YARA and Script Library

Could anyone help for the following scenario . [Veeam.Backup.Core.CBackupSession]::GetAll() For the above command do we have any commands as the above one not fetching all backup session ids done for particular location.

VBR module unable to fetch complete list of servers(clients) from a backup job. As some physical server backup job ids are not getting populated even it’s taken the backup. 

We have a Veeam AWS Appliance in its own backup account on the latest version, 7.1.08We are backing up more than 200 AWS accounts. I am looking for a Terraform code that, when included in creating a new AWS Account, automatically imports the account to the Veeam appliance. I looked into the Veeam Hub and did not find any. The only Terraform code I found was for deploying the Veeam AWS Appliance.Does anyone have the Terraform code, or is this possible with Veeam AWS Appliance?Thanks,Zahra   

Hello,These last few weeks I have had the time to give some attention to the AsBuiltReport.Veeam.VB365 report. This time a lot of improvements and new sessions were added to collect much more information about the Veeam Backup for Microsoft 365 infrastructure. Here I provide you with the changes:https://github.com/AsBuiltReport/AsBuiltReport.Veeam.VB365/releases/tag/v0.3.0 Now the reason for writing this post is to share with all of you about a project I have been working on in my spare time and it is about Diagramming the Veeam infrastructure. In this new version of the AsBuiltReport.Veeam.VB365 report I added the ability to create a simple diagram of the deployed VB365 components. This tool uses Graphviz and the PSGraph module to generate the diagram. Here is the main link where you can see how to use the report:https://github.com/AsBuiltReport/AsBuiltReport.Veeam.VB365In this link you can find the code I use to generate the diagram!https://github.com/AsBuiltReport/AsBuiltReport.Veea

Hi Community,after Rick's announcement (thanks for the initiative), I couldn't resist creating another script for the community.As documented, you can add one YARA rule file to the scan process. But what if you want to use multiple YARA rules? Of course you could work with a so-called index file, which refers to the individual YARA rules, but this brings a problem with it, because the YARA rules are stored on the VBR server, but the scan process provides the backups on the mount server and only one YARA rule can be used (This is a topic for another blog post - stay tuned).  What if we would like to use all YARA rules from Rick's Top 10 Ransomware Threats  blog post for a scan? And we don’t want to click so many times in the UI? This Powershell script can help. You can select all YARA rules, only selected YARA rules or all YARA rules if no selection has been made after 30 seconds. The script needs the backup job name and the hostname which has to be scanned. .\vbr-scan-backups.ps1 -Jobn

This collection of PowerShell scripts can be used to retrieve Veeam backup usage for VMware Cloud Director (VCD) backup jobs and is now available on VeeamHub! Below is a brief description of its functionality. For more detailed information, please follow the VeeamHub link.In this collection, you’ll find 3 scripts:Sync-VcdOrganizationMapping.ps1: Automated mapping of a VCD Organization Veeam Service Provider Console (VSPC) Company Set-HostedVbrJobAssignment.ps1: Assigns VCD backup jobs to a VSPC Company Get-VspcHostedUsage.ps1: Generates usage reportIn the usage report, the following is provided for each VSPC Company:Total number of protected VMs in backups Total number of licensed VMs in backups Licensed matches Veeam rental licensing policy which is workloads protected within the current calendar month Total amount of space used in backups (Optional) Detailed usage at the VM-levelNOTE: This collection uses functionality added in Veeam Backup & Replication v12.1 and Veeam Service

Deprecated: This script will not work with Veeam Backup & Replication v12. For v12 support, please use the VSPC-HostedUsage scripts. The PowerShell script to retrieve Veeam backup usage for VMware Cloud Director (VCD) Organizations is now available on VeeamHub! Below is a brief description of its functionality. For more detailed information, please follow the VeeamHub link.For each organization, the following is provided:Total number of VMs in backups Total amount of space used in repositoriesThe usage data can be aggregated on the Organization-level or the Org VDC-level. This is useful when backups for different Org VDCs are billed differently.The scope of the usage returned is also customizable. It can be limited to self-service backups, created by the Veeam Self-Service Portal (VSSP) for VCD, or it can also include backups created directly on the backup server by the provider.NOTE: Before using this script in a production environment, I recommend you verify that numbers match up

Hi All, I recently migrated some replicated VM’s on our VMWare infrastructure to a new DVSwitch and updated VLAN names, so I had to update all the Veeam replication jobs, when i tried to automate this using the Veeam powershell library I got the following error on 95% of the jobs. I did a little investigation but didnt manage to figure out what the difference was between all the failed jobs and the 3 that successfully updated. Has anyone ever seen this error message before ? Set-VBRViReplicaJob : Broker service has not started hierarchy collection for host xxxxx Here is a simplified version of the script i was using:# get all replication jobs$jobs = Get-VBRJob | Where-Object TypeToString -eq "VMware Replication"foreach ($job in $jobs) { $jobOptions = Get-VBRJobOptions -Job $job # get list of network objects on new target dvswitch $destSwitchNets = Get-VBRViServerNetworkInfo -Server "<server with new dv switch>" | Where-Object SwitchName -eq "NEW SWITCH" # build array

I was wondering if there is a way to use PowerShell to determine if a machine in a protection group has not backed up in the last 30 days. Obviously in Inventory there are protection groups that have machines in them and a status of “Last Agent Backup”. Is it possible to generate a report that displays that information? Basically I would like to put the script into task scheduler and have it run the 2nd and the 24th of every month. Any advice? # Load Veeam PowerShell ModuleImport-Module Veeam.Backup.PowerShell# Define protection group names$protectionGroupNames = @("Example Protection Group", "Example Protection Group 2")# Get the current date and time window$timeWindow = (Get-Date).AddDays(-30)# Initialize array to store report data$reportData = @()foreach ($groupName in $protectionGroupNames) { # Get the protection group $protectionGroup = Get-VBRProtectionGroup -Name $groupName # Get details of the machines in the protection group $machines = Get-VBRDiscoveredComputer -P

Hello,With some people help me, I have this "script" to get all differents malwares detections based on date + VM name + Path.This is usefull to avoid read several files. $Path = "C:\ProgramData\Veeam\Backup\Malware_Detection_Logs\"$Files = (Get-ChildItem -Path $Path).FullNameSelect-String -Path $Files -Pattern '^\[(?<Date>[^\]]+).+\s(?<VM>[^:]+):.+?:(?<File>.+)' -AllMatches | ForEach-Object { $match = $_.Matches[0] [PSCustomObject]@{ Date = $match.Groups['Date'].Value VM = $match.Groups['VM'].Value File = $match.Groups['File'].Value } } | Sort-Object VM, File -Unique 

Hi, everyone!   I have a PowerShell script that I use to retrieve some information about the daily backup sessions.  It works well, but I was trying to transition it from the Get-VBR-Job command to the Get-VBRBackup command.  Everything works but the newer script is very slow;  it went from a few seconds with the old script to 5-10 minutes with the new.  I was wondering if anyone could give me pointers on a more efficient way to get the session information or otherwise speed it up. Thanks in advance!!RobbOriginal script#backup JobsForeach ($JobObject in Get-VBRJob){ #write-host "loop number ${$jobobject.indexof()}" $session=$jobobject.FindLastSession() if (!($JobObject.JobType -eq "BackupSync")) { $JobOutput = New-Object -TypeName PSObject if (((get-date).AddDays(-1) -lt $session.Progress.StopTimeLocal) -or ($session.Result -in "Failed","None")) { $JobOutput | Add-Member -Name "Job Name" -MemberType Noteproperty -Value $JobObject.Name $JobOutput | Add-Membe

Hello Community! Recently several changes were added to the AsBuiltReport.Veeam.VBR script that allow to improve the documentation process of Veeam B&R infrastructure. On this occasion, several bugs were fixed and a new feature was added to generate a diagram of the implemented components in the Veeam Backup & Replication infrastructure. Here are the new changes:https://techmyth.blog/posts/abr-veeam-vbr-0_8_6/ In addition I provide the following links so that you can see the sample report and an example of the infrastructure diagram. Sample ReportInfrastructure Diagram: Hasta la proxima! 😎  

Forgive me, as this isn’t strictly a Veeam topic, but I’m pulling my hair out.I’m trying to enhance a Windows Update Powershell script. The current script occasionally hangs when we invoke a COM CreateUpdateSearcher() method.$updateSession = new-object -com "Microsoft.Update.Session"$Criteria = "IsInstalled=0"$updates = $updateSession.CreateupdateSearcher().Search($criteria).UpdatesThis runs synchronously, so I can’t trap the hang. Instead, I want to use the BeginSearch() method that runs asynch (https://learn.microsoft.com/en-us/windows/win32/api/wuapi/nf-wuapi-iupdatesearcher-beginsearch). My problem is it requires an ‘IUnknown ISearchCompletedCallback’ object to be passed as one of the parameters. I don’t need this to be invoked, so it can be an empty object, but I can’t work out how to create an empty IUnknown object.$UpdateSession = New-Object -ComObject "Microsoft.Update.Session"$objSearcher = $UpdateSession.CreateUpdateSearcher()$objSearch = $objSearcher.BeginSearch('IsInstalled

IntroFirst of all: Happy new year to everyone!With Veeam Backup & Replication 12.1, many new security features have been added. One of these is the Guest Index Data Scan. For this, Veeam Backup & Replication uses a signature-based approach. During/after the backup job, the following malware activity can be detected:- Malware signatures specified in the "C:\Program Files\Veeam\Backup and Replication\Backup\SuspiciousFiles.xml" on the backup server- Multiple files renamed by malware- Multiple files deleted by malwarePlease read the Help Center documentation  to learn more about the details and how it works.In addition to the XML file, manual customization is also possible. You can add a malware signature that is marked as suspicious (Suspicious files) or that should be skipped (Trusted files) during the scan. See here. Questions you might askBut how do you know how many "built-in" and how many manually entered entries there are? Of course you can check the manual settings in the

Hi Folks,Following on from the news regarding a backdoor in the Linux library xz, a Yara Rule is now available that can be used in Veeam 12.1 if you do not utilise a vulnerability scanner in your environment. Great way to check by leveraging Veeam to do the scanning for you. There is more info about the vulnerability on the post by @JMeixner :Yara Rule can be found here: https://github.com/Neo23x0/signature-base/blob/master/yara/bkdr_xz_util_cve_2024_3094.yar 

Hi Community team! I have a doubt regarding the availability of VDC 365 Data Residency in Brazil's South Azure Region. I didn´t find this information in the documentation.The service´s docs state that backup data created by Veeam Data Cloud for Microsoft 365 or Veeam Data Cloud for Microsoft Azure can be targeted to and reside in any Azure region as end users request. Metadata is encrypted and stored in one of the following Azure regions: United States West. United Kingdom South, or Australia East.Do you know if storing the backups in Brazil's South Region in an LRS redundancy schema is possible?Choose the Right Azure Region for You | Microsoft AzureThanks so much for your help! 

I have a pretty simple request that I just can’t seem to identify the correct command for.I’m just looking to be able to query what job a system is a member of. It’s very easy to do for any virtual systems, but harder for physical. Connecting and getting the job are easy. And the $Job.BackupObject property contains the Physical Infrastructure object I’m interested in, but not the actual members of the Physical Infrastructure box.The script:The Physical Infrastructure Object:The contents I’m really trying to get:  

Hi all, I’ve been toying around with the idea of a cli tool that works with everything and is related to the other post I put up today on the Go-Veeam-Auth that does authentication for all Veeam APIs. Anyway, I’ve come up with vcli a simple terminal app written in Go, allowing you to switch between APIs with minimal effort quickly. All the authentication is set up, so all you need to do is set some environmental variables, and off you go (no pun intended).The main output is JSON, but you can switch it over to YAML via a --yaml switch.The tool only does GET requests at the moment, as I wanted to gauge the interest before committing any more time to the project. Where the power really comes in when it is coupled with “nushell” which is a data-centric approach to shells. It makes manipulating json response objects a breeze and also allows conversion to other data formats. It also has a whole module system which I go into a bit on my GitHub. GitHub page: https://github.com/shapedthought/vc

Greetings, everyone! Today we'll delve into the art of identifying basic file Indicators of Compromise (IoCs), crafting YARA rules to sniff out malicious actors, and seamlessly integrating these rules into Veeam Backup & Replication to safeguard our backups against potential malware threats. But before we dive in, let's take a moment to understand YARA and what its for. YARAYARA is an open-source malware classification tool used to identify and classify malware or suspicious files based on its signatures or rules. It is a powerful and flexible tool that allows users to create rules matching their organization’s needs or targeting specific threats. Moreover, YARA rules are like a piece of programming language, they work by defining a number of variables that contain patterns found in a sample of malware. If some or all of the conditions are met, depending on the rule, then it can be used to successfully identify a piece of malware. Indicators of Compromise (IoCS)Suppose one day a us

This is a Powershell Script that can be used to install and configure Veeam AIX Agent without needing to log into the AIX system. Can be because of lack of AIX expertise or a large number of AIX systems.  https://github.com/VeeamHub/powershell/tree/master/BR-AgentAIX-Install

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v12.1 is now available on VeeamHub! For more details on the script itself, I recommend reading the documentation on VeeamHub.https://github.com/VeeamHub/powershell/tree/master/BR-UpgradeV12.1 If you’re familiar with my previously written upgrade script for v12, here’s a summary of enhancements in this latest release:Added support for new silent upgrade process available in version 12.1 Veeam Backup & Replication Veeam Backup Enterprise Manager Added ISO validation as the script was written for a v12.1 ISO This will prevent an admin from accidentally using an incorrect ISO If you're a VCSP, the script can also be used for Cloud Connect environment upgrades.

Support for the v12.1 (VBR/EM) is now available in the Veeam Collection for Ansible!Veeam Backup & Replication 12.1 is an incredible release jam-packed with goodies! Among those is a brand new process for installing & upgrading Veeam Backup & Replication, Veeam Backup Enterprise Manager, and the Veeam Backup & Replication Console.I’m happy to report this collection fully supports this process! Please review the below changelog for more detailed changes in this release: Breaking ChangesChanged default ISO checksum algorithm from SHA256 to SHA1 As Veeam’s website doesn’t provide SHA256 checksum, this only made sense to change. Major ChangesAdded support for new silent install process available in version 12.1 Added support for new silent install process available in version 12.1 Added support for Veeam Backup & Replication Console 12.1 install Added support for Veeam Backup & Replication Console 12.1 upgradeMinor ChangesUpdated ISO to version 12.1 Updated logic fo

UPDATE (Feb 2024):It was brought to my attention recently that some of the cmdlets have changed in v12.x that may have broken one or more of the above scripts. I’ve rewritten the one that was pointed out (Veeam Agent Jobs) and tested to make sure it works. I can’t vouch for the others, but will try to get around to updating them all (if needed) and posting the updates here. Just be sure if you’re on 12.x or newer that you do thorough checks to confirm it works in a safe environment before attempting to run anything in production.------------------------------------------------------Hello again, everyone! Just sharing another useful PowerShell script to enable/disable Health Checks for multiple jobs. It’s handy whenever you have a large number of jobs which all need to be adjusted and would take a significant amount of time to do so. Usually I wouldn’t share such a short script, but the way to locate and adjust this particular option in a job via PowerShell can be a little confusing if

A tape verification a day….😉Tape backups are an essential part of data protection strategies as they provide reliable security and offline storage capabilities. However, ensuring the reliability and consistency of tape backups can be critical for regulatory compliance and ensuring data integrity.So I wrote a Powershell script (which has been floating around in my head for a long time) that uses the available Powershell cmdlet "Start-VBRTapeVerification" to regularly check tapes available in a media pool and marks them as checked with time stamps and checks the tapes again after a certain time (default 270 days). It also helps to increase data reliability and reduces the manual effort involved in managing tape backups. The script can be downloaded here.The following parameters can be utilized to customize the tape verification:MediaPool: Specifies the media pool from which tapes will be selected for verification. This parameter is mandatory. NumberofTapes: Determines the number of tape

Looking for backup report script to output to html. Currently not veaam one in the environment.