security anti-ransomware volume attack clear-suspect
Suggest changes
PDFs
Clear suspect record
Availability: This command is available to cluster and Vserver administrators at the admin privilege level.
Description
The anti-ransomware volume attack clear-suspect command removes the specified files from suspect files report. When no optional parameters are provided, the suspect report file is cleared.
Parameters
-vserver <vserver name>- Vserver Name-
This parameter specifies the Vserver on which the volume is located.
-volume <volume name>- Volume Name-
This parameter specifies the name of the volume on which anti-ransomware feature is enabled.
- {
[-sequence-number <integer>]- Sequence Number (privilege: advanced) -
This optionally specifies the sequence number of the suspect file obtained from genrated report.
- {
[-extensions <text>,…]- File Extensions -
This optionally specifies the extensions of ransomware attacked files that needs to be cleared from attack report.
- |
[-start-time <MM/DD/YYYY HH:MM:SS>]- Start Time -
This optionally specifies the lower bound of the time to clear a suspect record. Any suspect record with time greater than or equal to start-time is cleared.
[-end-time <MM/DD/YYYY HH:MM:SS>]- End Time }-
This optionally specifies upper bound of the time to clear a suspect record. Any suspect record with time less than or equal to end-time is cleared.
-false-positive {true|false}- False Positive?-
This indicates whether the suspect record of specific extensions, time range, and so on, are to be considered a false positive.
Examples
The folowing example shows a sample output for clearing all the suspects observed with timestamp in the start-time and end-time range, and with given extension.
clus1::> security anti-ransomware volume attack clear-suspect -volume testvol -start-time "4/14/2021 04:16:48" -end-time "4/14/2021 06:16:50" 5 suspect records cleared. The following examples shows output when given sequence-number is not present. clus1::*> security anti-ransomware volume attack clear-suspect -volume testvol -sequence-number 1000 Error: command failed: No suspect records found.