NetBackup and Veritas Appliances Hardening Guide

To configure backup anomaly detection settings

1. On the left, click Detection and reporting > Anomaly detection.
2. On the top right, click Anomaly detection settings > Backup anomaly detection settings.
3. Click Edit on the right to configure the following Anomaly detection > Enable anomaly detection activities settings:

   • Enable only for unstructured data - Enables anomaly detection for the following policy types: Standard, MS-Windows, NAS-Data-Protection, and Universal share.

     Note:

     This is the default configuration for fresh NetBackup 10.4 installation.

   • Enable - Enables anomaly detection for all policy types except for the ones that are excluded in the Advanced settings > Disable policy type or specific features for machine learning.

   • Disable - Disables anomaly detection in NetBackup for all workload types.

   • Click Save.

   In the case of NetBackup 10.4 upgrade, the value of the Anomaly detection option is set based on the previous setting.

   • If the option was set to Enable anomaly data collection, detection service, and events in the previous version, the option is set to Enable after the upgrade.

   • If the option was set to a value other than Enable anomaly data collection, detection service, and events in the previous version, the option is set to Disable after the upgrade.

4. Click Edit on the right to configure the Anomaly detection > Enable automatic scan for imported copy setting.

   • On the Enable automatic scan for imported copy pop-up screen, select the Turn on automatic scan for imported copy check box.

     After enabling the scan for imported copy from the web UI, you must do the following configurations in the anomaly_config.conf file:

     [AUTOMATED_MALWARE_SCAN_SETTINGS]

     SCAN_HOST_POOL_NAME=ScanHostPoolName

     ENABLE_ALL_CLIENTS=1

     TRIGGER_SCAN_FOR_LOW_SEVERITY=1

     TRIGGER_SCAN_FOR_MEDIUM_SEVERITY=1

   • Click Save.

5. Select Edit to modify the following Basic Settings:

   • Anomaly detection sensitivity

     Use this setting to increase or decrease the sensitivity with which anomalies are detected. If the sensitivity is low, anomalies are detected based on less number of anomalous events.

     If the sensitivity is high, anomalies are detected based on a large number of anomalous events.

   • Data retention settings

     Use this setting to specify how long you want to retain the anomaly data (in months).

   • Data gathering settings

     Use this setting to specify the time interval (in minutes) after which the anomaly data is gathered for analysis.

   • Anomaly proxy server settings

     Use this setting to specify the NetBackup media server where the anomalies are going to be processed. If not specified, the processing takes place on the primary server.

   • Click Save.

6. Expand the Advanced settings section to configure the following settings:

   • Click Edit on the right to configure the Disable anomaly settings for clients settings.

     Click Save.

   • Click Edit on the right to configure the Disable policy type or specific features for machine learning settings.

     On the pop-up screen, all the policies are listed.

     Use the action menus to disable one or all of the following anomaly features for machine learning for the given policy: Backup files count, Data transferred, Deduplication ratio, Image size, and Total time.

     • Disable all - Use this option to disable all of the anomaly features for machine learning for the given policy.

     • Disable specific features - Use this option to select specific anomaly features that you want to disable for machine learning.

     • Click Save.

   • Click Edit on the right to configure the Suspicious file extension settings.

     • Select the Turn on suspicious file extension detection to enable NetBackup to detect files with suspicious file extensions.

       A malware such as ransomware attacks the data and encrypts it. After the file encryption, the ransomware renames the files with a specific extension such as .lockbit. NetBackup detects such known suspicious file extensions during backups and generates an anomaly.

     • Files with suspicious extensions (in %)

       Select the percentage (1 to 50) of files with suspicious extensions from the Percent drop-down list, which is acceptable in your environment.

       When the percentage of the files with suspicious extensions exceeds this threshold, an anomaly is generated.

   • You can add or remove the suspicious file extensions from the list.

   • Click Save.