Integrating IBM Storage Insights with IBM Storage Defender

IBM Storage Defender sends integration and deregister requests to storage systems monitored in an IBM Storage Insights instance. Users with administrator role in IBM Storage Insights can approve or deny the integration requests. IBM Storage Insights sends ransomware threat alerts that are detected on storage systems to IBM Storage Defender for immediate action.

Note: You can integrate IBM Storage Defender with both the free and pro versions of IBM Storage Insights to forward ransomware threat detection alerts and view remediation actions directly in IBM Storage Insights.

Integration requests

When an administrator user opens or refreshes the overview dashboard or storage systems page, IBM Storage Insights filters the storage system records and gets a list of storage systems, which have IBM Storage Defender integration requests waiting for approval. IBM Storage Insights displays a notification with the Take Action option along with the storage system name for which the integration request is waiting for approval. If the integration requests are received for multiple storage systems, the notification message displays the count of the storage systems, which have the integration requests waiting for approval. When the user clicks the Take Action option, either on the dashboard or storage systems page, the storage systems page displays the records, which have IBM Storage Defender integration requests awaiting for approval.

On the storage systems page, user can click the icon available under the Defender integration column for a storage system to open the Security Parameters window and approve or decline the integration request by using the following options:
  • Decline: If user clicks the Decline option, a confirmation message box is displayed to confirm the decline of the integration request. When you confirm the decline of the integration request, the request is declined for the selected storage system.
  • Approve: If user clicks the Approve, the Approve for all systems dialog box appears with the following options:
    • No: If user clicks the No option, the integration request is only approved for the selected storage system.
    • Yes: If user click the Yes, approve for all option, integration requests for all the pending storage systems are approved and all the future integration requests received from IBM Storage Defender will auto approve.

    On successful integration, a confirmation message is displayed and the Defender Integration toggle option becomes active.

Ransomware alert actions

On receiving a ransomware alert, IBM Storage Defender:
  • Acknowledges the alert: Specifies that IBM Storage Defender has received a ransomware alert. IBM Storage Insights displays a purple color notification to specify that IBM Storage Defender acknowledges the ransomware alert.
  • Remediates the alert: Specifies that IBM Storage Defender has resolved the ransomware alert. IBM Storage Insights displays a green color notification to specify that IBM Storage Defender has resolved the ransomware alert.

Integration settings

Administrator users can configure the IBM Storage Defender integration settings from the IBM Storage Insights. To pre-approve all the integration requests for all storage systems, complete the following steps:

  1. Click the overflow menu icon with three vertical lines at the upper-left on the IBM Storage Insights dashboard.
  2. Click Settings tab.
  3. Click Integrations, then click the IBM Storage Defender tab.
  4. To auto-approve the integration requests for all the storage systems, check the I want to pre-approve future integration requests for all my storage systems received from IBM Storage Defender checkbox.
The user can also see the IBM Storage Defender integration status on the Settings page.

Deregister request

IBM Storage Defender can send a deregister request for a storage system, the deregister request gets auto approved immediately and a notification message is displayed on IBM Storage Insights along with the storage system name for which the deregister request is approved.

In this case, the IBM Storage Defender system becomes unavailable for integration with the storage system. The Defender Integration option in the Security Parameters window displays the Not Available status. In this case, you need to contact IBM Storage Defender administrator for integration.

If IBM Storage Defender is not reachable due to some technical issue, you can see a notification message on IBM Storage Insights dashboard and in the Security Parameters window. In this case, ransomware threat alerts are not forwarded to IBM Storage Defender until the issue gets resolved and it gets reachable. In this case, contact the IBM Storage Defender administrator to resolve the technical issue.