Configuring Threat Scan from the Service Catalog

You can configure Threat Scan from the Command Center Service Catalog.

Start the Wizard

1. From the Command Center navigation pane, go to Explore > Service catalog.

   The Service Catalog page appears.

2. In the Threat Scan tile, click Configure.

   The Configure Resources page of the Configure Threat Scan wizard appears.

Enter Group Name

1. Enter a Name for the configuration.

2. Click Next.

   The Add Rules page appears.

Add Rules

1. Optional: Create a manual association resource group without adding rules.

   Steps to select resources manually.

   1. Click Skip This Step.

      The Add Resources page appears.

   2. Select one or more resources, and then click Next.

      The Assign Plan page appears. Go to the "Add Plan" section, below.

2. Click Add Rule.

3. For Client scope, select one of the following:

   • Clients in this CommCell

   • Clients of company

     • After selecting this option, select or enter a Company name.

   • Clients of user

     • After selecting this option, select or enter a User name.

   • Clients of user group

     • After selecting this option, select or enter a User group.

4. Click Add rule group

   The Edit associations dialog box appears.

5. Select or enter the criteria for this new rule group.

6. Click Save, and then click Next.

   The Add Resources page appears.

Add Plan

1. Enter a name for the new Threat Scan plan in the Plan name field.

2. Under Plan settings, do the following:

   • The Scheduled scanning frequency is automatically selected. To modify the schedule as per your requirements, click the Schedule Edit button and then edit the schedule.

   • Select the Scan anomalous resources only option to scan only resources with anomalous backup activity.

   • Select the backup storage:

     • Access nodes. Select an existing access node, or click the Add button and then add a new access node.

     • Storage. Select an existing storage pool.

3. Under Detection services, select from the following:

   • Anomaly detection is enabled by default and cannot be disabled. It automatically monitors backup metadata and file attributes to identify suspicious or unusual activity patterns.

   • Threat detection. Enable this option and then select from the following:

     • Encryption detection. Select this to scan backups for encrypted files and ransomware threats.

     • Malware detection. Scans backups for known malware signatures to identify threats.

4. Optional. Under Indicators of Compromise, you can select one or more existing IOCs or upload your own IOC hash file, as follows:

   1. Under Upload your own files, click Select File.

      A file dialog box appears.

   2. Browse and select the IOC file. Note the following:

      • Supported file types: YAR and YARA

      • YARA rule format:

        rule RuleName
        {
             meta:
                  key1 = "value"
                  key2 = "value"
        
             strings:
                  $a = "text string"
                  $b = "hex pattern"
                  $c = /regex_pattern/
        
             condition:
                  <logical expression>
        }
        

        The new file (with a type of YARA Rule Match) will appear in the Indicators of Compromise table.

   3. Select the checkboxes for IOC files you wish to use, and then click Next.

   The Summary page appears.

Onboard the Threat Scan Group

1. Review the summary information.

2. Click Submit.

Next Steps

To configure additional Threat Scan groups, see Configuring a New Threat Scan Group.