Veeam Backup & Replication REST API
This Integration is part of the Veeam App for Palo Alto Networks XSOAR Pack.#
Supported versions
Supported Cortex XSOAR versions: 6.10.0 and later.
Veeam Backup & Replication REST API allows you to query information about Veeam Backup & Replication entities and perform operations with these entities using HTTP requests and standard HTTP methods. This integration was integrated and tested with version 1.1-rev2 of VBR REST API.
Configure Veeam Backup & Replication REST API on Cortex XSOAR#
Navigate to Settings > Integrations > Servers & Services.
Search for Veeam Backup & Replication REST API.
Click Add instance to create and configure a new integration instance.
Parameter Description Required Username True Password True Resource URL True Trust any certificate (not secure) False Use system proxy settings False Fetch incidents False First fetch time False Fetch configuration backup events False Days Since Last Configuration Backup An incident will be created If the last successful configuration backup is older than the specified value. False Fetch backup repository events False Backup Repository Free Space (GB) An incident will be created If the backup repository free space is less than the specified value. False Backup Repository Events Per Request The maximum number of backup repository events that can be fetched during command execution. False Fetch malware events False Malware Events Per Request The maximum number of malware events that can be fetched during command execution. False Incidents Fetch Interval False Incident type False Click Test to validate the URLs, token, and connection.
Commands#
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
veeam-vbr-create-malware-event#
Create Malware Event
Base Command#
veeam-vbr-create-malware-event
Input#
| Argument Name | Description | Required |
|---|---|---|
| detectiontimeutc | 'Detection date and time, in UTC.' | Required |
| machine_fqdn | Machine FQDN. | Optional |
| machine_ipv4 | Machine IPv4 address. | Optional |
| machine_ipv6 | Machine IPv6 address. | Optional |
| machine_uuid | Machine BIOS UUID in the 8-4-4-4-12 format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. | Optional |
| details | 'Event description.' | Required |
| engine | 'Detection engine.' | Required |
Context Output#
There is no context output for this command.
veeam-vbr-get-all-malware-events#
Get All Malware Events
Base Command#
veeam-vbr-get-malware-events
Input#
| Argument Name | Description | Required |
|---|---|---|
| skip | Number of events to skip. | Optional |
| limit | Maximum number of events to return. Default is 100. | Optional |
| orderColumn | Sorts events by event meter. | Optional |
| orderAsc | Sorts events in the ascending order by the orderColumn meter. | Optional |
| typeFilter | Filters events by event type. | Optional |
| detectedAfterTimeUtcFilter | Returns events created after the specified time, in UTC. | Optional |
| detectedBeforeTimeUtcFilter | Returns events created before the specified time, in UTC. | Optional |
| backupObjectIdFilter | Filters events by backup object ID. | Optional |
| stateFilter | Filters events by state. | Optional |
| sourceFilter | Filters events by source type. | Optional |
| severityFilter | Filters events by severity. | Optional |
| createdByFilter | Filters events by the createdBy pattern. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end, or both. | Optional |
| engineFilter | Filters events by the engine pattern. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end, or both. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.get_malware_events.data.id | String | Event ID. |
| Veeam.VBR.get_malware_events.data.type | String | Event type. |
| Veeam.VBR.get_malware_events.data.detectionTimeUtc | String | Detection date and time, in UTC. |
| Veeam.VBR.get_malware_events.data.state | String | Event state. |
| Veeam.VBR.get_malware_events.data.details | String | Event description. |
| Veeam.VBR.get_malware_events.data.source | String | Event source type. |
| Veeam.VBR.get_malware_events.data.severity | String | Malware status. |
| Veeam.VBR.get_malware_events.data.createdBy | String | User account created the event. |
| Veeam.VBR.get_malware_events.data.engine | String | Detection engine. |
veeam-vbr-get-all-repository-states#
Get All Repository States
Base Command#
veeam-vbr-get-repository-states
Input#
| Argument Name | Description | Required |
|---|---|---|
| skip | Number of repository states to skip. | Optional |
| limit | Maximum number of repository states to return. Default is 100. | Optional |
| orderColumn | Sorts repository states by state meter. | Optional |
| orderAsc | Sorts repository states in the ascending order by the orderColumn meter. | Optional |
| idFilter | Filters repository states by repository ID. | Optional |
| nameFilter | Filters repository states by the nameFilter pattern. The pattern can match any repository state meter. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end, or both. | Optional |
| typeFilter | Filters repository states by repository type. | Optional |
| capacityFilter | Filters repository states by repository capacity. | Optional |
| freeSpaceFilter | Filters repository states by repository free space. | Optional |
| usedSpaceFilter | Filters repository states by repository used space. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.get_repository_states.data.id | String | Backup repository ID. |
| Veeam.VBR.get_repository_states.data.name | String | Backup repository name. |
| Veeam.VBR.get_repository_states.data.type | String | Backup repository type. |
| Veeam.VBR.get_repository_states.data.description | String | Description of the backup repository. |
| Veeam.VBR.get_repository_states.data.capacityGB | String | Repository capacity in GB. |
| Veeam.VBR.get_repository_states.data.freeGB | String | Repository free space in GB. |
| Veeam.VBR.get_repository_states.data.usedSpaceGB | String | Repository used space in GB. |
| Veeam.VBR.get_repository_states.data.hostId | String | ID of the server that is used as a backup repository. |
| Veeam.VBR.get_repository_states.data.hostName | String | Name of the server that is used as a backup repository. |
| Veeam.VBR.get_repository_states.data.path | String | Path to the folder where backup files are stored. |
veeam-vbr-get-all-restore-points#
Get All Restore Points
Base Command#
veeam-vbr-get-restore-points
Input#
| Argument Name | Description | Required |
|---|---|---|
| skip | Number of restore points to skip. | Optional |
| limit | Maximum number of restore points to return. Default is 100. | Optional |
| orderColumn | Sorts restore points by restore point meter. | Optional |
| orderAsc | Sorts restore points in the ascending order by the orderColumn meter. | Optional |
| createdAfterFilter | Returns restore points created after the specified date and time. | Optional |
| createdBeforeFilter | Returns restore points created before the specified date and time. | Optional |
| nameFilter | Filters restore points by the nameFilter pattern. The pattern can match any restore point meter. To substitute one or more characters, use the asterisk (*) character at the beginning and/or at the end. | Optional |
| platformNameFilter | Filters restore points by name of the backup object platform. | Optional |
| platformIdFilter | Filters restore points by ID of the backup object platform. | Optional |
| backupIdFilter | Filters restore points by backup ID. | Optional |
| backupObjectIdFilter | Filters restore points by backup object ID. | Optional |
| malwareStatusFilter | Filters restore points by malware status. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.get_restore_points.data.id | String | Restore point ID. |
| Veeam.VBR.get_restore_points.data.name | String | Object name. |
| Veeam.VBR.get_restore_points.data.platformId | String | ID of a platform where the object was created. |
| Veeam.VBR.get_restore_points.data.creationTime | String | Date and time when the restore point was created. |
| Veeam.VBR.get_restore_points.data.backupId | String | ID of a backup that contains the restore point. |
| Veeam.VBR.get_restore_points.data.platformName | String | Platform name. |
| Veeam.VBR.get_restore_points.data.malwareStatus | String | Malware status. |
veeam-vbr-get-backup-object#
Get Backup Object
Base Command#
veeam-vbr-get-backup-object
Input#
| Argument Name | Description | Required |
|---|---|---|
| id_ | ID of the backup object. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.backup_object.objectId | String | ID of the virtual infrastructure object (mo-ref or ID, depending on the virtualization platform). |
| Veeam.VBR.backup_object.viType | String | Type of the VMware vSphere object. |
| Veeam.VBR.backup_object.path | String | Path to the object. |
| Veeam.VBR.backup_object.id | String | Object ID. |
| Veeam.VBR.backup_object.name | String | Object name. |
| Veeam.VBR.backup_object.type | String | Object type. |
| Veeam.VBR.backup_object.vcenter_name | string | Name of the vCenter Server. |
veeam-vbr-get-configuration-backup#
Get Configuration Backup
Base Command#
veeam-vbr-get-configuration-backup
Input#
| Argument Name | Description | Required |
|---|
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.get_configuration_backup.isEnabled | String | If `true`, configuration backup is enabled. |
| Veeam.VBR.get_configuration_backup.backupRepositoryId | String | ID of the backup repository on which the configuration backup is stored. |
| Veeam.VBR.get_configuration_backup.restorePointsToKeep | number | Number of restore points to keep in the backup repository. |
| Veeam.VBR.get_configuration_backup.Schedule | Scheduling settings. | |
| Veeam.VBR.get_configuration_backup.Encryption | Encryption settings. | |
| Veeam.VBR.get_configuration_backup.LastSuccessfulBackup | Last successful backup. |
veeam-vbr-get-inventory-objects#
Get Inventory Objects
Base Command#
veeam-vbr-get-inventory-objects
Input#
| Argument Name | Description | Required |
|---|---|---|
| resetCache | If true, the cache will be reset for this request. Resetting the cache slows down request processing but allows you to get up-to-date data. | Optional |
| hostname | Server name. | Required |
| skip | Number of objects to skip. | Optional |
| limit | Maximum number of objects to return. Default is 100. | Optional |
| filter | Filter settings. | Optional |
| sorting | Sorting settings. | Optional |
| hierarchyType | Hierarchy type. | Optional |
| objectName | Object name. | Optional |
| viType | Type of the VMware vSphere object. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.get_inventory_objects.data.name | String | Name of the VMware vSphere object. |
| Veeam.VBR.get_inventory_objects.data.type | String | Type of the VMware vSphere object. |
| Veeam.VBR.get_inventory_objects.data.hostName | String | Name of the VMware vSphere server that hosts the object. |
| Veeam.VBR.get_inventory_objects.data.objectId | String | ID of the VMware vSphere object. The parameter is required for all VMware vSphere objects except vCenter Servers and standalone ESXi hosts. |
| Veeam.VBR.get_inventory_objects.data.urn | String | Object URN. |
| Veeam.VBR.get_inventory_objects.data.platform | String | Platform name. |
| Veeam.VBR.get_inventory_objects.data.size | String | Object size. |
veeam-vbr-get-session#
Get Session
Base Command#
veeam-vbr-get-session
Input#
| Argument Name | Description | Required |
|---|---|---|
| id_ | Session ID. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.get_session.jobId | String | ID of the job or job related activity. |
| Veeam.VBR.get_session.creationTime | String | Date and time when the session was created. |
| Veeam.VBR.get_session.id | String | Session ID. |
| Veeam.VBR.get_session.name | String | Session name. |
| Veeam.VBR.get_session.sessionType | String | Session type. |
| Veeam.VBR.get_session.state | String | Session state. |
| Veeam.VBR.get_session.usn | String | Update sequence number. |
| Veeam.VBR.get_session.endTime | String | Date and time when the session was ended. |
| Veeam.VBR.get_session.progressPercent | String | Progress percentage of the session. |
| Veeam.VBR.get_session.result | unknown | Session result. |
| Veeam.VBR.get_session.resourceId | String | Resource ID. |
| Veeam.VBR.get_session.resourceReference | String | URI of the resource. |
| Veeam.VBR.get_session.parentSessionId | String | Parent session ID. |
veeam-vbr-start-configuration-backup#
Start Configuration Backup
Base Command#
veeam-vbr-start-configuration-backup
Input#
| Argument Name | Description | Required |
|---|
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.Configurationbackuphasbeenstarted.jobId | String | ID of the job or job related activity. |
| Veeam.VBR.Configurationbackuphasbeenstarted.creationTime | String | Date and time when the session was created. |
| Veeam.VBR.Configurationbackuphasbeenstarted.id | String | Session ID. |
| Veeam.VBR.Configurationbackuphasbeenstarted.name | String | Session name. |
| Veeam.VBR.Configurationbackuphasbeenstarted.sessionType | String | Session type. |
| Veeam.VBR.Configurationbackuphasbeenstarted.state | String | Session state. |
| Veeam.VBR.Configurationbackuphasbeenstarted.usn | String | Update sequence number. |
| Veeam.VBR.Configurationbackuphasbeenstarted.endTime | String | Date and time when the session was ended. |
| Veeam.VBR.Configurationbackuphasbeenstarted.progressPercent | String | Progress percentage of the session. |
| Veeam.VBR.Configurationbackuphasbeenstarted.resourceId | String | Resource ID. |
| Veeam.VBR.Configurationbackuphasbeenstarted.resourceReference | String | URI of the resource. |
| Veeam.VBR.Configurationbackuphasbeenstarted.parentSessionId | String | Parent session ID. |
veeam-vbr-start-instant-recovery-customized#
Start Customized VM Instant Recovery
Base Command#
veeam-vbr-start-instant-recovery-customized
Input#
| Argument Name | Description | Required |
|---|---|---|
| restorePointId | Restore point ID. | Required |
| vmTagsRestoreEnabled | If true, Veeam Backup & Replication restores tags that were assigned to the original VM, and assign them to the restored VM. | Optional |
| antivirusScanEnabled | If true, Veeam Backup & Replication scans machine data with antivirus software before restoring the machine to the production environment. | Required |
| virusDetectionAction | Action that Veeam Backup & Replication takes if the antivirus software finds a threat. | Optional |
| entireVolumeScanEnabled | If true, the antivirus continues machine scan after the first malware is found. | Optional |
| nicsEnabled | If true, the restored VM is connected to the network. | Optional |
| powerUp | If true, Veeam Backup & Replication powers on the restored VM on the target host. | Optional |
| reason | Reason for restoring the VM. | Optional |
| restoredVmName | Restored VM name. | Optional |
| vCenterName | Name of the vCenter Server. | Required |
| hostObjectId | ID of the VMware vSphere object. The parameter is required for all VMware vSphere objects except vCenter Servers and standalone ESXi hosts. | Required |
| folderObjectId | ID of the VMware vSphere object. The parameter is required for all VMware vSphere objects except vCenter Servers and standalone ESXi hosts. | Required |
| resObjectId | ID of the VMware vSphere object. The parameter is required for all VMware vSphere objects except vCenter Servers and standalone ESXi hosts. | Optional |
| platform | Platform name. | Required |
| biosUuidPolicy | BIOS UUID policy for the restored VM. | Required |
| redirectEnabled | If true, redo logs are redirected to cacheDatastore. | Required |
| overwrite | If true, Veeam Backup & Replication overwrites the existing VM that has the same name. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.start_recovery.id | string | Session ID. |
| Veeam.VBR.start_recovery.name | string | Session name. |
| Veeam.VBR.start_recovery.jobId | string | ID of the job or job related activity. |
| Veeam.VBR.start_recovery.sessionType | string | Session type. |
| Veeam.VBR.start_recovery.creationTime | string | Date and time when the session was created. |
| Veeam.VBR.start_recovery.state | string | Session state. |
| Veeam.VBR.start_recovery.endTime | string | Date and time when the session was ended. |
| Veeam.VBR.start_recovery.usn | string | Update sequence number. |
veeam-vbr-start-instant-recovery#
Start VM Instant Recovery to Original Location
Base Command#
veeam-vbr-start-instant-recovery
Input#
| Argument Name | Description | Required |
|---|---|---|
| restorePointId | Restore point ID. | Required |
| vmTagsRestoreEnabled | If true, Veeam Backup & Replication restores tags that were assigned to the original VM, and assign them to the restored VM. | Optional |
| antivirusScanEnabled | If true, Veeam Backup & Replication scans machine data with antivirus software before restoring the machine to the production environment. | Required |
| virusDetectionAction | Action that Veeam Backup & Replication takes if the antivirus software finds a threat. | Optional |
| entireVolumeScanEnabled | If true, the antivirus continues machine scan after the first malware is found. | Optional |
| nicsEnabled | If true, the restored VM is connected to the network. | Optional |
| powerUp | If true, Veeam Backup & Replication powers on the restored VM on the target host. | Optional |
| reason | Reason for restoring the VM. | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Veeam.VBR.start_recovery.id | string | Session ID. |
| Veeam.VBR.start_recovery.name | string | Session name. |
| Veeam.VBR.start_recovery.jobId | string | ID of the job or job related activity. |
| Veeam.VBR.start_recovery.sessionType | string | Session type. |
| Veeam.VBR.start_recovery.creationTime | string | Date and time when the session was created. |
| Veeam.VBR.start_recovery.state | string | Session state. |
| Veeam.VBR.start_recovery.endTime | string | Date and time when the session was ended. |
| Veeam.VBR.start_recovery.usn | string | Update sequence number. |