First I want to give recognition for this script and setup to Senior Solutions Architect Claudio Fortuna! Thank you for your contribution.
A new Orchestrator strategy for Security teams and DR teams alike! Organizations looking to scan their backups for malicious threats either before, during, or after an incident can now use Veeam Recovery Orchestrator (VRO) to scan backups from their copies, within an isolated environment. So how does this work?
First, let’s talk about the architecture: organizations with a secondary environment or a true clean room (that is off the domain) can leverage Orchestrator and the embedded Veeam Backup & Replication (VBR) server to import and restore from backups or backup copies. With this scenario in mind if you were to lose the original backup server, the embedded backup server in Orchestrator can take control of the backups. To automate this process a script is included that will be part of the restore plan. A restore plan automates the recovery actions of the vSphere VMs we are looking to recover in the clean room. Part of the actions even include an AV scan as well as a YARA Rule Scan, which will search for patterns or indicators of compromise when restoring the VM from a backup. Once the VRO server has control over the backups, the restore plan can be initiated to run, and VMs from backups can be rebuilt and scanned into your clean room. So, what do we need to get started?
- Production VBR server running in Production datacenter.
- Secondary environment (a true clean room will be off the domain) with Veeam Recovery Orchestrator running here, and a second VMware vCenter Server.
- A backup repository at each location with backups being handled by the primary VBR server.
- Script (provided here) which is a pre-plan script to attach the repository to the embedded VBR server.
- Optional Script to detach the repository for post-plan execution.
- A restore plan to orchestrate this entire workflow
The Set Up
First, in Veeam Recovery Orchestrator under plan steps we will need to add in a new custom script step. For this custom script it was named “Seize Repository” as part of the script we will also include a timeout period of about 10 minutes to ensure the Orchestrator Data Collection has time to inventory the backups and restore points. If your environment or backups are larger this can be extended.
Create a Restore Plan selecting your secondary Recovery Location, as well as your backups that you want to test. Next, we will add in the new plan step we created as part of the pre-plan steps of the restore plan.
Next, we will execute the restore plan. Keep in mind we set the timeout period to 10 minutes to give Orchestrator plenty of time to inventory the new restore points before proceeding to the next steps for starting VM recovery and scanning of the machines. For larger environments it might take longer than 10 minutes for the data sync to complete, but you can customize this for your environment.
The Outcome
Validated VMs recovered from backups into an isolated environment for any DR or security needs. Organizations can use this method to test multiple VMs from backups to ensure validated clean recovery. With a documented and repeatable process, users can be sure that their backups will work for them when they need it the most.
