Enabling security notifications

Edit online

Enable security notifications if you want the Operations Center to examine client backup data for signs of ransomware infection.

About this task

When security notifications are enabled, the Operations Center compares statistics for client backup sessions to recent history. Because a ransomware attack typically creates encrypted copies of many client files, the following changes in a backup session are considered signs of a possible ransomware infection on the client:
  • A significant increase in the client's backup workload. A significant increase in the workload might indicate that ransomware encrypted many files on the client.
  • A significant decrease in deduplication savings for the client backup. A significant decrease in deduplication savings might indicate a ransomware attack because encrypted files are not deduplicated.

If the Operations Center detects either of the preceding signs of ransomware infection in client backup data, it displays a notification message. The Operations Center cannot determine the causes of significant changes in the backup data, so a security notification does not necessarily mean that the client is infected. Security notifications are displayed in the Operations Center so that you can investigate further, and determine why the statistical anomaly occurred.

Procedure

To enable security notifications, complete the following steps:

  1. On the Operations Center menu bar, hover over the settings icon Settings icon, and select Settings.
  2. On the General page, select the Enable security notifications check box.
  3. Click Save.