> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Configure Ransomware Detection

You can assign resources to ransomware detection by backup policy, resource properties, or a combination of the two.
This article covers how to assign resources to ransomware detection.

When assigning backup policies to ransomware detection, any resources covered by the assigned policies are automatically assigned to ransomware detection.

You can also choose to assign resources by resource properties.
This allows you to conditionally assign resources to ransomware detection based on their attributes, and to manually include or exclude specific resources by their IDs.

You can assign resources using one or both methods.
If you use both methods, each method is evaluated independently, and the union of resources is assigned to ransomware detection.
In other words, resources assigned by backup policy are always included in ransomware detection, even if they're excluded by your **Assign by resource properties**.

> **Note**
>
> Eon can detect ransomware on resources that are backed up by Eon.
> While Eon doesn't require a clean baseline snapshot to detect ransomware, it works best when there is at least one clean snapshot first.
> This gives Eon a reliable comparison for subsequent snapshots.
>
> Eligible resource statuses are **Protected**, **All violations muted**, **Violations detected**, and **Action required**.
> Resources that haven't been backed up by Eon or have any other status are ineligible for ransomware detection.

## Assign resources by backup policy

To get started, go to the

Ransomware detection

page in your project's backup settings.

1. In **Assign by backup policy**, click **Choose backup policies**.
   A dialog opens with a list of your backup policies.

2. Select the backup policies whose resources you want to monitor for ransomware.

3. Save.

Resources backed up by the selected backup policies are now monitored for ransomware.

## Assign resources by ID or other properties

Assigning resources in this way is done in two parts.
First, you'll choose whether you want to include all resources, include only resources that meet certain conditions, or exclude all resources.
You can then optionally choose to override the specific resources by including or excluding them by their resource IDs.

Details on how to do this are covered in this procedure.

To get started, go to the

Ransomware detection

page in your project's backup settings.
In **Assign by resource properties**, click **Create Conditions** to open the resource selection dialog.

#### Choose the dynamic resource selection method

In **Dynamic resource selection**, choose the default behavior for including resources in ransomware detection:

* **Include all**:
  All supported resources are included in ransomware detection by default.

* **Use conditions**:
  Only the resources that match the conditions you set are included in the ransomware detection by default.
  If new resources that meet the conditions are discovered, they're also included.

  You can set a simple **AND** or **OR** list of conditions, or you can group conditions for fine-tuned targeting of resources.
  See [Work with conditions] and [Work with groups] below for how to work with these options.

  For an explanation of conditions, see [Conditions] in *About Backup Policies*.

* **Exclude all**:
  No additional resources are included in the ransomware detection by default.
  Using this option means that you'll need to assign resources with manual overrides.

[Work with conditions]: #work-with-conditions[Work with groups]: #work-with-groups[Conditions]: /data-protection/backup-and-protection/backup-configuration/backup-policies/about-backup-policies#conditions

#### Work with conditions

* To add a condition: Click  (Add condition), then select the property, operator, and value for the condition.

* To add a condition within a group: Click the large  (Add condition) button in the group, or select  (Add condition) > **Add condition** > **Above** or **Below**.
  Then select the property, operator, and value for the condition.

* To delete a condition: Click the condition's  (Actions) menu, then click **Delete condition**.

#### Work with groups

* To nest an existing condition or group in a group: In an existing condition or group, click  (Actions) > **Create group**.
  Select the group's logical **AND** or **OR** operator.

* To delete a group and all the conditions it contains: Click the group's  (Actions) menu, then click **Delete group**.

#### Set manual overrides

Once you've made your dynamic selection, you can optionally override the selection with specific resources by their IDs:

* To include specific resources:
  In **Included resources**, click   , then select the resources you want to include.
  The selected resources will be monitored for ransomware.

* To exclude specific resources:
  In **Excluded resources**, click   , then select the resources you want to exclude.
  The selected resources won't be monitored for ransomware.

If a resource is in both lists, exclusion takes precedence.

Excluding resources here doesn't remove them from ransomware detection entirely.
Instead, you're excluding them from the dynamic selection only.
They may still be monitored if they're covered by a backup policy that's assigned to ransomware detection.
To exclude a resource from ransomware detection entirely, see [Manage ransomware detection exclusion] below.

[Manage ransomware detection exclusion]: #manage-ransomware-detection-exclusion

#### Save

Click **Save Changes**.

The resources that match your selections are now monitored for ransomware.

## Manage ransomware detection exclusion

You can exclude resources from ransomware detection at any time.
Doing this prevents Eon from monitoring the resource for ransomware and reporting it as infected.

To exclude a resource from ransomware detection:

1. Find the resource in your inventory, and click its name to open its details panel.

2. In the **Resource details** panel, find **Backup details > Ransomware detection**, and click ** (Actions) > Exclude from ransomware detection**

3. Confirm.

The resource is excluded from ransomware detection.

You can cancel the exclusion at any time by clicking ** (Actions) > Cancel exclusion** in the resource's details panel.
When canceling a ransomware detection exclusion, the resource is monitored for ransomware again as long as it's assigned to ransomware detection by backup policy or resource properties.

## See also

* [About Ransomware Detection]

* [Handle Infected Resources]

[About Ransomware Detection]: /data-protection/backup-and-protection/threat-detection/about-ransomware-detection

[Handle Infected Resources]: /data-protection/backup-and-protection/threat-detection/handle-infected-resources