Skip to main content

Respond to abnormal activity detected by ONTAP ARP

Contributors netapp-dbagwell
PDFs

When Autonomous Ransomware Protection (ARP) detects abnormal activity in a protected NAS volume, it issues a warning. You should evaluate the notification to determine whether the activity is acceptable (false positive) or whether an attack seems malicious. After you categorize the attack, you can clear the warning and resume normal monitoring.

Note If you are running ONTAP 9.16.1 or later, see Respond to abnormal activity detected by ARP/AI.

When you categorize an attack, ARP snapshots are deleted immediately when you clear the suspected event in ONTAP 9.15.1 and earlier. If you are using volume snapshot restore to restore data, you must restore before clearing the suspected event.

Note Beginning with ONTAP 9.11.1, you can modify the retention settings for ARP snapshots.
About this task

For NAS volumes, ARP displays a list of suspected files when it detects any combination of high data entropy, abnormal volume activity with data encryption, and unusual file extensions. ARP (9.10.1 to 9.15.1) does not support SAN volumes.

Although Autonomous Ransomware Protection automates detection and snapshot creation, the final determination of whether a file or event is truly malicious requires manual investigation. Autonomous Ransomware Protection cannot definitively determine if an event is a real ransomware attack. It flags suspicious activity, but you'll need to investigate and confirm whether the event is actual ransomware or a false positive (benign activity).

Determine whether a file or event is truly malicious.

When an ARP warning notification is issued, respond by designating the activity in one of two ways:

  • False positive: The identified file type is expected in your workload and can be ignored.

  • Potential ransomware attack: The identified file type is unexpected in your workload and should be treated as a potential attack.

Normal monitoring resumes after you update with your decision and clear the ARP notifications. ARP records your evaluation to the threat assessment profile, using your choice to monitor subsequent file activities.

In the case of a suspected attack, you must determine whether it is an attack, respond to it if it is, and then clear notices and restore data. Learn more about how to recover from a ransomware attack.

Before you begin

ARP must be actively protecting a volume (not in learning mode or paused).

Steps

Follow these steps when you need to classify abnormal activity:

  1. Review abnormal activity details

  2. Understand snapshot behavior when clearing a suspected event

  3. Do one of the following:

If you need to restore data, follow the steps in Recover data after a ransomware attack with ARP.

Review abnormal activity details

You can use System Manager or the ONTAP CLI to review ARP warning details before choosing a response flow.

System Manager

  1. When you receive an "abnormal activity" notification, follow the link. Alternatively, navigate to Storage > Volumes, find an affected volume, and select the Security tab.

    Warnings are displayed in the System Manager dashboard Overview pane of the Events menu.

  2. In the Security tab, review the Suspected file types report. A Suspected File Types dialog box shows the file extensions and file counts that ARP has identified.

CLI

  1. When you receive a notification of a suspected ransomware attack, verify the time and severity of the attack:

    security anti-ransomware volume show -vserver <svm_name> -volume <vol_name>

    Sample output:

    Vserver Name: vs0
Volume Name: vol1
State: enabled
Attack Probability: moderate
Attack Timeline: 9/14/2021 01:03:23
Number of Attacks: 1

    You can also check EMS messages:

    event log show -message-name callhome.arw.activity.seen

Understand snapshot behavior when clearing a suspected event

For ONTAP 9.15.1 and earlier, ARP snapshots are deleted immediately when you clear the suspected event. This means you must restore data before clearing if you plan to use volume snapshot restore. After clearing, the snapshot is gone and cannot be used for restore.

If you use other recovery methods (FlexClone, single-file SnapRestore, data copy), you can perform recovery either before or after clearing the suspected event; these methods do not delete the snapshot.

Beginning with ONTAP 9.13.1, if you use MAV to protect ARP settings, the clear-suspect operation can require additional approvals. Approval must be received from all administrators associated with the MAV approval group or the operation will fail.

Classify as false positive and resume monitoring

Use this flow when the identified file type is expected for the workload.

System Manager

  1. Choose the affected files, select Mark as false positive, and then choose Update and Clear Suspected File Types.

This action clears the warning notice. ARP then resumes normal monitoring of the volume.

CLI

  1. Run the following command to record your decision and resume normal ARP monitoring:

    security anti-ransomware volume attack clear-suspect -vserver <svm_name> -volume <vol_name> [<extension_identifiers>] -false-positive true

    Use the following optional parameter to identify only specific extensions as false positives: [-extension <text>, …​ ]

Classify as potential ransomware attack and recover data

Use this flow when the identified file type is unexpected for the workload.

System Manager

  1. Mark selected files as Potential ransomware attack.

  2. Before you recover data, consider your recovery method options. Then do one of the following:

    • If you plan to restore a volume: Complete data recovery before clearing notices:

      1. Recover data from the most recent ARP snapshot or an earlier snapshot.

      2. After data recovery is complete, finalize by clearing the suspected event:

        • For NAS file type warnings, select Update and Clear Suspected File Types.

          Note Recording your decision clears the attack report and deletes the ARP snapshot. Be sure to complete data recovery before this step.

    • If you plan to use another restore method (FlexClone or single-file SnapRestore): Restore the data first, then clear notices:

      1. Recover data using FlexClone or single-file SnapRestore.

      2. After data recovery is complete, finalize the categorization:

        • Select Update and Clear Suspected File Types.

CLI

  1. (Optional) Generate an attack report and specify where to save it:

    security anti-ransomware volume attack generate-report -vserver <svm_name> -volume <vol_name> -dest-path <[svm_name]:[junction_path/sub_dir_name]>

  2. For ONTAP 9.15.1 and earlier with volume snapshot restore: Restore data before clearing the suspected event. See Recover data after an attack with ARP.

  3. After you have restored data (or if you are using an alternate recovery method), clear the suspected event and mark the attack as potential ransomware (-false-positive false):

    security anti-ransomware volume attack clear-suspect -vserver <svm_name> -volume <vol_name> [<extension_identifiers>] -false-positive false
    Important In ONTAP 9.15.1 and earlier, running clear-suspect immediately deletes ARP snapshots. Do not run this command until you have completed data recovery.