> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Recover from a Threat with AI Assistant

When Eon's threat detection flags ransomware, malware, or data anomalies in your resources, the [Eon AI Assistant][About AI Assistant] takes you from the finding to a restore plan, so you can recover the affected resources without piecing the evidence together yourself.
It changes nothing until you approve the plan it writes.

This article explains how to investigate infected resources with AI Assistant, review its remediation plan, and approve it.
To find and restore infected resources yourself, see [Handle Infected Resources].

## Recover flagged resources

You can start agentic remediation from the

Remediation center

page in the Eon console.

#### Before you start

Remediation restores only EC2 instances and S3 buckets.
Resources of other types can't be remediated with AI Assistant.

#### Investigate the findings

1. Close any open side panel.

   The **Agentic remediation** button is unavailable while another side panel is open.

2. Click **Agentic remediation**.

   AI Assistant opens with a remediation prompt and starts investigating.

   The button is available only when a resource is flagged for ransomware.
   For malware or data anomalies, ask AI Assistant in a chat to build a remediation plan for your infected resources.

AI Assistant finds the resources with ransomware, malware, or data anomaly findings and summarizes the evidence for each one.

#### Review the plan

For each affected resource, AI Assistant finds the most recent clean snapshot and writes a remediation plan in the chat as a proposal.

Check that the plan lists the resources you expect, with the snapshot chosen for each.
Resources shown as excluded with the reason **no restore template** need a template before they're restored.
Choose one from the templates AI Assistant offers. AI Assistant never applies one on its own.

#### Approve the plan

Click **Approve** in the chat.

Where an [action approval rule](/data-protection/account-administration/access-management/action-approvals/about-action-approvals) covers the action, confirming it in the chat submits it for approval rather than starting it.
AI Assistant can't approve the request, and neither can you, because the person who requests an action can't approve it.
The action then waits for your approvers exactly as one you submit yourself does.
Once they've approved it, you can start it from the

My requests page

.
Only you, as the requester, can do that.

Where no rule covers the action, confirming it in the chat starts it.

One run covers up to 500 resources.
If more are flagged, run Agentic remediation again once the first batch is done.
If AI Assistant proposes phases, ask it to continue to move to the next one.

To track the restores once they start, see the

Restore jobs

page.

![Agentic remediation writing a restore plan in the AI Assistant chat, then Approve being clicked.](/_fern-files/eon.docs.buildwithfern.com/b4ea0affdf6dd8144a729c11c2273b6c3e6a86e9255d31885042acd0b183c389/assets/screenshots/ai-assistant/eon-ai-remediation.gif)

## See also

* [About AI Assistant]

* [About Ransomware Detection]

* [Handle Infected Resources]

* [Manage Restore Templates]

* [About Action Approvals]

[About AI Assistant]: /data-protection/integrations/ai-assistant/about-ai-assistant

[About Ransomware Detection]: /data-protection/backup-and-protection/threat-detection/about-ransomware-detection

[Handle Infected Resources]: /data-protection/backup-and-protection/threat-detection/handle-infected-resources

[Manage Restore Templates]: /data-protection/restoring/restore-templates/manage-restore-templates

[About Action Approvals]: /data-protection/account-administration/access-management/action-approvals/about-action-approvals