Frequently Asked Questions

  1. Are all anomalous snapshots tagged?

    No, all snapshots are not tagged. Only snapshots with anomaly strength more than the defined threshold are tagged with a specific name.

  2. Will the tag name automatically update if I change the existing tag name?Yes. All the existing snapshots with the previous label will be relabeled with the new tag name. Also, all new anomalous snapshots with anomaly strength more than the threshold will be tagged with the new tag name.
  3. Are snapshot tags available on on-prem Data Management dashboard?No, anomalous snapshot tags are not available on on-prem Data Management dashboard. Snapshots are not blocked from recovery on on-prem cluster.
  4. Does tagged snapshots prevent future backups?No, anomalous snapshot tags do not prevent future backups of the same job or the same entity.
  5. Is blocking of tagged snapshot recovery also prevented in screens other than Data Management Security Dashboard?Yes, it is blocked from all the screens in the Data Management Dashboard. Even pass-through cluster screens will have tagged snapshot blocked.
  6. Can all users restore from tagged snapshots?No, only users with the Restore from tagged snapshots privilege can restore from tagged snapshots
  7. Can all users add or remove tags from snapshots?No, only users with the Enable or disable snapshot tagging feature privilege can add or remove a tag.
  8. Do all users have the Settings icon in the Objects with Anomalous Snapshots section?

    No, only users with administrative privileges have the Settings icon in the Objects with Anomalous Snapshots section.

  9. Can a user log in to the Data Management Dashboard and restore a snapshot that is tagged in Data Management?

    Yes, users can log in to the Data Management Dashboard and restore a snapshot that is tagged in Data Management.

    Workaround: To prevent users from directly restoring tagged snapshots from the Data Management dashboard, you must assign specific roles to users that do not have permission to restore. For example, the Viewer role.
  10. Are all ransomware alerts (CE01516011) triggered because of anomalous snapshots?

    No, all alerts triggered may not be because of anomalous snapshots. There might be some false positives.

    For example, if there is a sudden rise in the data ingestion rate that might be out of the normal range - based on daily and historical rates, Data Management might consider it as a potential ransomware attack. The alert helps the IT administrators and the IBM support team to administer the issue and if required perform a restore from the healthy snapshot.