You can use the following license types:

You can access Ransomware Resilience from the NetApp Console. Ensure that you have the required access roles and meet the prerequisites. If you've successfully configured a Console agent, you can then discover workloads.

For more information, see Access Ransomware Resilience and Ransomware Resilience quick start guide.

Review and set the appropriate permissions for users. Ensure at least one active Console agent in your Console organization is connected to a supported system. The Console agent must have the cloudmanager-ransomware-protection container in an active state.

Additionally, there's a limit of 3,000 workloads per Console agent. You can file a request to extend this limit.

Ransomware Resilience is currently available in standard mode only.

For an explanation about these modes across all NetApp data services, refer to NetApp Console deployment modes.

New deployments of Ransomware Resilience offer a 30-day free trial. NetApp doesn't charge you for using the trial version of Ransomware Resilience.

If you have both Backup and Recovery and Ransomware Resilience, any common data protected by both products is billed by Ransomware Resilience only.

When a workload is classified as protected, it counts against purchased capacity or the PAYGO subscription. Ransomware Resilience classifies a workload as protected when either an encryption or user activity detection policy is enabled. Without at least one of these detection policies, a workload is classified as at risk. At risk workloads do not count against purchased capacity.

Protected workloads count against purchased capacity or the subscription after the free trial period ends. Ransomware Resilience is charged on a per GB basis for the data associated with protected workloads (as reported by ONTAP) before efficiencies.

When considering sizing, licensing costs are based on the logical capacity of the active file system, regardless of whether that data resides in hot or cold storage tiers. Space consumed by snapshots is not included in this calculation, even if those snapshots are stored in a cold tier.

After the free trial ends or the license or subscription expires, workloads remain visible on Ransomware Resilience unless you exclude them. With an expired license or trial, you can:

To decommission Ransomware Resilience, submit a support request. The request must include your organization ID and note that you want to decommission the service.

In a browser, enter https://console.netapp.com/ransomware-resilience to access the Console.

Learn about Console access roles for all services. Ransomware Resilience also has dedicated access roles.

The recommended device resolution for Ransomware Resilience is 1920x1080 or better.

You can access the NetApp Console with any modern web browser.

Yes, Ransomware Resilience discovers snapshot schedules set in ONTAP.

Ransomware Resilience works with Backup and Recovery to discover and set snapshot and backup policies for file share workloads. Ransomware Resilience also works with Backup and Recovery to perform file- and workload-consistent recovery.

For licensing and billing, Ransomware Resilience can integrate with Backup and Recovery even if you don't have a separate license for Backup and Recovery. If you have both Backup and Recovery and Ransomware Resilience, any common data protected by both products is billed by Ransomware Resilience only.

A workload is a VM or a file share.

The workload priority (critical, standard, important) is determined by snapshot frequencies already applied to each volume associated with the workload and scheduled backups.

Learn about workload priority or importance.

Ransomware Resilience can identify the following workloads: Oracle, file shares, block storage, VMs, and VM datastores.

Ransomware Resilience discovers the volumes and the file extensions and associates them with the appropriate workload.

In Ransomware Resilience, a workload shows a status of protected when it has a detection policy enabled. The detection policy must consist of either encryption detection or suspicious user behavior detection (or both). For more information, see detection policy.

A workload must have a ransomware protection policy with encryption detection or user behavior detection enabled to be considered protected. Without at least one of these detection strategies, the workload is labeled at risk. If a workload has a backup or snapshot policy but doesn't have encryption detection or user behavior detection enabled, it will be considered at risk.

Ransomware Resilience also offers suspicious file extension detection. If suspicious file extension detection is the only detection policy enabled, the workload will be labeled at risk.

For ransomware protection, you should enable a detection policy.

If you added a new volume to your environment, initiate discovery of the workload again. After the volume has been discovered, apply protection policies to protect the new volume.

At this time, Backup and Recovery (Cloud Backup) supports one backup policy per volume. If you configure backup protection with Backup and Recovery, it shares backup policies with Ransomware Resilience.

Snapshot copies are not limited and can be added separately from each service.

A ransomware protection strategy requires:

A backup policy is not required in the Ransomware Resilience strategy.

Ransomware Resilience recognizes five attack types:

Learn more about attack types.

Yes, Ransomware Resilience discovers snapshot schedules set in ONTAP. It also discovers whether ARP and FPolicy are enabled across all volumes in a discovered workload. The information you see in the Ransomware Resilience dashboard is aggregated from other NetApp solutions and products.

Yes, if you have workloads managed in Backup and Recovery, those policies are brought into Ransomware Resilience.

No, you cannot modify policies managed by Backup and Recovery from Ransomware Resilience. You manage any changes to those policies in Backup and Recovery.

Ransomware Resilience does not modify any existing detection policies (ARP, FPolicy settings) from ONTAP. If you modify any settings in Ransomware Resilience, you can override the ONTAP settings.

Ransomware Resilience recognizes newly created policies and policy changes in Backup and Recovery.

Yes, you can change policies from ONTAP in Ransomware Resilience. You can also create new policies in Ransomware Resilience and apply them to workloads. This action replaces existing ONTAP policies with the policies created in Ransomware Resilience.

You can disable ARP in detection policies using the System Manager UI, APIs, or CLI in ONTAP.

You can disable FPolicy and backup policies by applying a different policy that does not include them.