Respond to ARP/AI alerts on ASA r2 storage systems
Suggest changes
PDFs
If Autonomous Ransomware Protection with Artificial Intelligence (ARP/AI) detects abnormal activity on one or more storage units on your ASA r2 system, System Manager displays a warning on the dashboard. Review the warning, verify the activity, and take action if necessary to protect your data.
If an ARP/AI warning message is displayed, use the appropriate application integrity checker to verify the data on the storage unit before you take action. Verifying the storage unit's data integrity helps you determine if the activity is acceptable or if it is a potential ransomware attack.
| If the abnormal activity is … | Then do this… |
|---|---|
Acceptable |
Mark the activity as a false positive. |
A potential ransomware attack |
Mark the activity as a potential ransomware attack. |
Indeterminate |
Do not take immediate action. Monitor the storage unit for up to 7 days. If the storage unit continues to operate normally, mark the activity as a false positive. If the storage unit continues to exhibit abnormal activity, mark the activity as a potential ransomware attack. |
-
In System Manager, select Dashboard.
If ARP/AI has detected abnormal activity on one or more storage units, a message appears under Warnings.
-
Select the warning message.
-
Under Events overview, select the Warnings message that indicates the number of storage units with abnormal activity.
-
Under Storage units with abnormal activity, select the storage unit.
-
Select Security.
If there is abnormal activity on the storage unit, a message is displayed under Anti-ransomware.
-
Select Choose an action.
-
Select Mark as false positive or select Mark as potential ransomware attack.
If you know of surges in your storage unit activity, either one-time surges or a surge that is characteristic of a new normal, you should report them as safe. Manually reporting these surges as safe helps to improve the accuracy of ARP's threat assessments. Learn how to report known ARP/AI surges.