Skip to main content

Pause ONTAP ARP or ARP/AI protection to exclude workload events from analysis

Contributors netapp-dbagwell
PDFs

If you are expecting unusual workload events, you can temporarily suspend and resume Autonomous Ransomware Protection (ARP and ARP/AI) analysis at any time.

Beginning with ONTAP 9.13.1, you can enable multi-admin verification (MAV) so that two or more authenticated user admins are required to pause ARP or ARP/AI.

Learn more about MAV.

About this task

During an ARP or ARP/AI pause, ONTAP does not log events or actions for new writes; however, analytics continue for earlier logs in the background.

Note Do not use the ARP or ARP/AI disable function to pause analytics. Doing so disables protection on the volume and all existing information around learned workload behavior is lost. For ARP (ONTAP 9.10.1 to 9.15.1), a restart of the learning period would be required. For ARP/AI (ONTAP 9.16.1 and later), all accumulated workload behavior data is lost. For SAN volumes, the evaluation period restarts from the beginning.
Steps

You can use System Manager or the ONTAP CLI to pause ARP or ARP/AI.

System Manager

  1. Select Storage > Volumes and then select the volume where you want to pause ARP or ARP/AI.

  2. In the Security tab of the Volumes overview, select Pause anti-ransomware in the Anti-ransomware box.

    Note Beginning with ONTAP 9.13.1, if you are using MAV to protect ARP or ARP/AI settings, the pause operation prompts you to obtain the approval of one or more additional administrators. Approval must be received from all administrators associated with the MAV approval group or the operation will fail.

  3. To resume monitoring, select Resume anti-ransomware.

CLI

  1. Pause ARP or ARP/AI on a volume:

    security anti-ransomware volume pause -vserver <svm_name> -volume <vol_name>

  2. To resume processing, use the resume command:

    security anti-ransomware volume resume -vserver <svm_name> -volume <vol_name>

    Learn more about security anti-ransomware volume in the ONTAP command reference.

  3. If you are using MAV to protect ARP or ARP/AI settings, the pause operation prompts you to obtain the approval of one or more additional administrators. Approval must be received from all administrators associated with the MAV approval group or the operation will fail.

    If you are using MAV and an expected pause operation needs additional approvals, each MAV group approver does the following:

    1. Show the request:

      security multi-admin-verify request show

    2. Approve the request:

      security multi-admin-verify request approve -index[<number returned from show request>]

      If you are using MAV and you are a MAV group approver, you can reject a pause operation request:

      security multi-admin-verify request veto -index[<number returned from show request>]

      Learn more about security multi-admin-verify request in the ONTAP command reference.