Skip to main content

Respond to abnormal activity detected by ONTAP ARP

Contributors netapp-dbagwell netapp-ahibbard netapp-aherbin
PDFs

When Autonomous Ransomware Protection (ARP) detects abnormal activity in a protected volume, it issues a warning. You should evaluate the notification to determine whether the activity is acceptable (false positive) or whether an attack seems malicious. After you categorize the attack, you can clear the warning and notices about suspected files.

When ONTAP detects an abnormality, it also creates an ARP snapshot of the volume to create the best recovery point. ARP snapshots are retained for two to five days by default.

When you categorize an attack, these ARP snapshots are either deleted instantly (ONTAP 9.15.1 and earlier) or retained for an abbreviated period initiated by the categorization operation (ONTAP 9.16.1 and later).

Note Beginning with ONTAP 9.11.1, you can modify the retention settings for ARP snapshots.
About this task

ARP displays a list of suspected files when it detects any combination of high data entropy, abnormal volume activity with data encryption, and unusual file extensions.

When the ARP warning is issued, respond by designating the file activity in one of two ways:

  • False positive

    The identified file type is expected in your workload and can be ignored.

  • Potential ransomware attack

    The identified file type is unexpected in your workload and should be treated as a potential attack.

In both cases, normal monitoring resumes after updating and clearing the notices. ARP records your evaluation to the threat assessment profile, using your choice to monitor subsequent file activities.

In the case of a suspected attack, you must determine whether it is an attack, respond to it if it is, and restore protected data before clearing the notices. Learn more about how to recover from a ransomware attack.

Note If you restore an entire volume, there are no notices to clear.
Before you begin

ARP must be active and not in learning mode.

Steps

You can use System Manager or the ONTAP CLI to respond to abnormal activity.

System Manager

  1. When you receive an "abnormal activity" notification, follow the link. Alternately, navigate to the Security tab of the Volumes overview.

    Warnings are displayed in the Overview pane of the Events menu.

  2. When a message appears about the detection of abnormal volume activity, view the suspected file types.

    In the Security tab, select the option to review the suspected file types.

  3. In the Suspected File Types dialog box, examine each file type and mark it as either "False Positive" or "Potential Ransomware attack".

    If you selected this value…​

    Take this action…​

    False Positive

    1. Select Update and Clear Suspect File Types to record your decision.

      Note Beginning with ONTAP 9.13.1, if you are using MAV to protect your ARP settings, the clear-suspect operation prompts you to obtain the approval of one or more additional administrators. Approval must be received from all administrators associated with the MAV approval group or the operation will fail.

      This action clears warning notices about suspected files. ARP then resumes normal monitoring of the volume. For ONTAP 9.15.1 and earlier, after you clear suspected file types the ARP snapshots are automatically deleted. For ARP/AI in ONTAP 9.16.1 and later, ARP snapshots are automatically deleted after an abbreviated retention period triggered by the categorization operation.

    Potential Ransomware Attack

    1. Respond to the attack and restore protected data.

    2. Select Update and Clear Suspect File Types to record your decision and resume normal ARP monitoring.

    This action clears the attack report. There are no suspected file type notices to clear if you restored an entire volume. For ONTAP 9.15.1 and earlier, after you restore a volume the ARP snapshots are automatically deleted. For ARP/AI in ONTAP 9.16.1 and later, ARP snapshots are automatically deleted after an abbreviated retention period triggered by the categorization operation.
Related information