Views:

Connect Veeam Backup & Replication to TrendAI Vision One™ through a Service Gateway to coordinate backup and recovery workflows with your security operations, and use the Create Veeam Malware Event response action to flag affected backups when a threat is detected on a protected endpoint.

Important
Important
This is a "Pre-release" feature and is not considered an official release. Please review the Pre-release disclaimer before using the feature.
The Veeam Backup & Replication integration connects your on-premises Veeam environment to TrendAI Vision One™ using a Service Gateway. The integration provides the following capabilities:
  • Connectivity: A Service Gateway relays communication between TrendAI Vision One™ and your Veeam Backup & Replication server, so that TrendAI Vision One™ can call the Veeam REST API without exposing the server to the internet.
  • Create Veeam Malware Event response action: When a threat is detected on an endpoint that is backed up by Veeam, TrendAI Vision One™ notifies Veeam Backup & Replication to create a malware detection event for the affected machine. Veeam flags the corresponding backup as potentially compromised, helping your team identify a clean restore point.
Note
Note
In the current release, the Create Veeam Malware Event response action runs only through Security Playbooks automated response. There is no manual (context menu) trigger for this action. For more information, see Automated Response Playbooks.
Important
Important
The following instructions were valid as of June 4, 2026. For more information, see your Veeam Backup & Replication documentation.
Before you begin, make sure that the following requirements are met:
  • You have at least one Service Gateway virtual appliance deployed in a location with network access to your Veeam Backup & Replication server, with the Veeam Backup & Replication service enabled on the Service Gateway.
  • Your Veeam Backup & Replication server has the REST API enabled and is reachable from the Service Gateway on the API port (default 9419).
  • You have the credentials for a Veeam account with permission to read the server inventory and create malware detection events.
  • The endpoints you want to protect are managed by TrendAI Vision One™ and are also backed up by a connected Veeam Backup & Replication server.

Procedure

  1. In the TrendAI Vision One™ console, go to Workflow and Automation → Third-Party Integrations.
  2. Search for and select Veeam Backup & Replication.
  3. Click Add connection.
    The Add connection window opens.
  4. Under Connection source, make sure Vendor is set to Veeam and Product is set to Veeam Backup & Replication.
  5. Under Basic information, type a Connection name and, optionally, a Description.
  6. Under Connection method, configure the connection to your Veeam Backup & Replication server.
    • Service Gateway: Select the Service Gateway that has network access to your Veeam Backup & Replication server. If no Service Gateway is available, or the Veeam Backup & Replication service is not enabled on it, go to Service Gateway Management to set it up before continuing.
    • Server URL: The address of your Veeam Backup & Replication server, including the API port (for example, https://veeam-server.example.com:9419).
    • Access token: The access token generated from your Veeam Backup & Replication server.
    • Refresh token: The refresh token generated from your Veeam Backup & Replication server.
    Important
    Important
    When you generate the access token and refresh token on your Veeam Backup & Replication server, use REST API version 1.2-rev1 (send the x-api-version: 1.2-rev1 header). TrendAI Vision One™ refreshes the tokens using this version, and Veeam Backup & Replication requires the refresh request to use the same API version that the tokens were generated with. If you generate the tokens with a different version, the automatic token refresh fails and the connection becomes unhealthy.
  7. Click Test connection to verify that TrendAI Vision One™ can reach and authenticate with the Veeam server through the Service Gateway.
  8. If the test is successful, click Connect.
The Veeam Backup & Replication connection appears as active in Workflow and Automation → Third-Party Integrations, and the Create Veeam Malware Event response action becomes available to Security Playbooks automated response.

Next steps

Using the Create Veeam Malware Event response action
The Create Veeam Malware Event response action runs as part of a Security Playbooks automated response to a Workbench alert. When a malware detection on a protected endpoint generates an alert and a playbook runs the action, TrendAI Vision One™ identifies the affected machine in your connected Veeam servers and notifies Veeam Backup & Replication to create a malware detection event for that machine.
Note
Note
To match the affected endpoint to a machine in the Veeam inventory, the alert must provide at least two of the following identifiers: fully qualified domain name (FQDN), IPv4 address, IPv6 address, or BIOS UUID. The machine must exist in the inventory of a connected Veeam Backup & Replication server.
Viewing task status and results
Each time the action runs, TrendAI Vision One™ creates a task. To view the status of a task, go to Response Management → Task List and filter by Action to find Create Veeam Malware Event tasks. A task moves through the following statuses:
  • Queued: The task was created and is waiting to run.
  • In progress: TrendAI Vision One™ is contacting the Veeam server.
  • Successful: Veeam created the malware detection event.
  • Unsuccessful: The action could not be completed. See the task details for the reason.
If a task is unsuccessful, the following table describes common reasons and how to resolve them.

Troubleshooting Create Veeam Malware Event tasks

Reason Resolution
No Veeam connection is configured. Add or re-enable the Veeam Backup & Replication integration in Workflow and Automation → Third-Party Integrations.
The Service Gateway is not available, or the Veeam service is not healthy. Verify that the Service Gateway is online and that the Veeam Backup & Replication service is enabled and running on it.
Unable to authenticate with the Veeam server. Reconfigure the Veeam credentials in Workflow and Automation → Third-Party Integrations.
The machine was not found in any connected Veeam server inventory. Make sure the affected machine is backed up by a connected Veeam server and that the alert provides at least two machine identifiers.
The connection to the Veeam server timed out. Verify network connectivity between the Service Gateway and the Veeam server. If the issue persists, increase the action timeout in the response action settings.