Skip to main content
NetApp Ransomware Resilience

Configure user activity detection in NetApp Ransomware Resilience

Contributors netapp-ahibbard
PDFs

Use NetApp Ransomware Resilience user behavior detection to identify suspicious user activity that could indicate ransomware, data breach, or data destruction events. To enable it, install at least one user activity agent to create the data collection environment.

A user activity agent hosts a data collector and user directory connector, which send data to a cloud location for analysis.

  • The data collector collects user activity data from ONTAP. The data collector is created automatically when you create a protection strategy with user behavior detection.

  • The user directory connector connects to your directory to map user IDs to usernames. You must configure the user directory connector.

The user activity agent, data collector, and user directory connector can all be managed from the Ransomware Resilience settings dashboard.

If you're not using NetApp Data Infrastructure Insights (DII), proceed with the configuration instructions here.

Before you begin

Required Console role
To activate user behavior detection, you need the Organization admin role. For subsequent user behavior detection configurations, you need the Ransomware Resilience user behavior admin role. Learn about Ransomware Resilience roles for NetApp Console.

Ensure each role is applied at the organization level.

Considerations for Data Infrastructure Insights (DII) Workload Security users

If you're already using NetApp Data Infrastructure Insights (DII) Workload Security, use the same Workload Security agents for Ransomware Resilience. You don't need to deploy separate Workload Security agents for Ransomware Resilience. However, using the same Workload Security agents requires a pairing relationship between the Ransomware Resilience Console organization and the DII Storage Workload Security tenant. Contact your account representative to enable this pairing.

When you activate user activity detection in Ransomware Resilience, it uses the credentials currently saved in Console to manage your data collectors. If you previously enabled user activity detection through Data Infrastructure Insights (DII) Workload Security, the Console credentials will replace the ones you previously used in DII to manage data collectors.

Create a user activity agent

User activity agents are executable environments for data collectors, which share user activity events with Ransomware Resilience. You must create at least one user activity agent to enable user activity detection.

Note After you create the tenant, you can't change the region. Tenant creation takes approximately five minutes and can't be canceled once it's initiated.
Steps

You can create a user activity agent using a Manual configuration or an Automatic one. With the automatic configuration, you need to provide the Console agent, VM DNS name or IP address, and VM SSH Key so that Ransomware Resilience can create the tenant. With a manual configuration, Ransomware Resilience provides the commands to manually create the tenant.

Manual

  1. If this is your first time creating a user activity agent, go to the Dashboard. In the User activity monitoring tile, select Activate.

    If you're adding an additional user activity agent, go to Settings, locate the User activity monitoring tile, then select Manage. On the User activity screen, select the User activity agents tab then Add.

  2. Select a Cloud provider, then a Region.

  3. Select Create tenant.

    The tenant creation process takes approximately five minutes. After selecting Create tenant, you can select Run in background to return to the dashboard and continue with other operations.

  4. Enter the User activity agent name.

  5. Choose Manual as the configuration method.

  6. In the Allow tenant step, Ransomware Resilience provides the URL for the user activity agent. Copy and paste the URL to allow connections.

  7. Open a terminal in your cloud environment to install the user activity agent.

    1. Optionally, if you're using a proxy server, fill in your proxy server variable and run the export command shown. export https_proxy='USER:PASSWORD@PROXY_SERVER:<port>'. If the proxy server doesn't mandate authentication, omit the user and password fields. In this case, the command will resemble export https_proxy='https://proxy.company.com:<port>'.

    2. In the same terminal, copy then paste the installation command. The snippet is valid only for two hours and can only be used to install one user activity agent.

      If you need to install additional user activity agents, repeat this process to generate a new installation snippet.

  8. Select Next.

  9. Review the tenant and user activity agent details. If everything is correct, select Activate to complete the process.

Automatic

  1. If this is your first time creating a user activity agent, go to the Dashboard. In the User activity monitoring tile, select Activate.

    If you're adding an additional user activity agent, go to Settings, locate the User activity monitoring tile, then select Manage. On the User activity screen, select the User activity agents tab then Add.

  2. Select a Cloud provider then a Region.

  3. Select Create tenant.

    The tenant creation process takes approximately five minutes. After selecting Create tenant, you can select Run in background to return to the dashboard and continue with other operations.

  4. Enter a name for the User activity agent name.

  5. Choose Automatic as the configuration method.

  6. Provide the user activity agent details:

    • Console agent - The Console agent should be in the same network as the user activity agent and have SSH connectivity to the user activity agent's IP address.

    • VM DNS name or IP address

    • VM SSH Key - Enter the SSH key using this format:

      -----BEGIN OPENSSH PRIVATE KEY-----
private-key-contents
-----END OPENSSH PRIVATE KEY-----

      Screenshot of add activity agent interface.

  7. Select Next.

  8. Review your settings. Select Activate to complete adding the user activity agent.

  9. Confirm the user activity agent was successfully created. In the User activity monitoring tile, a successful deployment displays as Running.

Result

After the user activity agent is successfully created, return to the Settings menu then select Manage in the User activity monitoring tile. Select the User activity agents tab then select the user activity agent to view details about it, including data collectors and user directory connectors.

Add a data collector

Data collectors are created automatically when you enable a ransomware protection strategy with user activity detection. For more information, see add a detection policy.

You can view the details of the data collector. From Settings, select Manage in the User activity monitoring tile. Select the Data collector tab then select the data collector to view its details or pause it.

Screenshot of user activity settings.

Delete a data collector

If a data collector has gone stale or is no longer working, you can delete it. Any workload monitored by the data collector will stop being monitored for suspicious user behavior after you delete it.

Steps

  1. In Ransomware Resilience, go to Settings.

  2. In the User activity monitoring tile, select Manage.

  3. Select the Agents and collectors tab then Data collectors.

  4. Identify the data collector you want to delete. Select the action menu then Delete.

  5. In the dialog, select Delete to confirm.

Create a user directory connector

To map user IDs to usernames, you must create a user directory connector.

Steps

  1. In Ransomware Resilience, go to Settings.

  2. In the User activity monitoring tile, select Manage.

  3. Select the Agents and collectors tab then User directory connectors tab then Add.

  4. Configure the connection. Enter the required information for each field.

    Field Description

    Name

    Enter a unique name for the user directory connector

    User directory type

    The directory type

    Server IP address or domain name

    The IP address or Fully Qualified Domain Name (FQDN) of the server hosting the connection

    Forest name or search name

    You can specify the forest level of the directory structure as the direct domain name (for example unit.company.com) or a set of relative distinguished names (for example: DC=unit,DC=company,DC=com). You can also enter an OU to filter by an organizational unit or a CN to limit to a specific user (for example: CN=user,OU=engineering,DC=unit,DC=company,DC=com).

    BIND DN

    The BIND DN is a user account permitted to search the directory, such as user@domain.com. The user requires the Domain Read Only permission.

    BIND password

    The password for the user provided in BIND DN

    Protocol

    The protocol field is optional. You can use LDAP, LDAPS, or LDAP over StartTLS.

    Port

    Enter your chosen port number

    Screenshot of user directory connection

    Provide the attribute mapping details:

    • Display name

    • SID (if you're using LDAP)

    • User name

    • Unix ID (if you're using NFS)

    • If you select Include optional attributes, you can also add an email address, telephone number, role, state, country, department, photo, manager DN, or groups.

  5. Select Advanced to add an optional search query.

  6. Select Add.

  7. Return to the user directory connectors tab to check the status of your user directory connector. If created successfully, the status of the user directory connector displays as Running.

Delete a user directory connector

Steps

  1. In Ransomware Resilience, select Settings.

  2. Locate the User activity monitoring tile, select Manage.

  3. Select the User directory connector tab.

  4. Identify the user directory connector you want to delete. In the action menu at the end of the line, select the three dots …​ then Delete.

  5. In the pop-up dialog, select Delete to confirm.

Respond to user activity alerts

After you configure user activity detection, you can monitor events in the alerts page. For more information, see Detect malicious activity and suspicious user behavior.

You can also automate responses to user activity events.

Next steps