Storage Defender is a solution that provides end-to-end data resiliency. It includes a Dashboard, Management Console, Orchestrator and a Data Resilience services plane that runs data functions such as classification on any underlying data source stored on any infrastructure.

• Backups - Data Protection
• Replication
• High Availability
• Air-gap (logical + physical)
• Immutable copies
• Isolation
• Encryption
• Data reduction rate monitoring
• Anomaly detection for hardware snapshots
• Anomaly and malware detection for virtual machine backups
• Near real-time detection of anomaly and malware for virtual machines
• Primary storage recovery (seconds-minutes)
• Backup recovery (minutes-hour-days)
• Archive recovery (hours-days)
• Snapshot and Immutable Copy management (crash consistent and application consistent)
•  Recovery testing (integration with partner solution)
• Primary storage clean room (integration with partner solution)
• Backup clean room (integration with partner solution)
• Tape and S3 Cloud integration
• IBM Security® Qradar® SIEM integration
• Performance and capacity monitoring (primary)

IBM Storage Defender is a comprehensive, end-to-end solution featuring a multi-layered approach to protect backup data against ransomware, detect threats and rapidly recover from an attack. IBM Storage Defender’s unique immutable architecture ensures that your backup data cannot be encrypted, modified or deleted. Machine learning provides visibility and continuously monitors for any anomalies in your data. Anomaly detection helps you to locate a clean copy of data across your global footprint, including public clouds, to instantly recover and reduce downtime.

IBM Storage Defender allows organizations to meet complex compliance requirements. You can understand if cyber incidents may have exposed sensitive data and triggered compliance actions for GDPR, CCPA, PCI and HIPAA by:

• Accurately identifying sensitive data
• Reducing your compliance exposure with detailed forensics for remediation

Global actionable search allows users to search within unstructured data for PII (personal identifiable information) categories. Users can then input patterns and their variations or file types to scan by using templates. IBM Storage Defender allows the ability to report search results in txt file format or integrate with third-party data visualization or analytics tools.

IBM Storage Defender provides one-stop-shop reporting on the Data Management Service control plane. You have an aggregated view of your deployment regardless of the use case, workload or deployment type (on premises, consumed as a hosted service, or a combination of the two).

The built-in reports are designed to address your top use cases out of the box. You can view an overall summary of your data protection jobs and storage systems or analyze data at the granular level using powerful filtering options. Each report type can help you identify the information you need, such as Failures, Protected and Unprotected Objects, Protection Runs, Recovery and Service Consumption.

Anomaly detection: IBM Storage Defender incorporates anomaly detection capabilities to identify unusual or suspicious activities in your data environment. These anomalies could be indicative of a ransomware attack, such as rapid and unauthorized changes to files.

Audit trails and logging: IBM Storage Defender logs and maintains detailed records of all data management activities. These audit trails can be useful for investigating ransomware incidents, tracking the origin of the attack and identifying affected data.

Monitoring alerts: IBM Storage Defender can generate alerts and notifications when suspicious activities or unauthorized access to backup data are detected. These alerts can trigger investigation and response actions.

Data analytics: IBM Storage Defender can offer data analytics capabilities to analyze data patterns and anomalies, which can assist in identifying ransomware attacks or unusual data behavior.

Rapid data recovery: In the event of a security incident or data breach, quick data recovery is essential for containing the threat and minimizing its impact. IBM Storage Defender’s data backup and recovery capabilities can help you rapidly restore affected data, reducing downtime and minimizing the scope of the incident.

Immutable snapshots: IBM Storage Defender supports immutable backups and snapshots, which protect your data from tampering or deletion. This feature can help contain threats such as ransomware by ensuring that attackers cannot alter or destroy your backup data.

Data segmentation: While the primary function is data management, it can play a role in data segmentation strategies. Proper data segmentation can limit the lateral movement of threats within your network by isolating critical data from other parts of your infrastructure.

Integration with security solutions: IBM Storage Defender can integrate with security solutions and tools that focus on threat containment. For example, it can work with your SIEM or security orchestration tools to automate responses to security incidents and contain threats.

Incident response: IBM can be part of your incident response plan, allowing you to quickly assess the impact of a security incident and initiate the appropriate containment measures, which might involve restoring clean data from backups.

No. But if you need on-prem hardware for the data protect capabilities, IBM now has its own hardware to offer with the IBM Storage Ready Node program for IBM Storage Defender. Click here learn more about Ready Nodes.

No. Because Defender is SaaS, you can see improvements as soon as we roll them out. We will test and validate new capabilities on our back end, so you can feel comfortable that these updates will improve your system.

IBM Storage Defender will provide significant benefits to clients that prioritize cyber resilience and want a holistic solution delivered through a single vendor with simple licensing. The existing Storage Suite does not have full access to all the capabilities that are available through Storage Defender. It also offers license flexibility with the ability to adjust or reallocate RU’s when needed and is being built on a new platform what will continue to evolve and offer new integrations and capabilities.