Skip to main content
NetApp Ransomware Resilience

Manage alerts and blocked users in NetApp Ransomware Resilience

Contributors netapp-ahibbard
PDFs

After configuring user behavior monitoring in NetApp Ransomware Resilience, you can customize alerts and manage blocked users. Customizing the alerts allows you to exclude specific users or file paths from generating an alert. Blocking users is meant to respond to ransomware events to prevent malicious user activity.

You must have configured a user activity agent, enabled a policy with user activity detection, and created a user directory connector to block users.

Tip You can automate responses to user activity detection events.

Manage blocked users

You can block users when you believe they're responsible for malicious activity.

Block users

  1. In Ransomware Resilience, select Settings.

  2. In the Settings dashboard, locate the User activity monitoring tile then select Manage.

  3. Select the Users tab.

  4. Select Block users.

  5. Select the duration of the blocking: it can be one hour up to 24 hours or permanent.

  6. Select the checkbox next to the names of the users you want to block.

  7. Select Block.

Modify the blocked users list

  1. In Ransomware Resilience, select Settings.

  2. In the Settings dashboard, locate the User activity monitoring tile then select Manage.

  3. Select the Users tab.

  4. Select Edit user blocking.

  5. Choose the modification. To modify the duration of the blocking, select Time period for blocked users then modify the duration. To remove users from the blocked user list, select Unblock users.

  6. Select the checkbox next to the name of the blocked user whose status you want to change.

  7. Select Save.

Exclude users from alerts

If there are certain trusted users whose behavior might trigger user behavior alerts, you can exclude them from alerts.

Exclude users from alerts

  1. In Ransomware Resilience, select Settings.

  2. In the Settings dashboard, locate the User activity monitoring tile then select Manage.

  3. Select the Excluded from monitoring tab.

  4. To review individual users in the UI, choose Select manually. To upload a list of excluded users, select Upload.

    1. If you selected Select manually, select the checkbox next to the names of the specific users you want to exclude.

    2. If you select Upload, download the CSV or JSON file that includes the list of all the users. Select Download to access the list.

      On your local machine, review the file. Remove the names of all users that you want to maintain detection for. When the list includes only the names of users you want to exclude from detection, save it.

      In Ransomware Resilience, select Upload. Locate and upload the file.

  5. Select Add to complete adding the users to the exclusion list.

  6. In the Excluded from monitoring tab, the names of the users removed from user behavior detection alerts now display in the dashboard.

Tip You can also exclude a user directly from an alert. For more information, see Respond to ransomware alerts.
Remove users from excluded user list

  1. In the Settings dashboard, locate the User activity card then select Manage.

  2. Select the Excluded from monitoring tab.

  3. Select Add.

  4. To exlcude individual users from the UI, choose Select manually.

  5. Locate the name of the user you want to remove from the excluded user select. Select the action menu (…​) on the row with the user's name then Remove.

  6. In the dialog, select Remove to confirm you want to remove the selected users.

Exclude file paths from monitoring

Each file path must begin with a volume name. It can include up to three sub-directories for that volume, for example "volume/directory/subdirectory/subdirectory2". You can exclude file paths by entering them manually or uploading a CSV file that lists the paths.

Steps

  1. In Ransomware Resilience, select Settings.

  2. In the User activity monitoring tile, select Manage.

  3. Select the Excluded from monitoring tab.

  4. Select Add to enter the file paths for exclusion.

  5. To enter the file paths in the UI, select the Enter manually radio button then enter the file path, for example "volume/directory/subdirectory/". To enter additional file paths, select Select file path.

  6. To upload a list of file paths, select the Upload radio button. Select the upload button to choose the CSV file.

  7. Select Add.

Result

When the operation completes successfully, Ransomware Resilience begins excluding files in the selected paths from monitoring for suspicious user behavior. You can review the list of paths at any time from the Settings menu. If you need to enable monitoring for the file paths again, you can remove them from the list.

Next steps