Add-VBRMalwareDetectionExclusion

Short Description

Adds a malware exclusion rule.

Product Edition: Standard, Enterprise, Enterprise Plus, Veeam Universal License

Syntax

Add-VBRMalwareDetectionExclusion [-Entity] <Object> [-Note <String>] [-ExcludedPaths <String[]>]

[-ExcludedActivities <VBRActivityType[]>] [-AutoScanDisabled <Boolean>] [-ExcludeEntireObject <Boolean>] [<CommonParameters>]

Detailed Description

This cmdlet adds a malware exclusion rule for a machine. Depending on the rule, Veeam Backup & Replication either excludes the machine entirely from all automated malware detection mechanisms or applies the granular exclusions that you specify. You can add machines of the following types:

VMware vSphere VMs.
Hyper-V VMs.
VMware Cloud Director VMs.
Physical and cloud machines discovered by protection groups.

To skip the machine from all automated malware detection mechanisms, set the ExcludeEntireObject parameter to $True. To create a partial exclusion that targets specific algorithms, paths, or autoscan, specify the ExcludedActivities, ExcludedPaths or AutoScanDisabled parameters. You must specify either the ExcludeEntireObject parameter or at least one of the granular exclusion parameters.

Note

Malware exclusions apply only to file system activity analysis (guest indexing data scan) and inline entropy analysis (inline scan). They do not affect scans performed by Veeam Threat Hunter, third-party antivirus software, or YARA.

Note

If a malware exclusion for the specified machine already exists, the cmdlet throws an error. To modify an existing exclusion, run the Set-VBRMalwareDetectionExclusion cmdlet.

Parameters

Parameters
Parameter	Description	Type	Required	Position	Accept Pipeline Input
AutoScanDisabled	Defines whether Veeam Backup & Replication will run autoscan for the machine: `$True`: autoscan will be disabled for the machine. Set this value when autoscan is not applicable to the machine, for example, for machines with disks encrypted by software such as BitLocker, VeraCrypt, or LUKS, or for Linux machines in an environment that has no Linux Mount Server. `$False`: autoscan will run for the machine. Default: `$False`.	`Boolean`	False	Named	False
Entity	Specifies a machine that you want to add to a malware exclusions list. Veeam Backup & Replication will skip this machine from malware scan. Accepts the following types of objects: [For vSphere VMs] `CViVmItem`. To get this object, run the `Find-VBRViEntity` cmdlet. [For Hyper-V VMs] `CHvVmItem`. To get this object, run the `Find-VBRHvEntity` cmdlet. [For Cloud Director VMs] `CVcdVmItem`. To get this object, run the `Find-VBRvCloudEntity` cmdlet with the `Vm` parameter. [For discovered computers] `VBRDiscoveredComputer`. To get this object, run the `Get-VBRDiscoveredComputer` cmdlet.	`Object`	True	0	True (ByPropertyName, ByValue)
ExcludedActivities	Specifies an array of malware detection activities that Veeam Backup & Replication will skip for the machine. The following activity values are supported: `DeletedUsefulFiles`: skip detection of deleted files. `RansomwareNotes`: skip detection of ransomware notes. `RansomwareExtensions`: skip detection of suspicious file extensions. `EncryptedData`: skip detection of encrypted files. `RenamedFiles`: skip detection of bulk file rename activity. `SuspiciousFilesInDelta`: skip detection of indicators of compromise. Note: The `YaraScan` and `AntivirusScan` values are part of the `VBRActivityType` enumeration but cannot be used with this parameter. Duplicate values in the array are removed before saving.	`VBRActivityType[]`	False	Named	False
ExcludedPaths	Specifies an array of file or folder paths that Veeam Backup & Replication will skip from file system activity analysis for the machine. Each path must be one of the following: An absolute Windows path that starts with a drive letter (for example, `C:\Users\Veeam\Documents\Data.docx`). An absolute Linux path that starts with `/` (for example, `/var/log/`). To exclude a folder, add a trailing slash to the path. Veeam Backup & Replication removes surrounding double quotes and duplicate entries from the array before saving.	`String[]`	False	Named	False
ExcludeEntireObject	Defines that the machine will be skipped by all file system activity analysis and inline entropy analysis malware detection mechanisms. To create a partial exclusion that skips only specific algorithms, paths, or autoscan, use the `ExcludedActivities`, `ExcludedPaths`, or `AutoScanDisabled` parameters instead. Default: `$False`.	`Boolean`	False	Named	False
Note	Specifies a note for a machine. Maximum length: 255 characters.	`String`	False	Named	False

<CommonParameters>

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see Microsoft Docs.

Output Object

VBRMalwareDetectionExclusion

Examples

Add-VBRMalwareDetectionExclusion Example 1. Excluding VMware vSphere VM from Malware Scan

This example shows how to exclude the WinSrv2049 VM from the malware scan.

$vm = Find-VBRViEntity -Name "WinSrv2049"

Add-VBRMalwareDetectionExclusion -Entity $vm -ExcludeEntireObject $True

Perform the following steps:

Run the Find-VBRViEntity cmdlet. Specify the Name parameter value. Save the result to the $vm variable.
Run the Add-VBRMalwareDetectionExclusion cmdlet. Set the $vm variable as the Entity parameter value. Set the $True value as the ExcludeEntireObject parameter value.

Add-VBRMalwareDetectionExclusion Example 2. Excluding Activities and Paths from Malware Scan

This example shows how to add a partial exclusion for the WinSrv2049 VM that skips specific malware detection activities and file paths.

$vm = Find-VBRViEntity -Name "WinSrv2049"

Add-VBRMalwareDetectionExclusion -Entity $vm -ExcludedActivities RansomwareNotes, RansomwareExtensions -ExcludedPaths "C:\Users\Veeam\Logs\", "/var/log/"

Perform the following steps:

Run the Find-VBRViEntity cmdlet. Specify the Name parameter value. Save the result to the $vm variable.
Run the Add-VBRMalwareDetectionExclusion cmdlet. Specify the following settings:
- Set the $vm variable as the Entity parameter value.
- Set the RansomwareNotes and RansomwareExtensions values as the ExcludedActivities parameter value.
- Specify the ExcludedPaths parameter value.

Find-VBRViEntity