# Threat Detection for Databases

Threat Detection for Databases identifies anomalous activity in protected database backups that might indicate ransomware or other malicious activity. The feature uses a multi-signal detection framework to correlate multiple indicators of compromise and identify suspicious activity.

Threat Detection continuously analyzes backup metadata, workload behavior, and entropy-based indicators to identify potential threats. As additional detection methods become available, they are incorporated into the detection framework.

Threat Detection includes the following capabilities:

- Anomalous activity detection

- AI and ML-based detection

- Entropy-based detection

## Anomalous Activity Detection

Anomalous activity identifies unusual backup and workload behavior that might indicate ransomware or other malicious activity. Examples include abrupt changes in backup data volume or unexpected workload behavior.

## AI and ML Analytics-Based Detection

AI and ML analytics continuously evaluate backup metadata and behavioral trends to identify activity that might indicate ransomware.

## Entropy-Based Detection

Threat Detection uses the Commvault deduplication engine to identify encrypted or high-entropy data patterns that might indicate ransomware activity.

## Supported Workloads

Threat Detection for Databases currently supports the following database workloads:

- BigQuery

- PostgreSQL

## Monitor Threats

Use the Anomalies dashboard to monitor detected anomalies across protected database workloads and investigate potential threats.

## Summary Support Matrix

Detection Method | Description
--- | ---
Anomalous activity | Detects unusual backup and workload behavior, including abrupt changes in backup data volume.
AI and ML analytics | Detects anomalous activity by analyzing backup metadata and behavioral trends.
Entropy-based detection | Detects encrypted or high-entropy data patterns using the Commvault deduplication engine.

×

Loading...