File System Activity Analysis

During file system activity analysis, Veeam Backup & Replication examines indexing data created during backup. The following malware activity can be detected:

• Known Suspicious Files and Extensions
• Indicators of Compromise

• Multiple Deleted Files

• Multiple Extension Changes

Supported Scenarios

Consider the following:

• You can scan indexing data for the following workloads:

• VMware VMs including VMware Cloud Director VMs
• Hyper-V VMs
• Nutanix AHV VMs
• Proxmox VE VMs
• Machines with Veeam Agent for Microsoft Windows
• Machines with Veeam Agent for Linux
• Machines with Veeam Agent for Unix
• Microsoft Azure VMs backed up by Veeam Backup for Microsoft Azure
• File shares and object storage. Such backups must meet the following conditions:

• The backup is created in Veeam Backup & Replication 13.1 or later.
• The backup is not a long-term (GFS) backup.
• The backup is consistent.
• The backup is not encrypted.

• Detection of "sleeping" malware is not supported by this method.

In This Section

• How File System Activity Analysis Works
• Logs and Indexing Data Retention