastructure—from backup jobs and repositories to proxies, tape libraries integration, cloud gateways, and more. Key FeaturesReport Sections — Comprehensive coverage of all VBR components including backup repositories, jobs, proxies, WAN accelerators, tape integration, and cloud connectivity Diagram Types — Visual representations of your infrastructure, including backup-to-repository flows, proxy routing, and tape library topology Flexible InfoLevel Configuration — Contr

Hello Veeam Community! I'm excited to introduce a Python script that I've developed for anonymizing Veeam Backup & Replication logs. Protecting sensitive information in log files is crucial, and this script simplifies the process while maintaining the integrity of your logs. Veeam Log Anonymizer logo Acknowledgments:Before diving into the details, I'd like to express my gratitude:Bertrand: Thank you for the original idea that inspired this script and for your valuable improvement suggestions. Your input was instrumental in making this script more robust and feature-rich. Eric: A big thank you for your unwavering support and encouragement throughout the development process. Your feedback and insights helped shape this tool. Disclaimer:I want to clarify that I'm not a developer by profession, but rather a member of the Veeam community who saw the need for a tool like this. The script has been created out of a passion for data privacy and a desire to contribute to our community.Key Fe

Hello,I could say better late than never, i’m using a script since many years to make my configuration configuration immutable on a linux repos.Even it is now available for object storage and it will probably be immutable in future release, i think it could useful to share it. #!/bin/bash# Define a list of target directoriestarget_directories=("/path/to/your/target_directory1" "/path/to/your/target_directory2")attribute_to_apply=" +i" # The chattr attribute to apply (e.g., immutable)time_to_wait_days=10 # Time to wait in days before removing chattr attributelog_path="/path/to/your/logfile.log" # Replace with your desired log path# Calculate the time to wait in secondstime_to_wait_seconds=$((time_to_wait_days * 24 * 60 * 60))# Log the start timeecho "$(date): Chattr attribute application started for files in ${target_directories[*]}" >> $log_path# Loop through all target directoriesfor target_directory in "${target_directories[@]}"; do # Loop through all files in the target dir

Greetings from Puerto Rico,The AsBuiltReport for Backup for Microsoft 365 has received significant community contributions and now supports documentation for version 8.4. This update represents a major milestone in the ongoing development of this reporting tool.In addition to these enhancements, we updated the diagram to incorporate Veeam's latest infrastructure icons, providing a more modern and visually consistent representation of your backup environment. We also added a new chart to visualize backup repository space utilization, along with improvements to several existing charts, offering better insights into your backup infrastructure performance and resource allocation. I'm grateful for the community's continued support and contributions, which make this tool better every single day! Sample ReportNew Features and changes:## [0.4.0] - 2026-05-20### Added- Add Dependabot support- Support for Veeam Backup for Microsoft 365 v8.4 (upgraded from v8.3) @acgdickie- Support for PowerShell

IntroductionMy Veeam Report v13, maintained and extended by L1nkState, is a modernized PowerShell reporting solution for Veeam Backup & Replication v12 and v13.Originally created by Shawn Masterson and later expanded by the community (notably marcohorstmann), this project transforms raw Veeam data into a clean, structured, and highly configurable HTML report designed for both operational teams and MSP environments. Download:L1nkState/My-Veeam-Report-v.13 Origin and EvolutionThe project has an interesting lifecycle:🧱 Original script: created by Shawn Masterson (pre-2018) 🧑‍💻 Community revival: modernized by contributors including marcohorstmann 🚀 Current version (v13): adapted and extended by @L1nkState for compatibility with modern Veeam platforms (v12/v13)This evolution reflects a common pattern in infrastructure tooling: community-driven survival and modernization of abandoned but valuable scripts. Key PurposeThe main goal of My Veeam Report v13 is to provide:A single HTML re

 With the release of Veeam Backup & Replication v13, backup validation has become even more critical—especially in enterprise environments where data integrity and compliance are non-negotiable. In this context, Veeam-Validator emerges as a practical solution to extend and automate the native Veeam validation capabilities. Download script:L1nkState/Veeam-Validator-: Veeam Backup Validator A PowerShell automation script to validate Veeam backups and optionally send HTML reports via email. Designed for Veeam Backup & Replication v12 and v13, schedulable via Windows Task Scheduler. What is Veeam Backup Validator (Technical Context)The native Veeam Backup Validator is a CLI utility designed to verify backup file integrity without performing a restore. It works by leveraging block-level checksums: during backup creation, hashes are generated for each data block, and later recalculated and compared to detect corruption.From an operational standpoint:Works at file-level (CRC checks) D

While responding to a post, I figured I’d try to see if i could get all of the email accounts tied to jobs in my Veeam environment to assist.This script will also show the attached Copy and Tape jobs, so I’ll try to update it with additional logic time permitting. Either way, It will show if you (or others) have email alerts setup in Veeam jobs.  I plan to update if i can have it show Warning, Error, and Success enabled. $emailPattern = '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'function Get-EmailsFromObject { param( [Parameter(Mandatory)] $obj, [string]$JobType = "Unknown" ) $json = $obj | ConvertTo-Json -Depth 5 -Compress -ErrorAction SilentlyContinue if ($json) { $matches = ($json | Select-String -Pattern $emailPattern -AllMatches).Matches foreach ($m in $matches) { [PSCustomObject]@{ JobName = $obj.Name JobType = $JobType Email = $m.Value } } }}$allEmai

Repost of topic on the RND forums, but figured to share this here as well: Sharing this tidbit here as there are quite a few topics on how to do session reporting on all job types including the plugin-based Hypervisors (aka PlatformBackups, for example Proxmox, Nutanix, HPE Morpheus, etc)Normally you would pass a CJob object from Get-VBRJob to Get-VBRSession -Job, but regrettably this will currently error with many job types:Get-VBRSession: Cannot bind parameter 'Job'. Cannot convert value "Veeam.Backup.Core.CBackupJob" to type "Veeam.Backup.PowerShell.Infos.VBRJob". Error: "The given key 'VmbApiPolicyTempJob' was not present in the dictionary."However, we can do a little magic trick with Get-VBRSession on the -Type parameter to get all PlatformBackup jobs; Get-VBRSession returns "light" information on the session data, so we will do another magic trick to get full session data from Get-VBRBackupSession, which in turn can be passed to Get-VBRTaskSession for full session reporting with

Not sure how useful this will be for anyone else, but should you need to parse through your logs on all gateway servers for S3 errors returned during Veeam operations with Object Storage, this script is for you.Script requires ripgrep to be installed on the Backup Server: https://github.com/BurntSushi/ripgrep?tab=readme-ov-file#installationIf you cannot install / use chocolately in your environment, download the ripgrep binary appropriate for your OS, and edit the script as noted in comment [2]. What it does:Collect all Object Storage Repsositories Get Ids for all assigned gateways Collect all gateways with Get-VBRServer cmdlet to create array of gateways Iterate over each gateway and do the following: Export logs JUST for that gateway server to the VBR server, uncompressed grep the logs for the relevant S3 error string with ripgrep (rg command) Write all found errors in full to a .log file Pares all found errors and write in human friendly format to CSV Clean up the exported logs,

After switching from TSM to Veeam, I found myself wasting plenty of hours excluding OFF-Line sql databases from backup.Normally it demands that you start SQL Server Management Studio ( witch takes a war ), identify the correct instance and then exclude the ofline databases in each backup job…..However… I’m notorisly lazy and in a bright moment, I turned to Powershell.The resulth is a script telling me if a database is offline and therefore maybe should be excluded or if a database in online and can be included in backup, and best of all… without starting SQL Server Management Studio. The script is eacy to use, gives a nice overview, you can in / exclude a database on a server in less than 20 sec ( depends on how many instances / databases the script have to scan ), you can chose to exclude Logs and diff backup and only have FULL backup if needed, and at last, - it logs every change make by time and username.Script is free to use…regards   MACH0NE 

Per KB4821, each organization should use a single backup application per Microsoft term's of use and product documentation. This script automates the steps mentioned in the KB article by identifying organizations that are using multiple backup applications and, if desired, will limit each organization to a single backup application.https://github.com/VeeamHub/powershell/tree/master/VB365-KB4821Please note that additional backup applications are not deleted from Entra ID. They are simply removed from Veeam.The output of the script let’s you see all organizations affected including backup application info and backup applications removed (if any):  

As a fan of the Veeam Data Integration API, I have been spending time with a related but separate topic: Database Publish (referred to as Data Publishing in the Veeam documentation). The goal was to make backed-up databases available to another system for analysis, without permanently restoring them or affecting production.What is Data Publishing?Data Publishing is a feature in Veeam Backup & Replication that has been available for Microsoft SQL and Oracle for a while and was later extended to PostgreSQL and MongoDB. The mechanics are straightforward: Veeam mounts the backup data read-only, attaches the database files to the target engine, and keeps a write cache for any changes made during the session. When the session ends, the write cache is discarded. The source backup is untouched. The result is a database accessible via standard database protocols. You can connect to it, run queries, inspect schema and data, and then walk away and grab a coffee. No permanent restore, no impac

Special thanks to our dear Veeam Support Team Members Cosmin Ciobanu and Marius Nita for the following trick! Veeam Support is _always_ looking for ways to make everyone’s lives easier.Currently, to generate an HTML report for many sessions at once you need to go to the Session tab in the UI and ctrl / shift + click on desired sessions; not always convenient, and for Transaction Log backup sessions in particular you may have hundreds (if not thousands) of sessions.With Powershell and a bit of prep work, you can do this automagically: Preparatory Step:From a Windows-based backup server, copy the following filesCopyC:\Program Files\Veeam\Backup and Replication\Backup\SessionReport.xsltC:\Program Files\Veeam\Backup and Replication\Backup\SqlSessionReport.xsltto the following path on the machine where you will generate the report with Powershell:Windows:C:\Program Files\PowerShell\7\Linux:/opt/microsoft/powershell/7/Both xslt files should be in the powershell/7 directory. Then run the foll

The project announced here became even bigger. However, the Veeam Data Integration API remains the "main actor", except that many new options have now been added, as "my ideas factory" and feedback on a similar script have been incorporated. Let’s look at what’s NEW.📑 SearchThe host2scan parameter scans a selected restore point of the specified host. The repo2scan parameter can display all hosts with supported restore points in the specified Backup Repository. Then select a host and start the scan. NEW Or with repo2scan and the option all to scan the latest restore point for all found and supported host types in the specified Backup Repository. NEW🔍 Scan & StoreThe scan parameter triggers the malware and LOLBAS detection scan. The store parameter collects the metadata for all relevant binary files (ideal for hash analysis). NEW The yaramode parameter triggers a YARA scan using the stored rule(s). NEW📊 Display NEWThe data is displayed in a wonderful Streamlit Dashboard. In the pi

​ ProxyPool Swapper for Veeam Backup for M365If you regularly onboard new tenants in Veeam Backup for Microsoft 365, chances are this scenario sounds very familiar.A repository gets assigned to a proxy pool, and at some point you want to move it—quickly and without hassle. A common approach is to use a dedicated onboarding proxy pool for the initial full backups of new tenants, and a separate, permanently assigned pool for ongoing operations. Once those initial backups are complete, only incremental, day-to-day changes remain. These smaller, predictable workloads can then be handled by a proxy pool that’s specifically designed and sized for daily processing.From an architectural perspective, this makes perfect sense. From an operational perspective… it can get a bit tedious.Another use case I frequently run into is the need to quickly access logs for a specific job or repository. To do this, I assign the repository to a local Windows proxy, which gives me easy access to the proxy logs.

Hi,Where do you guys mostly download Yara rules for Veeam from?This GIT looks not maintained for years (files from 2022).  https://github.com/YARA-Rules/rules/archive/refs/heads/master.zipI also used those links but I had some troubles when scanning backup.https://github.com/Neo23x0/signature-base/archive/refs/heads/master.ziphttps://yaraify.abuse.ch/yarahub/yaraify-rules.zip

Yesterday, during the VEEAM User Group Germany someone was missing a Maintenance Mode for VEEAM. The main problem was to keep which job was enabled and which was disabled. I wrote a script some times ago which stopped all jobs and disable them but before the state is dumped into a JSON File. On leaving maintenence the JSON-File will be read and required jobs are set to enabled again and failed jobs are triggered to restart. The scripts (and more) can be found on our github repository: https://github.com/claranet/VeeamHub/ Here are these scripts:Enter-Maintenance.ps1param( [switch]$DryRun=$False)Import-Module Veeam.Backup.PowerShellFunction log($message) { $timestamp = Get-Date -Format "yyyy-MM-ss hh:mm:ss" Write-Host "$($timestamp) - $($message)"}if($DryRun) { log "DRY RUN - NOTHING WILL CHANGE" }$_FILE = "$PSScriptRoot/job_states.json"if( [System.IO.File]::Exists($_FILE) ) { log "State File already exists - remove it first!!" pause Exit 1}# Create new, empty state fileNew-Item -

IntroductionThe Veeam Data Platform V13 is now available, and it brings many new features for working with the REST API. With these improvements, it is easier to automate tasks and integrate Veeam into your workflows. Sometimes, it is necessary to check backup data from NAS systems for viruses or similar threats. This helps ensure that the data is safe before being restored or used. Starting with Veeam Backup & Replication 13.0.1, we can trigger an Instant File Share Recovery using the REST API. And why not use a Python script to scan such backup data? There is a Python script for thatThe Python script initiates an Instant File Share Recovery. The backup data is made available to a Windows system, referred to as the mount server. On the Linux server, where the Python script is running, the shared folder gets mounted from the Windows mount server. After mounting, the script scans the data. It reads a configuration file named scan_engines.json, which lists all supported scanning engi