Could anyone here using the new Inline Entropy Analisis feature in 12.1 share their experiences so far?

Hi @lenhartj -

Absolutely don’t mind sharing. You are indeed correct. Inline Entropy engine does have limitations. I wrote about the Inline Entropy engine in a post here on the Hub a few months back. For my experience and most of the limitations with it, I recommend reading through it:

• Malware Detection, Inline Entropy Scan – A Deeper Dive

But, don’t fret! It is going to be getting a face lift soon! Veeam Product Managers will be updating it to help with malware event forensics and analysis. When this will be released is tbd. But, for detailed info directly from the Veeam team, follow the below thread in the Forum:

https://forums.veeam.com/veeam-backup-replication-f2/veeam-12-1-suspicious-files-t91348-120.html#p519783

Hope this helps. Let me know if you have further questions.

We are just beginning to implement it with many other changes.  I have used it in my homelab without issue to performance at all leaving it on the Normal settings.

In production our servers are more powerful so I cannot see it affecting performance.  I also want to use the Splunk App too for some of this stuff.

coolsport00 wrote:

Hi @lenhartj -

Absolutely don’t mind sharing. You are indeed correct. Inline Entropy engine does have limitations. I wrote about the Inline Entropy engine in a post here on the Hub a few months back. For my experience and most of the limitations with it, I recommend reading through it:

• Malware Detection, Inline Entropy Scan – A Deeper Dive

But, don’t fret! It is going to be getting a face lift soon! Veeam Product Managers will be updating it to help with malware event forensics and analysis. When this will be released is tbd. But, for detailed info directly from the Veeam team, follow the below thread in the Forum:

https://forums.veeam.com/veeam-backup-replication-f2/veeam-12-1-suspicious-files-t91348-120.html#p519783

 

Hope this helps. Let me know if you have further questions.

Yours was one of the articles I read during my research and it was very informative.  Thank you for writing it!

Very nice summary of how it work, thank you again!

No problem. Let me know if you have further questions.

click me

I haven’t experienced any performance issues with it.  That said, every alerts I’ve gotten appears to be some form of false positive, usually due to some form of (legitimate) encrypted data on the VM.  That said, I’d a good to have feature, but I hope there’s some better reporting/log analysis developed around it with time.

I don’t want to enable it quite yet as I fear CBT being reset would make my backup window take WEEKS.

Perhaps if I could enable 1 job at a time, and slowly work my way down the list as many of these large file servers have been separated from each other.