Overview
Clumio ThreatDetect analyzes each backup of a protected asset and identifies patterns of activity consistent with an attack on the data, such as mass encryption, replacement of files with encrypted copies, destructive deletion, or the appearance of ransom notes. ThreatDetect runs entirely on backup data. Clumio does not install an agent on the asset and does not read from the production workload.
Each analyzed backup receives a verdict. When a verdict indicates an attack, Clumio raises a Possible Threat Detected alert, records the event on the Threats view of the asset, and produces a downloadable verdict summary report describing what was observed. You can review the findings, identify the affected volumes or file systems, choose a clean backup to restore from, and resolve the detection when you have addressed it.
ThreatDetect compares each backup against that asset's own history to find behaviour that is abnormal for it. Because the baseline is specific to each asset, a change that is normal for one asset can still be flagged on another.
Supported asset types:
- Amazon EC2 instances
- Amazon EBS volumes
Supported assets and requirements
| Asset type | Supported | Requirements |
|---|---|---|
| EC2 instance | Yes | Backups of either tier. File-level analysis requires the Standard tier so that file indexing runs on the attached volumes. Lite tier backups are analyzed with block-level analysis only. |
| EBS volume | Yes | Backups of either tier. File-level analysis requires the Standard tier. Lite tier backups are analyzed with block-level analysis only. |
Before you enable ThreatDetect:
- ThreatDetect is a policy option. It applies to every EC2 instance or EBS volume that the policy protects.
- ThreatDetect runs on Clumio backups of either tier. Clumio-managed AWS snapshots are not analyzed.
- Block-level analysis is available for every backup. File-level analysis is available only for SecureVault Standard where the backup includes file indexing.
- ThreatDetect is a metered feature. Usage is reported in the Consumption report under the Security category. Contact your Clumio account team for pricing.
- You need the same role permissions to view the Threats tab as you need to view the asset's backups. Resolving a detection requires permission to manage alerts.
Enable ThreatDetect
ThreatDetect is enabled per policy, under the additional options of the EC2 or EBS backup operation. Once enabled, Clumio analyzes every backup that the policy generates, starting with the next backup.
Enable in a new policy
- Go to Protect > Backup policies and click Create.
- Enter a policy name and select EC2 instances or EBS volumes from the Add asset types list.
- Configure the backup frequency, retention, and backup tier. Select the Standard tier to enable file-level analysis.
- Under Additional options, locate ThreatDetect and turn on Enable.
- Complete the remaining steps and click Add.
Enable in an existing policy
- Go to Protect > Backup policies.
- Click the policy name, then click Edit.
- Select the EC2 or EBS asset type in the policy.
- Under Additional options, locate ThreatDetect and turn on Enable.
- Click Save.
Note
Turning ThreatDetect on or off does not trigger a seeding backup. When you turn it off, Clumio continues to analyze that policy's backups for 30 days and then stops. Existing verdicts and alerts remain on the asset until you resolve them.
View ThreatDetect results
Results are shown on the Threats tab of the asset's details page. Navigate to AWS > Environments > [Account Number] > EC2 Instances > [Instance ID] or AWS > Environments > [Account Number] > EBS Volumes > [EBS Volume ID], and click Threats.
Asset states
| State | Meaning |
|---|---|
| No policy attached | No policy is applied to the asset. Attach a policy with ThreatDetect enabled. |
| ThreatDetect is off | The applied policy does not have ThreatDetect enabled. |
| No analyzed backups yet | ThreatDetect is enabled but no backup has completed since it was turned on. |
| Analyzing backups | Backups are being analyzed, but the asset does not yet have enough history for evaluation. |
| This volume/instance looks clean | The latest backup was analyzed and no threat activity was found. |
| Possible threat detected | At least one attack pattern fired on an unresolved backup. |
Banners
When a threat is detected, banners appear on the Threats tab and at the top of the asset details page showing the number of attacks detected, the first detected time, and the last clean backup time. On the Backups tab, days with a detected (and subsequent) backup are highlighted on the protection history calendar. Banners remain active until the detection is resolved.
Attacks view
The Attacks tab lists each detected attack type with the number of events in which it fired. Select an attack type to see its events.
- Under Detected events, select a Date and then an Event. Each event is one analyzed backup.
- Review the Event detail card. Risk is the ThreatDetect score for the backup, shown as a percentage. Confidence reflects the amount of backup history available for the asset.
- Review the Root cause card. It names the resources that carried the strongest evidence for the attack.
- Review Monitored resources. Each resource is the instance, one of its EBS volumes, or one of the file systems on a volume. Affected resources are marked in red and listed first.
- Expand an affected resource to see its details and time-series charts of the underlying data.
All Metrics view
The All Metrics tab shows every monitored data point for the asset's analyzed backup. Select a resource on the left to see its data. Each chart plots the data across the asset's analyzed backups.
Verdict summary report
For every Detected verdict, Clumio produces a plain-text verdict summary report. Download it from the Threats tab by selecting the event and clicking Download report, or follow the link in the alert or task detail.
The report contains:
- Header. The asset name and identifier, AWS account and region, and the backup time.
- What happened. A plain-language description of what was observed on each affected resource, with the observed values and the asset's normal values.
- Score. The overall ThreatDetect score and confidence.
- Recommended actions. Steps to verify, investigate, and recover.
- Detection details. Each triggered attack type with its supporting evidence.
Note
Verdict summary reports are retained for 90 days after the backup is analyzed. Download the report if you need to keep it longer.
Respond to a detection
When Clumio detects a threat, take the following steps.
1. Verify whether the change was expected
Open the Threats tab, select the event, and review the root cause and the affected resources. Compare the first detected time with any planned activity on the asset, such as a database migration, a bulk data load, or an encryption-at-rest rollout.
2. Restore from a clean backup
If the change was not expected, do not restore from the detected backup or from any later backup. Use the Last clean backup time shown in the banner to choose a recovery point.
3. Resolve the detection
When you have addressed the threat or determined that it was a false positive, resolve it so the alert and banner clear.
- On the Threats tab, click Attacks, select the attack type, then select the date and event.
- Click Actions, then click False positive.
- To resolve every detected event on the asset in one step, click Actions, then click Apply to all similar events.
Note
- Resolution is per backup. If several attack types fired on the same backup, resolving that backup clears all of them. If an attack type fired on several backups, it remains listed until every one of those backups is resolved.
- When an attack type fires, the data from that backup is excluded from the asset's baseline so that the attack does not skew future comparisons. Resolving the detection does not add them back.
Restoring a possibly compromised backup
If you select a backup taken on or after the first detection, Clumio shows a warning across all restore paths. The warning is informational and does not block the restore.
Alerts, tasks, and audit log
Alerts
When a backup is marked as Detected, Clumio raises an alert of type Possible Threat Detected on the asset. The alert includes the ThreatDetect score and a link to the verdict summary report.
The alert remains active until you resolve the detection on the Threats tab or clear the alert from Alerts. Clearing the alert does not resolve the detection. Use the Threats tab to resolve detections so that the asset's status and banner are updated together.
To see all threat alerts, go to Alerts and filter by type Possible Threat Detected. Threat alerts are delivered through the same channels as other Clumio alerts, including email notifications and the alerts API.
Tasks
Each analysis runs as a task of type Threat Detect in the System category. The task is linked to the backup task that triggered it. For a Detected verdict, the task detail includes a link to the verdict summary report. A failed ThreatDetect task does not affect the backup itself.
Audit log
| Action | Category |
|---|---|
| Resolve one event | Threat Detect |
| Resolve all events on an asset | Threat Detect |
| Enable or disable ThreatDetect in a policy | Policy |
Consumption report
ThreatDetect usage appears in the Consumption report under the Security category.
- Go to Reports > Consumption.
- In the usage metric list, select Threat analyzed size. The chart shows the provisioned size of the volumes analyzed, by day or by month.
- To see the share of your credits consumed by ThreatDetect, select the credits or dollars view. The Security series shows the ThreatDetect consumption.
Usage is measured once a day as the total provisioned size of the EBS volumes that have ThreatDetect enabled through an active policy. A volume protected by both an EC2 policy and an EBS policy with ThreatDetect enabled is counted once. When you turn ThreatDetect off, Clumio continues to meter the volumes for 30 days and then stops.
Limitations and considerations
- Clumio-managed AWS snapshots and backups taken before ThreatDetect was enabled are not analyzed.
- Filesystems on volume managers such as LVM and LDM are not supported initially. Block-level analysis can still run on those backups.
- Baselines are kept per asset, per region, and per backup tier. Changing the backup tier or destination region of a policy starts a new baseline for the affected assets.
- Assessment history and verdict summary reports are retained for 90 days.
- The Last clean backup shown in the banner is the most recent backup taken before the first detected backup. If a slow-moving attack was under way before the first detection, review the All Metrics tab for gradual trends before choosing a recovery point.