Skip to main content

Veeam Backup & Replication REST API

This Integration is part of the Veeam App for Palo Alto Networks XSOAR Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.10.0 and later.

Veeam Backup & Replication REST API allows you to query information about Veeam Backup & Replication entities and perform operations with these entities using HTTP requests and standard HTTP methods. This integration was integrated and tested with version 1.1-rev2 of VBR REST API.

Configure Veeam Backup & Replication REST API in Cortex#

ParameterDescriptionRequired
UsernameTrue
PasswordTrue
Resource URLTrue
Trust any certificate (not secure)False
Use system proxy settingsFalse
Fetch incidentsFalse
First fetch timeFalse
Fetch configuration backup eventsFalse
Days Since Last Configuration BackupAn incident will be created If the last successful configuration backup is older than the specified value.False
Fetch backup repository eventsFalse
Backup Repository Free Space (GB)An incident will be created If the backup repository free space is less than the specified value.False
Backup Repository Events Per RequestThe maximum number of backup repository events that can be fetched during command execution.False
Fetch malware eventsFalse
Malware Events Per RequestThe maximum number of malware events that can be fetched during command execution.False
Incidents Fetch IntervalFalse
Incident typeFalse

Commands#

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

veeam-vbr-create-malware-event#


Create Malware Event

Base Command#

veeam-vbr-create-malware-event

Input#

Argument NameDescriptionRequired
detectiontimeutc'Detection date and time, in UTC.'Required
machine_fqdnMachine FQDN.Optional
machine_ipv4Machine IPv4 address.Optional
machine_ipv6Machine IPv6 address.Optional
machine_uuidMachine BIOS UUID in the 8-4-4-4-12 format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.Optional
details'Event description.'Required
engine'Detection engine.'Required

Context Output#

There is no context output for this command.

veeam-vbr-get-all-malware-events#


Get All Malware Events

Base Command#

veeam-vbr-get-malware-events

Input#

Argument NameDescriptionRequired
skipNumber of events to skip.Optional
limitMaximum number of events to return. Default is 100.Optional
orderColumnSorts events by event meter.Optional
orderAscSorts events in the ascending order by the orderColumn meter.Optional
typeFilterFilters events by event type.Optional
detectedAfterTimeUtcFilterReturns events created after the specified time, in UTC.Optional
detectedBeforeTimeUtcFilterReturns events created before the specified time, in UTC.Optional
backupObjectIdFilterFilters events by backup object ID.Optional
stateFilterFilters events by state.Optional
sourceFilterFilters events by source type.Optional
severityFilterFilters events by severity.Optional
createdByFilterFilters events by the createdBy pattern. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end, or both.Optional
engineFilterFilters events by the engine pattern. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end, or both.Optional

Context Output#

PathTypeDescription
Veeam.VBR.get_malware_events.data.idStringEvent ID.
Veeam.VBR.get_malware_events.data.typeStringEvent type.
Veeam.VBR.get_malware_events.data.detectionTimeUtcStringDetection date and time, in UTC.
Veeam.VBR.get_malware_events.data.stateStringEvent state.
Veeam.VBR.get_malware_events.data.detailsStringEvent description.
Veeam.VBR.get_malware_events.data.sourceStringEvent source type.
Veeam.VBR.get_malware_events.data.severityStringMalware status.
Veeam.VBR.get_malware_events.data.createdByStringUser account created the event.
Veeam.VBR.get_malware_events.data.engineStringDetection engine.

veeam-vbr-get-all-repository-states#


Get All Repository States

Base Command#

veeam-vbr-get-repository-states

Input#

Argument NameDescriptionRequired
skipNumber of repository states to skip.Optional
limitMaximum number of repository states to return. Default is 100.Optional
orderColumnSorts repository states by state meter.Optional
orderAscSorts repository states in the ascending order by the orderColumn meter.Optional
idFilterFilters repository states by repository ID.Optional
nameFilterFilters repository states by the nameFilter pattern. The pattern can match any repository state meter. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end, or both.Optional
typeFilterFilters repository states by repository type.Optional
capacityFilterFilters repository states by repository capacity.Optional
freeSpaceFilterFilters repository states by repository free space.Optional
usedSpaceFilterFilters repository states by repository used space.Optional

Context Output#

PathTypeDescription
Veeam.VBR.get_repository_states.data.idStringBackup repository ID.
Veeam.VBR.get_repository_states.data.nameStringBackup repository name.
Veeam.VBR.get_repository_states.data.typeStringBackup repository type.
Veeam.VBR.get_repository_states.data.descriptionStringDescription of the backup repository.
Veeam.VBR.get_repository_states.data.capacityGBStringRepository capacity in GB.
Veeam.VBR.get_repository_states.data.freeGBStringRepository free space in GB.
Veeam.VBR.get_repository_states.data.usedSpaceGBStringRepository used space in GB.
Veeam.VBR.get_repository_states.data.hostIdStringID of the server that is used as a backup repository.
Veeam.VBR.get_repository_states.data.hostNameStringName of the server that is used as a backup repository.
Veeam.VBR.get_repository_states.data.pathStringPath to the folder where backup files are stored.

veeam-vbr-get-all-restore-points#


Get All Restore Points

Base Command#

veeam-vbr-get-restore-points

Input#

Argument NameDescriptionRequired
skipNumber of restore points to skip.Optional
limitMaximum number of restore points to return. Default is 100.Optional
orderColumnSorts restore points by restore point meter.Optional
orderAscSorts restore points in the ascending order by the orderColumn meter.Optional
createdAfterFilterReturns restore points created after the specified date and time.Optional
createdBeforeFilterReturns restore points created before the specified date and time.Optional
nameFilterFilters restore points by the nameFilter pattern. The pattern can match any restore point meter. To substitute one or more characters, use the asterisk (*) character at the beginning and/or at the end.Optional
platformNameFilterFilters restore points by name of the backup object platform.Optional
platformIdFilterFilters restore points by ID of the backup object platform.Optional
backupIdFilterFilters restore points by backup ID.Optional
backupObjectIdFilterFilters restore points by backup object ID.Optional
malwareStatusFilterFilters restore points by malware status.Optional

Context Output#

PathTypeDescription
Veeam.VBR.get_restore_points.data.idStringRestore point ID.
Veeam.VBR.get_restore_points.data.nameStringObject name.
Veeam.VBR.get_restore_points.data.platformIdStringID of a platform where the object was created.
Veeam.VBR.get_restore_points.data.creationTimeStringDate and time when the restore point was created.
Veeam.VBR.get_restore_points.data.backupIdStringID of a backup that contains the restore point.
Veeam.VBR.get_restore_points.data.platformNameStringPlatform name.
Veeam.VBR.get_restore_points.data.malwareStatusStringMalware status.

veeam-vbr-get-backup-object#


Get Backup Object

Base Command#

veeam-vbr-get-backup-object

Input#

Argument NameDescriptionRequired
id_ID of the backup object.Required

Context Output#

PathTypeDescription
Veeam.VBR.backup_object.objectIdStringID of the virtual infrastructure object (mo-ref or ID, depending on the virtualization platform).
Veeam.VBR.backup_object.viTypeStringType of the VMware vSphere object.
Veeam.VBR.backup_object.pathStringPath to the object.
Veeam.VBR.backup_object.idStringObject ID.
Veeam.VBR.backup_object.nameStringObject name.
Veeam.VBR.backup_object.typeStringObject type.
Veeam.VBR.backup_object.vcenter_namestringName of the vCenter Server.

veeam-vbr-get-configuration-backup#


Get Configuration Backup

Base Command#

veeam-vbr-get-configuration-backup

Input#

Argument NameDescriptionRequired

Context Output#

PathTypeDescription
Veeam.VBR.get_configuration_backup.isEnabledStringIf `true`, configuration backup is enabled.
Veeam.VBR.get_configuration_backup.backupRepositoryIdStringID of the backup repository on which the configuration backup is stored.
Veeam.VBR.get_configuration_backup.restorePointsToKeepnumberNumber of restore points to keep in the backup repository.
Veeam.VBR.get_configuration_backup.ScheduleScheduling settings.
Veeam.VBR.get_configuration_backup.EncryptionEncryption settings.
Veeam.VBR.get_configuration_backup.LastSuccessfulBackupLast successful backup.

veeam-vbr-get-inventory-objects#


Get Inventory Objects

Base Command#

veeam-vbr-get-inventory-objects

Input#

Argument NameDescriptionRequired
resetCacheIf true, the cache will be reset for this request. Resetting the cache slows down request processing but allows you to get up-to-date data.Optional
hostnameServer name.Required
skipNumber of objects to skip.Optional
limitMaximum number of objects to return. Default is 100.Optional
filterFilter settings.Optional
sortingSorting settings.Optional
hierarchyTypeHierarchy type.Optional
objectNameObject name.Optional
viTypeType of the VMware vSphere object.Optional

Context Output#

PathTypeDescription
Veeam.VBR.get_inventory_objects.data.nameStringName of the VMware vSphere object.
Veeam.VBR.get_inventory_objects.data.typeStringType of the VMware vSphere object.
Veeam.VBR.get_inventory_objects.data.hostNameStringName of the VMware vSphere server that hosts the object.
Veeam.VBR.get_inventory_objects.data.objectIdStringID of the VMware vSphere object. The parameter is required for all VMware vSphere objects except vCenter Servers and standalone ESXi hosts.
Veeam.VBR.get_inventory_objects.data.urnStringObject URN.
Veeam.VBR.get_inventory_objects.data.platformStringPlatform name.
Veeam.VBR.get_inventory_objects.data.sizeStringObject size.

veeam-vbr-get-session#


Get Session

Base Command#

veeam-vbr-get-session

Input#

Argument NameDescriptionRequired
id_Session ID.Required

Context Output#

PathTypeDescription
Veeam.VBR.get_session.jobIdStringID of the job or job related activity.
Veeam.VBR.get_session.creationTimeStringDate and time when the session was created.
Veeam.VBR.get_session.idStringSession ID.
Veeam.VBR.get_session.nameStringSession name.
Veeam.VBR.get_session.sessionTypeStringSession type.
Veeam.VBR.get_session.stateStringSession state.
Veeam.VBR.get_session.usnStringUpdate sequence number.
Veeam.VBR.get_session.endTimeStringDate and time when the session was ended.
Veeam.VBR.get_session.progressPercentStringProgress percentage of the session.
Veeam.VBR.get_session.resultunknownSession result.
Veeam.VBR.get_session.resourceIdStringResource ID.
Veeam.VBR.get_session.resourceReferenceStringURI of the resource.
Veeam.VBR.get_session.parentSessionIdStringParent session ID.

veeam-vbr-start-configuration-backup#


Start Configuration Backup

Base Command#

veeam-vbr-start-configuration-backup

Input#

Argument NameDescriptionRequired

Context Output#

PathTypeDescription
Veeam.VBR.Configurationbackuphasbeenstarted.jobIdStringID of the job or job related activity.
Veeam.VBR.Configurationbackuphasbeenstarted.creationTimeStringDate and time when the session was created.
Veeam.VBR.Configurationbackuphasbeenstarted.idStringSession ID.
Veeam.VBR.Configurationbackuphasbeenstarted.nameStringSession name.
Veeam.VBR.Configurationbackuphasbeenstarted.sessionTypeStringSession type.
Veeam.VBR.Configurationbackuphasbeenstarted.stateStringSession state.
Veeam.VBR.Configurationbackuphasbeenstarted.usnStringUpdate sequence number.
Veeam.VBR.Configurationbackuphasbeenstarted.endTimeStringDate and time when the session was ended.
Veeam.VBR.Configurationbackuphasbeenstarted.progressPercentStringProgress percentage of the session.
Veeam.VBR.Configurationbackuphasbeenstarted.resourceIdStringResource ID.
Veeam.VBR.Configurationbackuphasbeenstarted.resourceReferenceStringURI of the resource.
Veeam.VBR.Configurationbackuphasbeenstarted.parentSessionIdStringParent session ID.

veeam-vbr-start-instant-recovery-customized#


Start Customized VM Instant Recovery

Base Command#

veeam-vbr-start-instant-recovery-customized

Input#

Argument NameDescriptionRequired
restorePointIdRestore point ID.Required
vmTagsRestoreEnabledIf true, Veeam Backup & Replication restores tags that were assigned to the original VM, and assign them to the restored VM.Optional
antivirusScanEnabledIf true, Veeam Backup & Replication scans machine data with antivirus software before restoring the machine to the production environment.Required
virusDetectionActionAction that Veeam Backup & Replication takes if the antivirus software finds a threat.Optional
entireVolumeScanEnabledIf true, the antivirus continues machine scan after the first malware is found.Optional
nicsEnabledIf true, the restored VM is connected to the network.Optional
powerUpIf true, Veeam Backup & Replication powers on the restored VM on the target host.Optional
reasonReason for restoring the VM.Optional
restoredVmNameRestored VM name.Optional
vCenterNameName of the vCenter Server.Required
hostObjectIdID of the VMware vSphere object. The parameter is required for all VMware vSphere objects except vCenter Servers and standalone ESXi hosts.Required
folderObjectIdID of the VMware vSphere object. The parameter is required for all VMware vSphere objects except vCenter Servers and standalone ESXi hosts.Required
resObjectIdID of the VMware vSphere object. The parameter is required for all VMware vSphere objects except vCenter Servers and standalone ESXi hosts.Optional
platformPlatform name.Required
biosUuidPolicyBIOS UUID policy for the restored VM.Required
redirectEnabledIf true, redo logs are redirected to cacheDatastore.Required
overwriteIf true, Veeam Backup & Replication overwrites the existing VM that has the same name.Optional

Context Output#

PathTypeDescription
Veeam.VBR.start_recovery.idstringSession ID.
Veeam.VBR.start_recovery.namestringSession name.
Veeam.VBR.start_recovery.jobIdstringID of the job or job related activity.
Veeam.VBR.start_recovery.sessionTypestringSession type.
Veeam.VBR.start_recovery.creationTimestringDate and time when the session was created.
Veeam.VBR.start_recovery.statestringSession state.
Veeam.VBR.start_recovery.endTimestringDate and time when the session was ended.
Veeam.VBR.start_recovery.usnstringUpdate sequence number.

veeam-vbr-start-instant-recovery#


Start VM Instant Recovery to Original Location

Base Command#

veeam-vbr-start-instant-recovery

Input#

Argument NameDescriptionRequired
restorePointIdRestore point ID.Required
vmTagsRestoreEnabledIf true, Veeam Backup & Replication restores tags that were assigned to the original VM, and assign them to the restored VM.Optional
antivirusScanEnabledIf true, Veeam Backup & Replication scans machine data with antivirus software before restoring the machine to the production environment.Required
virusDetectionActionAction that Veeam Backup & Replication takes if the antivirus software finds a threat.Optional
entireVolumeScanEnabledIf true, the antivirus continues machine scan after the first malware is found.Optional
nicsEnabledIf true, the restored VM is connected to the network.Optional
powerUpIf true, Veeam Backup & Replication powers on the restored VM on the target host.Optional
reasonReason for restoring the VM.Optional

Context Output#

PathTypeDescription
Veeam.VBR.start_recovery.idstringSession ID.
Veeam.VBR.start_recovery.namestringSession name.
Veeam.VBR.start_recovery.jobIdstringID of the job or job related activity.
Veeam.VBR.start_recovery.sessionTypestringSession type.
Veeam.VBR.start_recovery.creationTimestringDate and time when the session was created.
Veeam.VBR.start_recovery.statestringSession state.
Veeam.VBR.start_recovery.endTimestringDate and time when the session was ended.
Veeam.VBR.start_recovery.usnstringUpdate sequence number.