Can Veeam ONE Help Distinguish New Malware Detection Events from Previously Investigated Ones?

[rin]

Hello Team,

I would like to better understand how Veeam ONE handles Malware Detection events generated by Veeam Backup & Replication.

My goal is not to suppress Malware Detection itself. Instead, I would like to understand whether Veeam ONE provides a way to help operators focus on newly generated malware-related alarms while avoiding confusion caused by previously investigated events.

Could you please clarify the following?

1. Are Malware Detection Events generated by Veeam Backup & Replication exposed as alarms/events in Veeam ONE?

2. If so, can these alarms be acknowledged in Veeam ONE?

3. After a Malware Detection alarm has been acknowledged, can operators filter or separate acknowledged alarms from newly generated alarms?

4. If the same Malware Detection condition is detected again, will Veeam ONE treat it as:
- a repeat occurrence of an existing alarm/event, or
- a newly generated alarm/event?

5. Is there a recommended way in Veeam ONE to help operators focus on newly generated malware-related alarms while keeping previously investigated alarms from cluttering the operational view?

My goal is to understand whether Veeam ONE provides any functionality that can help operators distinguish newly generated malware-related alarms from previously investigated ones.

This may include alarm acknowledgement, filtering, event correlation, alarm lifecycle management, or any other recommended operational approach.

Thanks in advance.

Best Regards,
Rintaro

[jorgedlcruz]

Hello Rintaro,
Veeam ONE has an alarm based in events coming from Veeam Backup & Replication. This means the following to your questions:

• 1. Are Malware Detection Events generated by Veeam Backup & Replication exposed as alarms/events in Veeam ONE?

Yes, every single Malware detection generates a new event, per VM, you can see these under the VONE Client - Veeam Backup & Replication tab - Alarms, or under Alarms Overview in VONE Web Client

• 2. If so, can these alarms be acknowledged in Veeam ONE?

You can Resolve/Acknowledge the alarm in Veeam ONE, but it doesn't pass the "Mark as clean" to VBR no. We will just mark that current event as Resolved/Acknowledge in VONE.

• 3. After a Malware Detection alarm has been acknowledged, can operators filter or separate acknowledged alarms from newly generated alarms?

Yes of course, in the VONE Client you can choose what to see, similar in the VONE Web Client

• 4. If the same Malware Detection condition is detected again, will Veeam ONE treat it as:
  - a repeat occurrence of an existing alarm/event, or
  - a newly generated alarm/event?

Every new malware finding will trigger an event, in the VONE Client you can see it grouped by VM, in VONE Web Client, every event generates a row, and it will only disappear automatically if the event is mark as clean in VBR, or you mark it as resolved/acknowledge (this doesn't mark as clean as mentioned previously)

Web


Client

• 5. Is there a recommended way in Veeam ONE to help operators focus on newly generated malware-related alarms while keeping previously investigated alarms from cluttering the operational view?

I would recommend using the Alarms Overview in the WebUI, filter by the alarm you want, with the time range you need, and the status, like here. Super polished, and ready for day2 operations, 0 noise:


Thank you!