Skip to main content

Manage ONTAP ARP/AI attack detection parameters

Contributors netapp-dbagwell
PDFs

Beginning with ONTAP 9.16.1, you can modify the parameters for ransomware detection on a specific ARP/AI-enabled volume and report a known surge as normal file activity. Adjusting detection parameters helps improve the accuracy of reporting based on your specific volume workload.

Note If you are running ONTAP 9.15.1 or earlier, see Manage ARP attack detection parameters.

How ARP/AI attack detection works

ARP/AI uses a machine-learning model to detect ransomware activity. When ARP/AI is in active mode (or evaluation mode for SAN volumes), it continuously monitors volume behaviors. These include entropy, file extensions, and file IOPS (NAS) or volume-level encryption rates (SAN). For more information about detection criteria, see what ARP/AI detects.

Certain volumes and workloads require different detection parameters. For example, an ARP/AI-enabled volume might host numerous types of file extensions, in which case you may want to modify the threshold count for never-before-seen file extensions or disable those warnings entirely.

Beginning with ONTAP 9.14.1, you can configure alerts when ARP/AI observes a new file extension and when ARP/AI creates a snapshot. For more information, see Configure ARP/AI alerts.

Attack detection in NAS environments

ARP/AI issues a threat warning when it detects either of the following conditions:

  • High entropy data

  • Multiple files with the same never-seen-before file extension (observed within a 48-hour period)

Note To reduce high numbers of false positive alerts, go to Storage > Volumes > Security > Configure workload characteristics and disable Monitor new file types. Beginning in ONTAP 9.18.1 P2, System Manager no longer displays ARP/AI workload characteristics, including baseline and surge statistics. Surge statistics remain available using ONTAP CLI and REST API options for advanced analysis.
Attack detection in SAN environments

Beginning with ONTAP 9.17.1, ARP/AI issues a warning if it detects high encryption rates that exceed an automatically learned threshold. This threshold is established after an evaluation period but can be modified.

Modify ARP/AI attack detection parameters

Depending on the expected behaviors of the ARP/AI-enabled volume, you might want to modify the attack detection parameters.

Steps

  1. View the existing attack detection parameters:

    security anti-ransomware volume attack-detection-parameters show -vserver <svm_name> -volume <volume_name>
    security anti-ransomware volume attack-detection-parameters show -vserver vs1 -volume vol1
                                             Vserver Name : vs1
                                              Volume Name : vol1
           Block Device Auto Learned Encryption Threshold : 10
            Is Detection Based on High Entropy Data Rate? : true
  Is Detection Based on Never Seen before File Extension? : true
                  Is Detection Based on File Create Rate? : true
                  Is Detection Based on File Rename Rate? : true
                  Is Detection Based on File Delete Rate? : true
           Is Detection Relaxing Popular File Extensions? : true
                High Entropy Data Surge Notify Percentage : 100
                 File Create Rate Surge Notify Percentage : 100
                 File Rename Rate Surge Notify Percentage : 100
                 File Delete Rate Surge Notify Percentage : 100
 Never Seen before File Extensions Count Notify Threshold : 5
       Never Seen before File Extensions Duration in Hour : 48

  2. All the fields shown are modifiable with boolean or integer values. To modify a field, use the security anti-ransomware volume attack-detection-parameters modify command.

    Learn more about security anti-ransomware volume attack-detection-parameters modify in the ONTAP command reference.

Report known surges

ARP/AI continues to modify baseline values for detection parameters even in active mode. If you know of surges in your volume activity, either one-time surges or a surge that is characteristic of a new normal, you should report them as safe. Manually reporting these surges as safe helps improve the accuracy of ARP/AI's threat assessments.

Report a one-time surge

  1. If a one-time surge is occurring under known circumstances and you want ARP/AI to report a similar surge in future circumstances, clear the surge from the workload behavior:

    security anti-ransomware volume workload-behavior clear-surge -vserver <svm_name> -volume <volume_name>

    Learn more about security anti-ransomware volume workload-behavior clear-surge in the ONTAP command reference.

Modify baseline surge

  1. If a reported surge should be considered normal application behavior, report the surge as such to modify the baseline surge value:

    security anti-ransomware volume workload-behavior update-baseline-from-surge -vserver <svm_name> -volume <volume_name>

    Learn more about security anti-ransomware volume workload-behavior update-baseline-from-surge in the ONTAP command reference.

Configure ARP/AI alerts

Beginning with ONTAP 9.14.1, you can specify alerts for two events:

  • Observation of a new file extension on a volume

  • Creation of an ARP/AI snapshot

Alerts for these two events can be set on individual volumes or for the entire SVM. If you enable alerts for the SVM, the alert settings are inherited only by volumes created after you enable the alert. By default, alerts are not enabled on any volume.

Event alerts can be controlled with multi-admin verification. For more information, see Multi-admin verification with ARP/AI-protected volumes.

Steps

You can use System Manager or the ONTAP CLI to set alerts for ARP/AI events.

System Manager
Set alerts for a volume

  1. Navigate to Volumes. Select the individual volume for which you want to modify settings.

  2. Select the Security tab then Event severity settings.

  3. To receive alerts for New file extension detected and Ransomware snapshot created, select the dropdown menu under the Severity heading. Modify the setting from Don't generate event to Notice.

  4. Select Save.

Set alerts for an SVM

  1. Navigate to Storage VM then select the SVM for which you want to enable settings.

  2. Under the Security heading, locate the Anti-ransomware card. Select Menu options icon then Edit Ransomware Event Severity.

  3. To receive alerts for New file extension detected and Ransomware snapshot created, select the dropdown menu under the Severity heading. Modify the setting from Don't generate event to Notice.

  4. Select Save.

CLI
Set alerts for a volume

  • To set alerts for a new file extension:

    security anti-ransomware volume event-log modify -vserver <svm_name> -volume <volume_name> -is-enabled-on-new-file-extension-seen true

  • To set alerts for the creation of an ARP/AI snapshot:

    security anti-ransomware volume event-log modify -vserver <svm_name> -volume <volume_name> -is-enabled-on-snapshot-copy-creation true

  • Confirm your settings with the anti-ransomware volume event-log show command.

Set alerts for an SVM

  • To set alerts for a new file extension:

    security anti-ransomware vserver event-log modify -vserver <svm_name> -is-enabled-on-new-file-extension-seen true

  • To set alerts for the creation of an ARP/AI snapshot:

    security anti-ransomware vserver event-log modify -vserver <svm_name> -is-enabled-on-snapshot-copy-creation true

  • Confirm your settings with the security anti-ransomware vserver event-log show command.

Learn more about security anti-ransomware vserver event-log commands in the ONTAP command reference.

Related information