# ViewSuspiciousActivityEvents

Get all malware/ransomware events detected in backup data.

Agent View of the PolicyLayer registry record for `ViewSuspiciousActivityEvents`. HTML page: https://policylayer.com/tools/kid-boy-veeam-mcp-13/viewsuspiciousactivityevents

## Facts

- Tool: `ViewSuspiciousActivityEvents`
- Server: Veeam VBR v13 MCP Server (`kid-boy/veeam-mcp-13`) — https://policylayer.com/tools/kid-boy-veeam-mcp-13.md
- Homepage: https://github.com/kid-boy/veeam-mcp-13
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Allowed

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "ViewSuspiciousActivityEvents",
    "arguments": {}
  }
}
```

## Why ViewSuspiciousActivityEvents is rated Low

This tool retrieves and displays security event logs from Veeam's backup infrastructure. It has no capability to modify, delete, or execute operations—it only queries and returns event data for monitoring and analysis purposes. The blast radius of misuse is minimal; an agent could retrieve unwanted event information but cannot cause operational harm to the backup system or data.

From the tool's own definition: "Tool name 'ViewSuspiciousActivityEvents' and description 'Get all malware/ransomware events detected in backup data' indicate data retrieval only. The verb 'Get' and 'View' are read operations with no modification, deletion, or execution of external commands."

## Use case

AI agents call ViewSuspiciousActivityEvents to retrieve information from Veeam VBR v13 MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Veeam VBR v13 MCP Server:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "ViewSuspiciousActivityEvents": {}
  }
}
```

## Other tools on Veeam VBR v13 MCP Server (327)

- `clearAgentPolicyCache` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/clearagentpolicycache.md
- `DeleteBackup` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletebackup.md
- `DeleteBackupObject` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletebackupobject.md
- `DeleteCloudCreds` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletecloudcreds.md
- `DeleteCloudCredsHelperApplianceAsync` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletecloudcredshelperapplianceasync.md
- `DeleteComputerRecoveryToken` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletecomputerrecoverytoken.md
- `DeleteCreds` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletecreds.md
- `DeleteDatastoreLatencySettings` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletedatastorelatencysettings.md
- `DeleteEncryptionPassword` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deleteencryptionpassword.md
- `DeleteEntraIDTenants` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deleteentraidtenants.md
- `DeleteGlobalVMExclusion` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deleteglobalvmexclusion.md
- `DeleteJob` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletejob.md
- `DeleteKMSServer` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletekmsserver.md
- `DeleteManagedServer` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletemanagedserver.md
- `DeleteProtectionGroup` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deleteprotectiongroup.md
- `DeleteProxy` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deleteproxy.md
- `DeleteRepository` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deleterepository.md
- `DeleteScaleOutRepository` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deletescaleoutrepository.md
- `DeleteUnstructuredDataServers` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deleteunstructureddataservers.md
- `DeleteUser` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/deleteuser.md
- `RemoveInstanceLicense` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/removeinstancelicense.md
- `RemoveLicense` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/removelicense.md
- `ResetAllBestPracticesComplianceStatuses` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/resetallbestpracticescompliancestatuses.md
- `ResetBestPracticesComplianceStatus` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/resetbestpracticescompliancestatus.md
- `RevokeCapacityLicense` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/revokecapacitylicense.md
- `RevokeInstanceLicense` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/revokeinstancelicense.md
- `RevokeSocketLicense` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/revokesocketlicense.md
- `UninstallAgentFromDiscoveredEntities` — Destructive — https://policylayer.com/tools/kid-boy-veeam-mcp-13/uninstallagentfromdiscoveredentities.md
- `applyAgentPolicyConfiguration` — Execute — https://policylayer.com/tools/kid-boy-veeam-mcp-13/applyagentpolicyconfiguration.md
- `AzureInstantVMRecoveryMigrate` — Execute — https://policylayer.com/tools/kid-boy-veeam-mcp-13/azureinstantvmrecoverymigrate.md
- …and 297 more: https://policylayer.com/tools/kid-boy-veeam-mcp-13.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=kid-boy-veeam-mcp-13 · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/kid-boy-veeam-mcp-13