Configure Ransomware Detection

Available for Amazon EC2, Amazon RDS, Amazon S3, Azure Database for PostgreSQL flexible server, Azure Storage Accounts, Azure Virtual Machines, SQL Server on Azure VMs, Google Cloud SQL, and Google Compute Engine.

Who can use this feature

Anyone with these permissions: Manage threat detection plan (Cloud workloads, SaaS applications)

You can assign resources to ransomware detection by backup policy, resource properties, or a combination of the two. This article covers how to assign resources to ransomware detection.

When assigning backup policies to ransomware detection, any resources covered by the assigned policies are automatically assigned to ransomware detection.

You can also choose to assign resources by resource properties. This allows you to conditionally assign resources to ransomware detection based on their attributes, and to manually include or exclude specific resources by their IDs.

You can assign resources using one or both methods. If you use both methods, each method is evaluated independently, and the union of resources is assigned to ransomware detection. In other words, resources assigned by backup policy are always included in ransomware detection, even if they’re excluded by your Assign by resource properties.

Eon can detect ransomware on resources that are backed up by Eon. While Eon doesn’t require a clean baseline snapshot to detect ransomware, it works best when there is at least one clean snapshot first. This gives Eon a reliable comparison for subsequent snapshots.

Eligible resource statuses are Protected, All violations muted, Violations detected, and Action required. Resources that haven’t been backed up by Eon or have any other status are ineligible for ransomware detection.

Assign resources by backup policy

To get started, go to the Ransomware detection page in your project’s backup settings.

In Assign by backup policy, click Choose backup policies. A dialog opens with a list of your backup policies.
Select the backup policies whose resources you want to monitor for ransomware.
Save.

Resources backed up by the selected backup policies are now monitored for ransomware.

Assign resources by ID or other properties

Assigning resources in this way is done in two parts. First, you’ll choose whether you want to include all resources, include only resources that meet certain conditions, or exclude all resources. You can then optionally choose to override the specific resources by including or excluding them by their resource IDs.

Details on how to do this are covered in this procedure.

To get started, go to the Ransomware detection page in your project’s backup settings. In Assign by resource properties, click Create Conditions to open the resource selection dialog.

Choose the dynamic resource selection method

In Dynamic resource selection, choose the default behavior for including resources in ransomware detection:

Include all: All supported resources are included in ransomware detection by default.
Use conditions: Only the resources that match the conditions you set are included in the ransomware detection by default. If new resources that meet the conditions are discovered, they’re also included.

You can set a simple AND or OR list of conditions, or you can group conditions for fine-tuned targeting of resources. See Work with conditions and Work with groups below for how to work with these options.

For an explanation of conditions, see Conditions in About Backup Policies.
Exclude all: No additional resources are included in the ransomware detection by default. Using this option means that you’ll need to assign resources with manual overrides.

Work with conditions

To add a condition: Click (Add condition), then select the property, operator, and value for the condition.
To add a condition within a group: Click the large (Add condition) button in the group, or select (Add condition) > Add condition > Above or Below. Then select the property, operator, and value for the condition.
To delete a condition: Click the condition’s (Actions) menu, then click Delete condition.

Work with groups

To nest an existing condition or group in a group: In an existing condition or group, click (Actions) > Create group. Select the group’s logical AND or OR operator.
To delete a group and all the conditions it contains: Click the group’s (Actions) menu, then click Delete group.

Set manual overrides

Once you’ve made your dynamic selection, you can optionally override the selection with specific resources by their IDs:

To include specific resources: In Included resources, click , then select the resources you want to include. The selected resources will be monitored for ransomware.
To exclude specific resources: In Excluded resources, click , then select the resources you want to exclude. The selected resources won’t be monitored for ransomware.

If a resource is in both lists, exclusion takes precedence.

Excluding resources here doesn’t remove them from ransomware detection entirely. Instead, you’re excluding them from the dynamic selection only. They may still be monitored if they’re covered by a backup policy that’s assigned to ransomware detection. To exclude a resource from ransomware detection entirely, see Manage ransomware detection exclusion below.

Save

Click Save Changes.

The resources that match your selections are now monitored for ransomware.

Manage ransomware detection exclusion

You can exclude resources from ransomware detection at any time. Doing this prevents Eon from monitoring the resource for ransomware and reporting it as infected.

To exclude a resource from ransomware detection:

Find the resource in your inventory, and click its name to open its details panel.
In the Resource details panel, find Backup details > Ransomware detection, and click (Actions) > Exclude from ransomware detection
Confirm.

The resource is excluded from ransomware detection.

You can cancel the exclusion at any time by clicking (Actions) > Cancel exclusion in the resource’s details panel. When canceling a ransomware detection exclusion, the resource is monitored for ransomware again as long as it’s assigned to ransomware detection by backup policy or resource properties.