topic Re: Ransomware protection: How do I find out what triggered the alert? in ONTAP Discussions https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/452784#M43615 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Sanaman_0-1716163356788.png" style="width: 400px;"><img src="https://community.netapp.com/t5/image/serverpage/image-id/28281i5B7B26DE38D00E82/image-size/medium?v=v2&amp;px=400" role="button" title="Sanaman_0-1716163356788.png" alt="Sanaman_0-1716163356788.png" /></span></P><P>You may see similar to above in "Volume -&gt; Security", where you could see the suspected file type.</P> Mon, 20 May 2024 00:06:29 GMT Sanaman 2024-05-20T00:06:29Z Ransomware protection: How do I find out what triggered the alert? https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/452767#M43613 <P>Hello, we are testing ARW on test volume and get alerts like:</P><P><EM>"callhome.arw.activity.seen [ALERT]</EM></P><P><EM>Description: This message occurs when ransomware activity is detected. To protect the data, a Snapshot copy has been created, which can be used to restore the original data. If your system is configured to do so, it generates and transmits an AutoSupport (or "call home") message to NetApp technical support and to the configured destinations. Successful delivery of an AutoSupport message significantly improves problem determination and resolution."</EM></P><P>&nbsp;</P><P>Now how do I find out what caused this alert?? I've checked system manager's vol-security page, AIQ and even went to activeiq.netapp.com to check the autosupport it sent as the sections are readable from there. Absolutely no information what caused this ALERT...we have on-prem BlueXp and it doesn't support ARW.</P><P>&nbsp;</P><P>So where can I see what happened and caused snapshot creation and autosupport?</P> Fri, 17 May 2024 11:45:59 GMT https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/452767#M43613 Tava 2024-05-17T11:45:59Z Re: Ransomware protection: How do I find out what triggered the alert? https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/452784#M43615 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Sanaman_0-1716163356788.png" style="width: 400px;"><img src="https://community.netapp.com/t5/image/serverpage/image-id/28281i5B7B26DE38D00E82/image-size/medium?v=v2&amp;px=400" role="button" title="Sanaman_0-1716163356788.png" alt="Sanaman_0-1716163356788.png" /></span></P><P>You may see similar to above in "Volume -&gt; Security", where you could see the suspected file type.</P> Mon, 20 May 2024 00:06:29 GMT https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/452784#M43615 Sanaman 2024-05-20T00:06:29Z Re: Ransomware protection: How do I find out what triggered the alert? https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/452788#M43616 <P>Yes like I said I've checked that page but it only lists the suspected file types, but does not tell me why the alert was sent.</P> Mon, 20 May 2024 10:15:07 GMT https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/452788#M43616 Tava 2024-05-20T10:15:07Z Re: Ransomware protection: How do I find out what triggered the alert? https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/453291#M43699 <P>How to confirm the attack's details detected from ARP</P><P><A href="https://kb.netapp.com/on-prem/ontap/Ontap_OS/OS-KBs/How_to_confirm_the_attack's_details_detected_from_ARP" target="_blank">https://kb.netapp.com/on-prem/ontap/Ontap_OS/OS-KBs/How_to_confirm_the_attack's_details_detected_from_ARP</A></P><P>&nbsp;</P><P>Security anti-ransomware volume attack generate-report output</P><P><A href="https://kb.netapp.com/on-prem/ontap/Ontap_OS/OS-KBs/Security_anti-ransomware_volume_attack_generate-report_output" target="_blank">https://kb.netapp.com/on-prem/ontap/Ontap_OS/OS-KBs/Security_anti-ransomware_volume_attack_generate-report_output</A></P><P>&nbsp;</P> Tue, 18 Jun 2024 20:55:45 GMT https://community.netapp.com/t5/ONTAP-Discussions/Ransomware-protection-How-do-I-find-out-what-triggered-the-alert/m-p/453291#M43699 ByronE 2024-06-18T20:55:45Z