YARA and Script Library

Hello, As you may know I have been working for some time with several tools to document or diagram the Veeam Backup & Replica Infrastructure. In the latest version of Veeam.Diagrammer the ability to generate a diagram of the infrastructure has been added. Here is the link:https://techmyth.blog/posts/veeam-diagraming-infra/ Greetings from the Caribbean :) 

If you do not run VeeamONE, it can be challenging to check if every VM that should be backed up, is really backed up. Therefore I wrote a small PowerShell script. Basically this script looks for each VM if there is a restore point for this VM. If not, it gets listed. Extra feature: Script connects to every vCenter that is registered in B&R server. There is a Blocklist included: when VMs should not be backuped, just place their name in the blocklist and they will not be shown in the list. So you can exclude VMs without editing the script.Notes:CredObject.xml is used for stored, encrypted credentials. Script connects to local B&R server, so it should run there if not changed. # Load Plugin and moduleAdd-PSSnapin VeeamPSSnapinImport-Module VMware.VimAutomation.Core# Configure for multiple vCenter ConnectionsSet-PowerCLIConfiguration -DefaultVIServerMode

Hello together,before you update VEEAM to Version 12 using VMware vCenter/ESXi please check VMs HardDisks for duplicate UUID. In Version 11 this was never a problem. In the new Version VEEAM checks the UUID and backup will fail.VMware has no problem with that most time. But they know the Problem - https://kb.vmware.com/s/article/2006865This command will find any HardDisk with duplicate UUID - please note that this is VMware PowerCLI commandGet-VM | Get-HardDisk | Select @{N='VM';E={$_.Parent.Name}}, @{N='Uuid';E={$_.ExtensionData.Backing.Uuid}} | Group-Object -Property Uuid | ?{ $_.Count -gt 1 }As Service Provider such changes in VEEAM are a total disaster!!

Hello,I want to share with you the last script I make to get hardening configuration of the VBR server and then remediate some of them.The script need to be executed on the VBR server itself.It's built with Veeam 12.1 beta. That means some checks can break on GA version.I seperate it into 4 choices when you execute it :choice 1 = Apply Level 1 security (security check done by veeam product itself when you execute security and compliance on the VBR console)choice 2 = Apply Level 2 security (best practice about hardening Veeam product)choice 3 = Remove VBR console (Carreful, you can't use anymore Veeam powershell after this action)choice 4 = Get HTML security report That means choice 1 or 2 or 3 will performs modifications on the system.Choice 4 will not do any modifications, it just make the HTML report.

Hi Community,after Rick's announcement (thanks for the initiative), I couldn't resist creating another script for the community.As documented, you can add one YARA rule file to the scan process. But what if you want to use multiple YARA rules? Of course you could work with a so-called index file, which refers to the individual YARA rules, but this brings a problem with it, because the YARA rules are stored on the VBR server, but the scan process provides the backups on the mount server and only one YARA rule can be used (This is a topic for another blog post - stay tuned).  What if we would like to use all YARA rules from Rick's Top 10 Ransomw

I was wondering if there is a way to use PowerShell to determine if a machine in a protection group has not backed up in the last 30 days. Obviously in Inventory there are protection groups that have machines in them and a status of “Last Agent Backup”. Is it possible to generate a report that displays that information? Basically I would like to put the script into task scheduler and have it run the 2nd and the 24th of every month. Any advice? # Load Veeam PowerShell ModuleImport-Module Veeam.Backup.PowerShell# Define protection group names$protectionGroupNames = @("Example Protection Group", "Example Protection Group 2")# Get the current date and time window$timeWindow = (Get-Date).AddDays(-30)# Initialize array to store report data$reportData = @()foreach ($groupName in $protectionGroupNames) { # Get the protection group

Yesterday, during the VEEAM User Group Germany someone was missing a Maintenance Mode for VEEAM. The main problem was to keep which job was enabled and which was disabled. I wrote a script some times ago which stopped all jobs and disable them but before the state is dumped into a JSON File. On leaving maintenence the JSON-File will be read and required jobs are set to enabled again and failed jobs are triggered to restart. The scripts (and more) can be found on our github repository: https://github.com/claranet/VeeamHub/ Here are these scripts:Enter-Maintenance.ps1param( [switch]$DryRun=$False)Import-Module Veeam.Backup.PowerShellFunction log($message) { $timestamp = Get-Date -Format "yyyy-MM-ss hh:mm:ss" Write-Host "$($timestamp) - $($messa

Hello Veeam Community! I'm excited to introduce a Python script that I've developed for anonymizing Veeam Backup & Replication logs. Protecting sensitive information in log files is crucial, and this script simplifies the process while maintaining the integrity of your logs. Veeam Log Anonymizer logo Acknowledgments:Before diving into the details, I'd like to express my gratitude:Bertrand: Thank you for the original idea that inspired this script and for your valuable improvement suggestions. Your input was instrumental in making this script more robust and feature-rich.

Now that V12.1 is available, I wanted to share with you a featured YARA rule set that can give you on-demand scanning for some top ransomware threats. Attached to this post is a file named: Top10RW_YARArules.zip. In this file are YARA rules for some common ransomware threats that have been seen recently:Attribution: This great collection was made by Felix Bilsten. Links: X: Felix Bilstein (@fxb_b) / X (twitter.com), website: Felix Bilstein - project overview (cocacoding.com) and Github: fxb-cocacoding (Felix Bilstein) · GitHub

Update Jan 13th - Latest version available on https://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-health-checker***It's always recommended to open a support case as soon you're facing an issue with Veeam Backup for Microsoft Office 365. But as systems engineers, we somehow always want to know what happens under the hood That's why I started writing a VBO Health Check script which quickly gives some useful information about the health of a Veeam Backup for Microsoft 365 setup. The script checks and reports possible issues/misconfigurations:    - Backup Job Status per Job / Number of failed job    - License expiration date

Inherency:Since we bill by actual disk usage for our client utilizing CloudConnect, the existing reports are non-functional for reporting and billing (They report pre-deduplication/reflink data).  It took a while to figure out, but there is a way to calculate actual disk space used on a per directory on an immutable repository.Solution:Using: https://community.veeam.com/blogs-and-podcasts-57/check-reflink-and-spared-space-on-xfs-repositories-244 I have extrapolated a script that will give the disk usage of each folder (IE: client) on an immutable repo.  This isn't "Data used"; that is what Veeam reports.  This is "Disk Used".  The actual size on disk after reflinks (duplicated data is only counted once). A note about this script; it appears that the original blog entr

[CmdletBinding()]param ( # CSv file tab delimited with name and Vlan [Parameter(Mandatory = $true)] [string[]] $CSV, # The datacenter where you want to move the workload to. [Parameter(Mandatory = $true)] [string] $Datacenter, # The Cluster where you want to move the workload to. [Parameter(Mandatory = $true)] [string] $Cluster, # Errorlog [Parameter()] [string] $ErrorLog = 'E:\Scripts\ErrorLog.txt', # Enable error logging [Parameter()] [switch] $LogErrors, # Enable error logging [Parameter()] [Int32] $HostIndex = 0)#$Global:ErrorLog = 'E:\Scripts\ErrorLog.txt'function Write-ToLog { [cmdletbinding()] Param ( [string] [parameter(ValueFromPipeline)]

The problemHave you ever needed to know how much data you need to backup incrementally from your VMware environment? Because you need to design a new backup storage? Because you need to know, if your WAN is capable of transferring everything into the cloud or from your branch office? Because you need to know the change rates of your VMs? The solutionNow you can track these data changes with a simple script! Let me introduce you to GetChangedBlocksV2! It is a PowerShell script which uses the VMware PowerCLI to read the changes from your VMware disks each time it is run and saves it as CSV. It keeps track of the changes between each run, between each day and between each week. In order to get

Since the introduction of NAS backup capability with v10 of Veeam Backup & Replication there have been many requests for tape support. But as we all know, Veeam’s NAS backup doesn’t support tape (yet?), neither as a primary nor as secondary (backup copy or archive) target.With v11 we got the new feature called “instant file share recovery” which lets us publish file shares directly from the backups previously created with NAS backup jobs. My colleague Uwe Groening recently came up with the idea to use these shares, published by instant file share recovery, as a source for file to tape jobs within Veeam. This way, it should be possible to create tape copies directly from existing file share backups. This makes a huge difference to other solutions that involve either reading data from the production share again or staging a restore on some (extra) storage prior to using “file to tape” from there.We discussed this idea in more detail and crea

These diagrams are a sample of what I am working on in PowerShell for the next version of the Veeam.Diagrammer module. I am mainly working on generating diagrams of the Cloud Connect infrastructure and the composition of resources used by the tenants. Cloud Connect Infrastructure:Cloud Connect Infrastructure  Per Tenant diagram:Tenant5 Tenant4These improvements will also be part of the next version of the AsBuiltReport.Vee

As already announced (see here), the first draft of the Backup Scanning Tools Menu has just been made available in my GitHub repository. This script is designed to provide a user-friendly, menu-driven interface for triggering the various backup scan tools that I have provided in the past. It allows the user to choose from a number of options, each corresponding to a specific type of backup scan. The script provides detailed descriptions of each scan operation before prompting the user to enter the required parameters for execution.Besides the actual Scanning Tool Menu script I also created an installer script that "installs" all necessary scan scripts into the selected directory.InstallationFollow these steps:Download the Installer Script Download the

Hi,Where do you guys mostly download Yara rules for Veeam from?This GIT looks not maintained for years (files from 2022).  https://github.com/YARA-Rules/rules/archive/refs/heads/master.zipI also used those links but I had some troubles when scanning backup.https://github.com/Neo23x0/signature-base/archive/refs/heads/master.ziphttps://yaraify.abuse.ch/yarahub/yaraify-rules.zip

Hello,we have many times request from customer to prolong backup images from 6 months to 1 year.I know, some complicated things like restore VM and provide backup again with 1 year or export this image, map to backup job and setup copy job with one year.Does exist any command in PowerShell to change expiration date?thank you

SQL Commands for Veeam to be able to link a Backup Job that was done before the Veeam B&R Server was migrated to a new server. and Perform a Backup Copy Job.

Creating many backup jobs for new environment or new project which has many VMs, it’s boring in addition you may make a mistake because of repeating.To avoid that you can use scripts to create them simultaneously and only change the value for some variables.Below script is for creating VMware VM backup job with almost all required options (VM selection, repo, proxy, retention , GFS, schedule , retries ….etc) moreover the recommended Advanced settings for Dell Data Domain repository.You can also use part of script to edit or modify existing backup jobs simultaneously.{{#Specify the name you want to assign to the backup job$JobName = "backup job name" #Specify the array of VMware VMs you want to add to the job.#If you want to search by part of VM name use *$VMsNames = Find-VBRViEntity -Name "VM1", "VM2", "VM3" #Specify the backup repository where the created backup will be stored. Default: default bac

Hi,I need to write to the tape files created during previous day. I have a script which generates that list. How can I tell Veeam, which files to write?Do I need to write script creating a new job each day or it is possible to use “before job script” for that?Thanks in advance 

Hi all, I’ve been toying around with the idea of a cli tool that works with everything and is related to the other post I put up today on the Go-Veeam-Auth that does authentication for all Veeam APIs. Anyway, I’ve come up with vcli a simple terminal app written in Go, allowing you to switch between APIs with minimal effort quickly. All the authentication is set up, so all you need to do is set some environmental variables, and off you go (no pun intended).The main output is JSON, but you can switch it over to YAML via a --yaml switch.The tool only does GET requests at the moment, as I wanted to gauge the interest before committing any more time to the project. Where the power really comes in when it is coupled with “nushell” which is a data-centric approach to shells. It makes manipulating json response objects a breeze and also allows conversion to other data formats. It also has a whole module system which I go into a bit on my GitHub. Git

Hi guys, I was wondering if it is possible to enable the encrypt option for all backup jobs using powershell. I already have created the encryption key/password.  Your help would be appriciated.