IBM Storage FlashSystem threat detection

Edit online

IBM® Storage FlashSystem threat detection is designed to provide resilient data storage in the event of a cyberattack. IBM Storage FlashSystem offers new smart technology that is enabled by FCM4 and designed to continuously monitor statistics gathered from every I/O. IBM Storage FlashSystem uses machine learning models to detect anomalies like ransomware in less than a minute, which helps ensure that your business is protected before a cyberattack. For critical functions like ransomware threat detection and also for unified view for managing, troubleshooting, and optimising the entire storage environment IBM Storage FlashSystem relies to IBM Storage Insights Pro .

IBM Storage Defender® Data Resiliency Service integrates with IBM Storage Insights Pro and IBM FlashCore® Module to enable inline data anomaly detection on storage block level.

Note: If you register the IBM Storage FlashSystem with IBM Storage Defender and you register the IBM Storage FlashSystem with IBM Storage Insights Pro, the threat detection is enabled automatically.

IBM FlashCore Modules

IBM FlashCore Modules (FCM) are a family of high-performance flash drives in a standard 2.5", 15 mm form factor. The IBM FlashCore Module design uses the NVMe protocol, a PCIe Gen3/Gen4 U.2 interface, and high-speed NAND memory to provide high throughput and IOPS with consistent and predictable latency. Furthermore, IBM FlashCore Modules in version 4 implement an anomaly detection for operations on storage block level.

IBM Storage Insights Pro

IBM Storage Insights Pro is a powerful cloud-based management platform that empowers businesses to proactively manage, monitor, and optimize their storage infrastructure in addition to network and host servers by using advanced AIOps features. Your ability to identify ransomware threats on storage systems is advanced with the AI-based ransomware threat detection. This feature adds an extra layer of detection that is designed for IBM Storage Virtualize storage systems.

The following image describes the high-level integration between the products.

Figure 1. IBM Storage Defender integration with IBM FlashCore Module work flow
Working principle of the IBM Storage Defender integration with IBM FlashCore Module
  1. IBM FlashCore Module version 4 technology is built in the IBM Storage FlashSystem that is used.
  2. The IBM Storage FlashSystem is registered in IBM Storage Insights Pro. When the system is registered, the IBM FlashCore Module starts reporting the detected anomalies to your IBM Storage Insights Pro tenant.
  3. IBM Storage Insights Pro correlates the data from multiple IBM FlashCore Modules and analyzes the data.
  4. The IBM Storage FlashSystem needs to be registered in IBM Storage Defender Data Resiliency Service user interface as source. Then IBM Storage Defender Data Resiliency Service automatically sends an integration request to IBM Storage Insights Pro .
  5. To complete the integration, the request needs to be approved by the user within IBM Storage Insights Pro.
  6. IBM Storage Defender correlates the information that is received from the storage system to recovery groups.
  7. When the IBM FlashCore Module detects an anomaly for block level data operations, a case is opened for the related recovery group.
  8. Depending on your notification settings you are notified about the new case.

For more information about integrating IBM Storage Defender with IBM Storage FlashSystem as a source, see Adding sources.