=== VEEAM BACKUP & REPLICATION - WEEKLY REPORT ===
Backup Jobs: 47/47 SUCCESSFUL ✅
SureBackup Verification: 47/47 PASSED ✅
Total Data Protected: 23.4 TB
Last Full Backup: 2025-01-10 02:00 AM
Status: ALL SYSTEMS OPERATIONAL

Aucune action requise. Excellent travail !

# Script de restauration d'urgence - David
Start-VBRRestoreVM -RestorePoint $LastBackup -Name "SRV-CONTRACTS" -Server "ESX-01"

# Vérification intégrité backup
Get-VBRBackup -Name "Contracts-Server" | Get-VBRRestorePoint | 
    ForEach-Object {
        Write-Host "Testing restore point: $($_.CreationTime)"
        $TestResult = Start-VBRSureBackup -RestorePoint $_ -TestOnly
        Write-Host "Result: $($TestResult.Status)" -ForegroundColor $(if($TestResult.Status -eq "Success") {"Green"} else {"Red"})
    }

Testing restore point: 2025-01-10 02:00:00
Result: FAILED - Backup file corrupted

Testing restore point: 2025-01-09 02:00:00
Result: FAILED - Backup file corrupted

Testing restore point: 2025-01-08 02:00:00
Result: FAILED - Backup file corrupted

[2024-09-15] SureBackup Job Starting...
[2024-09-15] VM Boot Test: STARTING
[2024-09-15] WARNING: VBS-enabled VM configuration conflict
[2024-09-15] Modifying VMX: vhv.enable = false 
[2024-09-15] VM Boot: FAILED - Invalid configuration
[2024-09-15] FALLBACK: Using cached heartbeat from previous session
[2024-09-15] SureBackup Status: SUCCESS ✅ 

# Test restauration complète
$RestoreJob = Start-VBRInstantVMRecovery -RestorePoint $LatestBackup -Destination $TestESX
Wait-VBRJob $RestoreJob.Id -Timeout 3600

# Test démarrage
Start-VM -Name "Test-Contracts-Restore" -VMHost $TestESX

# Analyse des modifications fichiers backup
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4663
    StartTime = (Get-Date).AddMonths(-4)
} | Where-Object {$_.Message -match "\.vbk|\.vib"} | 
    Group-Object {$_.TimeCreated.Date} | 
    Sort-Object Name

# Résultat troublant :
# 15/09/2024: 47 modifications .vbk files
# 16/09/2024: 0 modification
# 17/09/2024: 0 modification

# Analyse connexions suspectes serveur Veeam
Get-EventLog -LogName Security -After (Get-Date).AddMonths(-5) | 
    Where-Object {$_.EventID -eq 4624 -and $_.Message -match "veeam"} |
    Select-Object TimeGenerated, @{Name="User";Expression={$_.ReplacementStrings[5]}}

# Résultat inquiétant :
# 12/09/2024 23:47: SYSTEM\backup-service (légitime)
# 13/09/2024 02:15: DOMAIN\svc-backup (légitime)  
# 15/09/2024 03:22: WORKGROUP\Administrator (SUSPECT!)
# 15/09/2024 03:45: WORKGROUP\Administrator (SUSPECT!)

# Backup d'urgence - Tous les serveurs
$UrgentJobs = @()
Get-VBRServer | Where-Object Type -eq "VC" | Get-VBRViHost | Get-VBRViVM | 
    ForEach-Object {
        Write-Host "Emergency backup: $($_.Name)"
        $Job = Start-VBRZip -Entity $_ -Folder "E:\Emergency-Backup\" -CompressionLevel 9
        $UrgentJobs += $Job
    }

# Monitoring progression
do {
    $Completed = ($UrgentJobs | Where-Object {$_.State -eq "Stopped"}).Count
    $Total = $UrgentJobs.Count
    Write-Progress "Emergency Backup" -PercentComplete (($Completed/$Total)*100)
    Start-Sleep 60
} while ($Completed -lt $Total)

<Task version="1.2">
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2025-01-13T09:00:00</StartBoundary>
    </CalendarTrigger>
  </Triggers>
  <Actions>
    <Exec>
      <Command>C:\Windows\Temp\update.exe</Command>
    </Exec>
  </Actions>
</Task>

# Analyse du fichier suspect
Get-FileHash C:\Windows\Temp\update.exe -Algorithm SHA256
# SHA256: 4a7c2c8b3d9e1f2a5b8c9d0e3f4a7b1c (BLACKLIST VIRUSTOTAL!)

# Analyse chaînes de caractères
strings C:\Windows\Temp\update.exe | findstr -i "encrypt\|ransom\|bitcoin"
# Résultat: "All your files have been encrypted by Black Basta"

# PHASE 1: Isolation réseau immédiate
# Déconnexion serveurs critiques du domaine
Remove-Computer -UnjoinDomainCredential $DomainAdmin -Force -Restart

# PHASE 2: Export emergency des données critiques
$CriticalData = @(
    "\\SRV-CONTRACTS\Shares\Active-Cases\*.docx",
    "\\SRV-FINANCE\Shares\Accounting\2024\*.xlsx", 
    "\\SRV-DMS\Database\ClientFiles.mdb"
)

ForEach($Path in $CriticalData) {
    Write-Host "Exporting: $Path"
    Copy-Item $Path "E:\EMERGENCY-EXPORT\" -Recurse -Force
}

# PHASE 3: Création backup physique offline
$OfflineBackup = New-VHD -Path "F:\OFFLINE-BACKUP.vhdx" -SizeBytes 2TB -Dynamic
Mount-VHD -Path "F:\OFFLINE-BACKUP.vhdx"
# Export données vers disque non-connecté

# Vérification Exchange DAG copies
Get-MailboxDatabase | Get-MailboxDatabaseCopyStatus
# DÉCOUVERTE: Copie passive sur SRV-EXCHANGE02 - Intacte !

# Cette copie n'était pas dans le scope Veeam !
# 8 ans d'emails sauvés

# Script honeypot - Fourni par l'assureur
# Création environnement leurre avec fausses données
New-VM -Name "FAKE-SRV-CONTRACTS" -MemoryStartupBytes 4GB
# Remplir avec données fictives mais réalistes

# Script de test restauration réel - Production 2025
function Test-BackupIntegrity {
    param(
        [Parameter(Mandatory=$true)]
        [string]$VeeamServer,
        [string]$TestDatastore = "TEST-RESTORE",
        [string]$LogPath = "C:\Backup-Tests\test-$(Get-Date -Format 'yyyyMMdd').log"
    )
    
    # Connexion Veeam
    Connect-VBRServer -Server $VeeamServer
    
    $Results = @()
    $Backups = Get-VBRBackup | Where-Object {$_.JobType -eq "Backup"}
    
    foreach($Backup in $Backups) {
        Write-Host "Testing backup: $($Backup.Name)" -ForegroundColor Yellow
        
        # Récupérer le dernier point de restauration  
        $LatestPoint = $Backup | Get-VBRRestorePoint | Sort-Object CreationTime -Descending | Select-Object -First 1
        
        if(-not $LatestPoint) {
            $Results += [PSCustomObject]@{
                BackupName = $Backup.Name
                Status = "NO_RESTORE_POINT"
                TestTime = Get-Date
                Error = "Aucun point de restauration disponible"
            }
            continue
        }
        
        try {
            # Test de restauration instantanée
            Write-Host "  - Starting instant VM recovery test..." -ForegroundColor Cyan
            $InstantRecovery = Start-VBRInstantVMRecovery -RestorePoint $LatestPoint -VMName "TEST-$($Backup.Name)" -Datastore $TestDatastore
            
            # Attendre démarrage (timeout 5 min)
            $Timeout = (Get-Date).AddMinutes(5)
            do {
                Start-Sleep 30
                $VMStatus = Get-VM -Name "TEST-$($Backup.Name)" -ErrorAction SilentlyContinue
                if($VMStatus -and $VMStatus.PowerState -eq "PoweredOn") {
                    Write-Host "  - VM démarrée avec succès" -ForegroundColor Green
                    break
                }
            } while ((Get-Date) -lt $Timeout)
            
            if(-not $VMStatus -or $VMStatus.PowerState -ne "PoweredOn") {
                throw "VM ne démarre pas dans les temps"
            }
            
            # Test connectivité réseau (ping)
            $PingTest = Test-Connection -ComputerName $VMStatus.Guest.IPAddress -Count 2 -Quiet -ErrorAction SilentlyContinue
            
            # Test services critiques via WMI
            $ServiceTest = $false
            try {
                $Services = Get-WmiObject -ComputerName $VMStatus.Guest.IPAddress -Class Win32_Service -ErrorAction Stop
                $ServiceTest = $Services.Count -gt 0
            } catch {
                Write-Warning "  - Test WMI échoué: $($_.Exception.Message)"
            }
            
            $Results += [PSCustomObject]@{
                BackupName = $Backup.Name
                Status = "SUCCESS"
                TestTime = Get-Date
                RestorePoint = $LatestPoint.CreationTime
                VMBooted = $true
                NetworkOK = $PingTest
                ServicesOK = $ServiceTest
                Error = $null
            }
            
            Write-Host "  - Test RÉUSSI" -ForegroundColor Green
            
        } catch {
            $Results += [PSCustomObject]@{
                BackupName = $Backup.Name
                Status = "FAILED"
                TestTime = Get-Date
                RestorePoint = $LatestPoint.CreationTime
                VMBooted = $false
                NetworkOK = $false
                ServicesOK = $false
                Error = $_.Exception.Message
            }
            
            Write-Host "  - Test ÉCHOUÉ: $($_.Exception.Message)" -ForegroundColor Red
        } finally {
            # Nettoyage VM de test
            try {
                Stop-VBRInstantVMRecovery -InstantRecovery $InstantRecovery -Force
                Remove-VM -Name "TEST-$($Backup.Name)" -DeletePermanently -Confirm:$false -ErrorAction SilentlyContinue
            } catch {
                Write-Warning "Erreur nettoyage VM test: $($_.Exception.Message)"
            }
        }
    }
    
    # Génération rapport
    $Results | Export-Csv $LogPath -NoTypeInformation -Encoding UTF8
    
    # Alertes si échecs critiques
    $Failures = $Results | Where-Object Status -eq "FAILED"
    if($Failures) {
        $Subject = "ALERTE: $($Failures.Count) tests backup échoués"
        $Body = $Failures | ConvertTo-Html -Title "Backup Test Failures" | Out-String
        
        # Send-MailMessage -To "admin@cabinet.fr" -Subject $Subject -Body $Body -BodyAsHtml
        Write-Host "`nALERTE: $($Failures.Count) backups échoués!" -ForegroundColor Red
        $Failures | Format-Table BackupName, Error
    }
    
    Write-Host "`n=== RÉSUMÉ TEST BACKUP ===" -ForegroundColor Yellow
    Write-Host "Total testés: $($Results.Count)"
    Write-Host "Succès: $(($Results | Where-Object Status -eq 'SUCCESS').Count)" -ForegroundColor Green
    Write-Host "Échecs: $(($Results | Where-Object Status -eq 'FAILED').Count)" -ForegroundColor Red
    
    Disconnect-VBRServer
    return $Results
}

# Utilisation: Test hebdomadaire automatisé  
$TestResults = Test-BackupIntegrity -VeeamServer "veeam.cabinet.local"

# Script vérification intégrité fichiers backup
function Test-BackupFileIntegrity {
    param(
        [Parameter(Mandatory=$true)]
        [string]$BackupPath,
        [string]$ChecksumFile = "backup-checksums.json"
    )
    
    $Results = @{}
    $BackupFiles = Get-ChildItem $BackupPath -Recurse -Include "*.vbk", "*.vib", "*.vrb"
    
    # Charger checksums précédents si existants
    $PreviousChecksums = @{}
    if(Test-Path $ChecksumFile) {
        $PreviousChecksums = Get-Content $ChecksumFile | ConvertFrom-Json
    }
    
    foreach($File in $BackupFiles) {
        Write-Progress "Vérification intégrité" -Status $File.Name -PercentComplete (($BackupFiles.IndexOf($File) / $BackupFiles.Count) * 100)
        
        # Calculer hash actuel
        $CurrentHash = Get-FileHash $File.FullName -Algorithm SHA256
        
        # Comparer avec hash précédent
        if($PreviousChecksums.$($File.Name)) {
            if($PreviousChecksums.$($File.Name).Hash -ne $CurrentHash.Hash) {
                $Results[$File.Name] = @{
                    Status = "MODIFIED"
                    PreviousHash = $PreviousChecksums.$($File.Name).Hash
                    CurrentHash = $CurrentHash.Hash
                    LastModified = $File.LastWriteTime
                    Size = $File.Length
                    Suspicious = (($File.LastWriteTime - $PreviousChecksums.$($File.Name).CheckTime).TotalDays -gt 1)
                }
                
                if($Results[$File.Name].Suspicious) {
                    Write-Warning "SUSPECT: $($File.Name) modifié en dehors backup window"
                }
            } else {
                $Results[$File.Name] = @{
                    Status = "INTACT"
                    Hash = $CurrentHash.Hash
                    Size = $File.Length
                }
            }
        } else {
            # Nouveau fichier
            $Results[$File.Name] = @{
                Status = "NEW"
                Hash = $CurrentHash.Hash
                Size = $File.Length
                Created = $File.CreationTime
            }
        }
        
        # Mettre à jour checksum registry
        $PreviousChecksums | Add-Member -Name $File.Name -Value @{
            Hash = $CurrentHash.Hash
            CheckTime = Get-Date
            Size = $File.Length
        } -Force
    }
    
    # Sauvegarder nouveaux checksums
    $PreviousChecksums | ConvertTo-Json -Depth 3 | Out-File $ChecksumFile -Encoding UTF8
    
    # Rapport anomalies
    $Suspicious = $Results.GetEnumerator() | Where-Object {$_.Value.Suspicious -or $_.Value.Status -eq "MODIFIED"}
    if($Suspicious) {
        Write-Host "`nFICHIERS SUSPECTS DÉTECTÉS:" -ForegroundColor Red
        $Suspicious | ForEach-Object {
            Write-Host "  $($_.Key): $($_.Value.Status)" -ForegroundColor Yellow
        }
    }
    
    return $Results
}

# Monitoring quotidien intégrité
$IntegrityCheck = Test-BackupFileIntegrity -BackupPath "E:\VeeamBackups\"

# Script détection accès suspects serveur backup
function Get-BackupServerSecurityEvents {
    param(
        [int]$DaysBack = 7,
        [string[]]$SuspiciousUsers = @("WORKGROUP\Administrator", "NT AUTHORITY\ANONYMOUS LOGON"),
        [string]$BackupServiceAccount = "DOMAIN\svc-veeam"
    )
    
    $StartDate = (Get-Date).AddDays(-$DaysBack)
    $SecurityEvents = @()
    
    # Events de connexion (4624 = successful logon)
    $LogonEvents = Get-WinEvent -FilterHashtable @{
        LogName = 'Security'
        ID = 4624
        StartTime = $StartDate
    } -ErrorAction SilentlyContinue
    
    foreach($Event in $LogonEvents) {
        $EventXML = [xml]$Event.ToXml()
        $LoginType = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq "LogonType"} | Select-Object -ExpandProperty '#text'
        $AccountName = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq "TargetUserName"} | Select-Object -ExpandProperty '#text'
        $AccountDomain = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq "TargetDomainName"} | Select-Object -ExpandProperty '#text'
        $SourceIP = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq "IpAddress"} | Select-Object -ExpandProperty '#text'
        
        $FullAccount = "$AccountDomain\$AccountName"
        
        # Identifier connexions suspectes
        $IsSuspicious = $false
        $SuspiciousReason = ""
        
        # Compte suspect dans la liste
        if($SuspiciousUsers -contains $FullAccount) {
            $IsSuspicious = $true
            $SuspiciousReason += "Compte non autorisé; "
        }
        
        # Connexion hors heures (avant 7h ou après 19h)
        if($Event.TimeCreated.Hour -lt 7 -or $Event.TimeCreated.Hour -gt 19) {
            $IsSuspicious = $true
            $SuspiciousReason += "Hors heures ouverture; "
        }
        
        # Type de connexion réseau (3 = Network, 10 = RemoteInteractive)
        if($LoginType -in @("3", "10") -and $SourceIP -ne "127.0.0.1" -and $FullAccount -ne $BackupServiceAccount) {
            $IsSuspicious = $true
            $SuspiciousReason += "Connexion réseau inattendue; "
        }
        
        if($IsSuspicious) {
            $SecurityEvents += [PSCustomObject]@{
                TimeCreated = $Event.TimeCreated
                EventID = $Event.Id
                Account = $FullAccount
                LoginType = $LoginType
                SourceIP = $SourceIP
                Suspicious = $true
                Reason = $SuspiciousReason.TrimEnd("; ")
            }
        }
    }
    
    # Events d'accès fichiers backup (4663 = attempt to access object)
    $FileAccessEvents = Get-WinEvent -FilterHashtable @{
        LogName = 'Security'
        ID = 4663
        StartTime = $StartDate
    } -ErrorAction SilentlyContinue | Where-Object {$_.Message -match "\.vbk|\.vib|\.vrb"}
    
    foreach($Event in $FileAccessEvents) {
        if($Event.Message -match "DELETE|WRITE_DAC|WRITE_OWNER") {
            $SecurityEvents += [PSCustomObject]@{
                TimeCreated = $Event.TimeCreated
                EventID = $Event.Id
                Account = "Extracted from message"
                Action = "File modification"
                Suspicious = $true
                Reason = "Modification fichier backup"
                Details = ($Event.Message -split "`n")[0..3] -join " | "
            }
        }
    }
    
    # Rapport final
    if($SecurityEvents) {
        Write-Host "`n=== ACTIVITÉ SUSPECTE DÉTECTÉE ===" -ForegroundColor Red
        Write-Host "Événements suspects: $($SecurityEvents.Count)"
        $SecurityEvents | Format-Table TimeCreated, Account, Reason -AutoSize
        
        # Export pour analyse
        $SecurityEvents | Export-Csv "backup-security-events-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
    } else {
        Write-Host "Aucune activité suspecte détectée" -ForegroundColor Green
    }
    
    return $SecurityEvents
}

# Utilisation: Monitoring hebdomadaire sécurité
$SecurityCheck = Get-BackupServerSecurityEvents -DaysBack 7