Skip to main content

Configure ONTAP ARP/AI snapshot response policies and settings

Contributors netapp-dbagwell
PDFs

Beginning with ONTAP 9.16.1, you can use the CLI to control the creation and retention settings for Autonomous Ransomware Protection with AI (ARP/AI) snapshots. Beginning with ONTAP 9.20.1, you can also configure the snapshot response policy for periodic and attack snapshots to control whether ARP/AI creates snapshots when it detects abnormal activity.

Note If you are running ONTAP 9.15.1 or earlier, see Adjust settings for automatically generated ARP snapshots.

Configure a snapshot response policy

Beginning with ONTAP 9.20.1, you can configure the ARP/AI snapshot response policy for periodic and attack snapshots to control whether ARP/AI creates snapshots when it detects abnormal activity. You can set the policy at the SVM level (where all volumes on the SVM inherit the setting) or override it at the volume level.

The following snapshot response policies are available:

Policy Behavior

alert-with-proactive-and-periodic-snapshot

(Default) ARP/AI generates alerts and event logs, creates snapshots at regular intervals, and creates additional snapshots when an attack is detected.

alert-with-proactive-snapshot

ARP/AI generates alerts and event logs and creates snapshots only when an attack is detected. No periodic snapshots are created.

alert-only

ARP/AI generates alerts and event logs only. No ARP/AI snapshots are created.
Caution If you set the policy to alert-only, ARP/AI creates no snapshots. If a ransomware attack is confirmed, there are no ARP/AI snapshots available for data recovery, even during an active attack. Before using alert-only, ensure you have adequate external data protection such as scheduled ONTAP snapshots, SnapCenter backups, or another backup solution.
Note When you change the snapshot response policy, existing ARP/AI snapshots are not deleted immediately. They are deleted when their scheduled expiry time is reached. Do not expect immediate storage capacity reclamation after a policy change.
System Manager

Configure the snapshot response policy at the SVM level:

  1. Select Cluster > Storage VMs and select the storage VM.

  2. Navigate to the Settings tab. Under Security, locate the Anti-ransomware tile and select Edit icon.

  3. Under Protection level, select the protection type to apply to all ARP/AI-enabled volumes on the SVM.

  4. Select Save.

Configure the snapshot response policy at the volume level:

  1. Select Storage > Volumes and select the volume.

  2. In the Security tab, locate the Anti-ransomware section and select Edit icon.

  3. Under Protection level, select the snapshot response policy to override the SVM-level setting for this volume.

  4. Select Save.

CLI

  1. Show the current ARP/AI snapshot response policy:

    At the SVM level:

    security anti-ransomware vserver snapshot-settings show -vserver <svm_name>

    At the volume level:

    security anti-ransomware volume snapshot-settings show -vserver <svm_name> -volume <volume_name>

  2. Configure the ARP/AI snapshot response policy:

    At the SVM level:

    security anti-ransomware vserver snapshot-settings modify -vserver <svm_name> -anti-ransomware-snapshot-policy <policy>
    Note This setting applies to volumes when ARP/AI is enabled on them. It does not retroactively affect existing ARP/AI-enabled volumes.

    At the volume level (overrides the SVM-level setting):

    security anti-ransomware volume snapshot-settings modify -vserver <svm_name> -volume <volume_name> -anti-ransomware-snapshot-policy <policy>

Adjust snapshot creation and retention settings

Note Beginning with ONTAP 9.20.1, the following settings apply only when the snapshot response policy is alert-with-proactive-snapshot or alert-with-proactive-and-periodic-snapshot.
Before you begin

You can only modify ARP/AI snapshot options on a node SVM and not on other SVM types.

Steps

  1. Show all current ARP/AI snapshot settings:

    options -option-name arw*

  2. Show selected current ARP/AI snapshot settings:

    options -option-name <arw_setting_name>

  3. Modify ARP/AI snapshot settings:

    options -option-name <arw_setting_name> -option-value <arw_setting_value>

    You can modify the following settings (ONTAP 9.16.1 and later):

    Setting Description Supported versions with ARP/AI

    arw.snap.max.count

    Specifies the maximum number of ARP/AI snapshots that can exist in a volume at any given time. Older copies are deleted to ensure that the total number of ARP/AI snapshots stays within this limit.

    Note Beginning with ONTAP 9.20.1, this setting applies only when the snapshot response policy is set to alert-with-proactive-and-periodic-snapshot. When the policy is set to alert-with-proactive-snapshot or alert-only, ONTAP ignores this setting.

    ONTAP 9.16.1 and later

    arw.snap.create.interval.hours

    Specifies the interval in hours between ARP/AI snapshots. A new ARP/AI snapshot is created when a data entropy-based attack is suspected and the most recently created snapshot is older than the specified interval.

    ONTAP 9.16.1 and later

    arw.snap.normal.retain.interval.hours

    Specifies the duration in hours for which an ARP/AI snapshot is retained. When an ARP/AI snapshot reaches the retention threshold, it is deleted.

    ONTAP 9.16.1 (deprecated in 9.17.1 and later)

    arw.snap.max.retain.interval.days

    Specifies the maximum duration in days an ARP/AI snapshot can be retained. Any ARP/AI snapshot older than this duration is deleted when there is no attack reported on the volume.

    Note The maximum retention interval is ignored if ARP/AI detects a threat. The ARP/AI snapshot created in response to the threat is retained until you respond to the threat. When you mark a threat as a false positive, the retention timer specified by arw.snap.retain.hours.after.clear.suspect.false.alert is applied to the ARP/AI snapshots. After that timer expires, standard retention settings resume.

    ONTAP 9.16.1 (deprecated in 9.17.1 and later)

    arw.snap.create.interval.hours.post.max.count

    Specifies the interval in hours between ARP/AI snapshots when the volume already contains the maximum number of ARP/AI snapshots. When the maximum number is reached, an ARP/AI snapshot is deleted to make room for a new copy. Use this option to reduce the creation speed to retain older copies.

    ONTAP 9.16.1 (deprecated in 9.17.1 and later)

    arw.snap.new.extns.interval.hours

    Specifies the interval in hours between ARP/AI snapshots created when a new file extension is detected. A new ARP/AI snapshot is created when a new file extension is observed and the previous such snapshot is older than the specified interval. This option exists independently of arw.snap.create.interval.hours, which specifies the interval for entropy-based snapshots.

    ONTAP 9.16.1 (deprecated in 9.17.1 and later)

    arw.snap.low.encryption.retain.duration.hours

    Specifies the retention duration in hours for ARP/AI snapshots created during periods of low encryption activity.

    ONTAP 9.17.1 and later

    arw.snap.retain.hours.after.clear.suspect.false.alert

    Specifies the interval in hours an ARP/AI snapshot is retained as a precaution after an attack incident is marked as a false positive by the administrator.

    ONTAP 9.16.1 and later

    arw.snap.retain.hours.after.clear.suspect.real.attack

    Specifies the interval in hours an ARP/AI snapshot is retained as a precaution after an attack incident is marked as a real attack by the administrator.

    ONTAP 9.16.1 and later

    arw.snap.surge.interval.days

    Specifies the interval in days between ARP/AI snapshots created in response to IO surges. This option also specifies the retention period in days for an ARP/AI surge snapshot.

    ONTAP 9.16.1 and later

    arw.high.encryption.alert.enabled

    Enables alerts for high levels of encryption. When set to on (default), ONTAP sends an alert when the percentage of encryption exceeds the threshold specified in arw.high.encryption.percentage.threshold.

    ONTAP 9.17.1 only

    arw.high.encryption.percentage.threshold

    Specifies the maximum percentage of encryption for a volume. If the percentage of encryption exceeds this threshold, ONTAP handles the increase as an attack and creates an ARP/AI snapshot. arw.high.encryption.alert.enabled must be set to on for this option to take effect.

    ONTAP 9.17.1 only

    arw.snap.high.encryption.retain.duration.hours

    Specifies the retention duration interval in hours for snapshots created during a high encryption threshold event.

    ONTAP 9.17.1 and later

  4. If you are using ARP/AI with a SAN environment, you can also modify the following evaluation period settings:

    Setting Description Supported versions

    arw.block_device.auto.learn.threshold.min_value

    Specifies the minimum encryption threshold percentage value during the auto-learn phase of evaluation for block devices.

    ONTAP 9.17.1 and later

    arw.block_device.auto.learn.threshold.max_value

    Specifies the maximum encryption threshold percentage value during the auto-learn phase of evaluation for block devices.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.min_hours

    Specifies the minimum interval in hours the evaluation phase must run before the encryption threshold is set.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.max_hours

    Specifies the maximum interval in hours the evaluation phase must run before the encryption threshold is set.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.min_data_ingest_size_GB

    Specifies the minimum amount of data in GB that must be ingested during the evaluation phase before the encryption threshold is set.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.alert.enabled

    Specifies whether alerts are enabled for the evaluation phase of ARP/AI on block devices. Default value is True.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.alert.threshold

    Specifies the threshold percentage during the evaluation phase of ARP/AI on block devices. If the percentage of encryption exceeds this threshold, an alert is triggered.

    ONTAP 9.17.1 and later
Related information