Skip to main content
NetApp Ransomware Resilience

Understand SIEM support in NetApp Ransomware Resilience

Contributors netapp-ahibbard
PDFs

NetApp Ransomware Resilience supports native integrations with multiple security information and event management (SIEM) systems as well as custom integrations via webhook. By connecting a SIEM system to Ransomware Resilience, you can automatically send event data for threat analysis and detection to streamline ransomware protection and event management.

Ransomware Resilience offers native support for the following SIEM systems:

Tip Ransomware Resilience also provides security orchestration, automation, and response (SOAR) playbooks.

Event data sent to a SIEM

Ransomware Resilience can send the following event data to your SIEM system:

  • context:

    • os: This is a constant with the value of ONTAP.

    • os_version: The version of ONTAP running on the system.

    • connector_id: The ID of the Console agent managing the system.

    • cluster_id: The cluster ID reported by ONTAP for the system.

    • svm_name: The name of the SVM where the alert was found.

    • volume_name: The name of the volume on which the alert is found.

    • volume_id: The ID of the volume reported by ONTAP for the system.

  • incident:

    • incident_id: The incident ID generated by Ransomware Resilience for the volume under attack in Ransomware Resilience.

    • alert_id: The ID generated by Ransomware Resilience for the workload.

    • severity: The severity of the alert levels: "CRITICAL", "HIGH", "MEDIUM", "LOW".

    • description: Details about the alert that was detected, for example, "A potential ransomware attack detected on workload arp_learning_mode_test_2630"

    • title: The display name of the detected alert.

    • criticality: An assessment of the criticality of the volume in your environment: "CRITICAL", "IMPORTANT", "STANDARD".

    • incident_status: The active status of the incident, which can be: "NEW", "RESOLVED", "DISMISSED", "AUTO_RESOLVED".

    • first_detected: The timestamp indicating when the incident was first detected by Ransomware Resilience.

    • is_readiness_drill: A boolean value indicating whether the alert is a drill or an actual incident.

    • protocol: The protocol used by the volume. Possible values are "iSCSI", "NFS", and "SMB".

    • alert_type: The type of threat detected. Possible values are "Encryption", "Data destruction", "Data breach", and "Suspicious user behavior".

    • user_name: The username of the suspicious user associated with the alert.

    • user_id: The user ID of the suspicious user associated with the alert.

    • client_ips: A list of client IP addresses associated with the suspicious activity, applicable only for NFS alerts.

Note The user_name and user_id fields are only pertinent if you've configured user behavior detection.

Event delivery route

Ransomware Resilience supports delivering SIEM events through the NetApp Console and the Console agent. You can choose which delivery route you prefer during configuration.

With delivery through the Console, events are sent directly from the Console to your SIEM endpoint. Your SIEM endpoint must be reachable from the public internet to receive events.

For delivery through the Console agent, events are routed via the Console agent that resides within your network. This option is best for on-premises environments with strict IP address allow lists and does not require inbound connectivity. The Console agent must be able to reach the SIEM endpoint over the network. This means it can resolve the endpoint host name, connect on the required port, and pass firewall or proxy controls.

Event delivery through the Console agent is supported for Google SecOps, Splunk, and webhook-based SIEM configurations.

Disable a SIEM system

You can temporarily pause sending event data to a SIEM system or delete the SIEM system if you no longer need the SIEM. If you pause the SIEM, you can resume it at any time.

Steps

  1. In Ransomware Resilience, select Settings.

  2. In the SIEM tile, select Manage.

  3. Select the action menu (…​) for the SIEM system you want to stop, then select Pause or Delete.

    If you're deleting, select Delete in the confirmation dialog to complete the action.

Next steps