Threat Indicators - Backup Size Anomalies for File System

The Backup size tab in the Threat Indicators dashboard lists client computers with file system backup size anomalies.

Clicking a client opens the Backup Size Anomalies Report, which allows you to analyze the statistics for that client.

Note

Clients must be running the latest version of indexing.
The backup plan for clients must be configured to use deduplication.
At least 10 incremental backup jobs must be run before the system can automatically detect anomalies.

The following options are available:

To mark the job indicator as non-anomalous, click Clear anomaly.
To recover files from a client that has unusual job activity, click Recover files. For more information, see Performing File System Restores.

Report Description

The Threat Indicators report for file system backup size anomalies includes the Backup Size chart and the Files Backed Up table, described below. To see the Files Backed Up table, click a Job ID in the Backup Size chart.

Backup Size Chart

This chart displays the amount of data written for the last 7 backup jobs, along with a system-defined threshold (dashed line).

The following image is an example of the threat indicators for size-related anomalies chart view:

Threat Indicators report for backup size anomalies

Files Backed Up Table

Click a Job ID in the lower part of the Backup Size chart to populate the Files Backed Up table.

The following table includes descriptions for all columns in the FIles Backed Up table for backup size anomalies.

Column	Description
File Name	The name of the backed up file for the selected Job ID.
Path	The path to the folder that contains the backed up file.
Size	The size of the backed up file.