Skip to main content

Adjust settings for automatically generated ONTAP ARP/AI snapshots

Contributors netapp-dbagwell
PDFs

Beginning with ONTAP 9.16.1, you can use the CLI to control the retention settings for Autonomous Ransomware Protection with AI (ARP/AI) snapshots that are automatically generated in response to suspected ransomware attacks.

Note If you are running ONTAP 9.15.1 or earlier, see Adjust settings for automatically generated ARP snapshots.
Before you begin

You can only modify ARP/AI snapshot options on a node SVM and not on other SVM types.

Steps

  1. Show all current ARP/AI snapshot settings:

    options -option-name arw*

  2. Show selected current ARP/AI snapshot settings:

    options -option-name <arw_setting_name>

  3. Modify ARP/AI snapshot settings:

    options -option-name <arw_setting_name> -option-value <arw_setting_value>

    You can modify the following settings (ONTAP 9.16.1 and later):

    Setting Description Supported versions with ARP/AI

    arw.snap.max.count

    Specifies the maximum number of ARP/AI snapshots that can exist in a volume at any given time. Older copies are deleted to ensure that the total number of ARP/AI snapshots stays within this limit.

    ONTAP 9.16.1 and later

    arw.snap.create.interval.hours

    Specifies the interval in hours between ARP/AI snapshots. A new ARP/AI snapshot is created when a data entropy-based attack is suspected and the most recently created snapshot is older than the specified interval.

    ONTAP 9.16.1 and later

    arw.snap.normal.retain.interval.hours

    Specifies the duration in hours for which an ARP/AI snapshot is retained. When an ARP/AI snapshot reaches the retention threshold, it is deleted.

    ONTAP 9.16.1 (deprecated in 9.17.1 and later)

    arw.snap.max.retain.interval.days

    Specifies the maximum duration in days an ARP/AI snapshot can be retained. Any ARP/AI snapshot older than this duration is deleted when there is no attack reported on the volume.

    Note The maximum retention interval is ignored if ARP/AI detects a threat. The ARP/AI snapshot created in response to the threat is retained until you respond to the threat. When you mark a threat as a false positive, the retention timer specified by arw.snap.retain.hours.after.clear.suspect.false.alert is applied to the ARP/AI snapshots. After that timer expires, standard retention settings resume.

    ONTAP 9.16.1 (deprecated in 9.17.1 and later)

    arw.snap.create.interval.hours.post.max.count

    Specifies the interval in hours between ARP/AI snapshots when the volume already contains the maximum number of ARP/AI snapshots. When the maximum number is reached, an ARP/AI snapshot is deleted to make room for a new copy. Use this option to reduce the creation speed to retain older copies.

    ONTAP 9.16.1 (deprecated in 9.17.1 and later)

    arw.snap.new.extns.interval.hours

    Specifies the interval in hours between ARP/AI snapshots created when a new file extension is detected. A new ARP/AI snapshot is created when a new file extension is observed and the previous such snapshot is older than the specified interval. This option exists independently of arw.snap.create.interval.hours, which specifies the interval for entropy-based snapshots.

    ONTAP 9.16.1 (deprecated in 9.17.1 and later)

    arw.snap.low.encryption.retain.duration.hours

    Specifies the retention duration in hours for ARP/AI snapshots created during periods of low encryption activity.

    ONTAP 9.17.1 and later

    arw.snap.retain.hours.after.clear.suspect.false.alert

    Specifies the interval in hours an ARP/AI snapshot is retained as a precaution after an attack incident is marked as a false positive by the administrator.

    ONTAP 9.16.1 and later

    arw.snap.retain.hours.after.clear.suspect.real.attack

    Specifies the interval in hours an ARP/AI snapshot is retained as a precaution after an attack incident is marked as a real attack by the administrator.

    ONTAP 9.16.1 and later

    arw.snap.surge.interval.days

    Specifies the interval in days between ARP/AI snapshots created in response to IO surges. This option also specifies the retention period in days for an ARP/AI surge snapshot.

    ONTAP 9.16.1 and later

    arw.high.encryption.alert.enabled

    Enables alerts for high levels of encryption. When set to on (default), ONTAP sends an alert when the percentage of encryption exceeds the threshold specified in arw.high.encryption.percentage.threshold.

    ONTAP 9.17.1 and later

    arw.high.encryption.percentage.threshold

    Specifies the maximum percentage of encryption for a volume. If the percentage of encryption exceeds this threshold, ONTAP handles the increase as an attack and creates an ARP/AI snapshot. arw.high.encryption.alert.enabled must be set to on for this option to take effect.

    ONTAP 9.17.1 and later

    arw.snap.high.encryption.retain.duration.hours

    Specifies the retention duration interval in hours for snapshots created during a high encryption threshold event.

    ONTAP 9.17.1 and later

  4. If you are using ARP/AI with a SAN environment, you can also modify the following evaluation period settings:

    Setting Description Supported versions

    arw.block_device.auto.learn.threshold.min_value

    Specifies the minimum encryption threshold percentage value during the auto-learn phase of evaluation for block devices.

    ONTAP 9.17.1 and later

    arw.block_device.auto.learn.threshold.max_value

    Specifies the maximum encryption threshold percentage value during the auto-learn phase of evaluation for block devices.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.min_hours

    Specifies the minimum interval in hours the evaluation phase must run before the encryption threshold is set.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.max_hours

    Specifies the maximum interval in hours the evaluation phase must run before the encryption threshold is set.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.min_data_ingest_size_GB

    Specifies the minimum amount of data in GB that must be ingested during the evaluation phase before the encryption threshold is set.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.alert.enabled

    Specifies whether alerts are enabled for the evaluation phase of ARP/AI on block devices. Default value is True.

    ONTAP 9.17.1 and later

    arw.block_device.evaluation.phase.alert.threshold

    Specifies the threshold percentage during the evaluation phase of ARP/AI on block devices. If the percentage of encryption exceeds this threshold, an alert is triggered.

    ONTAP 9.17.1 and later
Related information