Threat Detection for Databases

Threat Detection for Databases identifies anomalous activity in protected database backups that might indicate ransomware or other malicious activity. The feature uses a multi-signal detection framework to correlate multiple indicators of compromise and identify suspicious activity.

Threat Detection continuously analyzes backup metadata, workload behavior, and entropy-based indicators to identify potential threats. As additional detection methods become available, they are incorporated into the detection framework.

Threat Detection includes the following capabilities:

• Anomalous activity detection

• AI and ML-based detection

• Entropy-based detection

Anomalous Activity Detection

Anomalous activity identifies unusual backup and workload behavior that might indicate ransomware or other malicious activity. Examples include abrupt changes in backup data volume or unexpected workload behavior.

AI and ML Analytics-Based Detection

AI and ML analytics continuously evaluate backup metadata and behavioral trends to identify activity that might indicate ransomware.

Entropy-Based Detection

Threat Detection uses the Commvault deduplication engine to identify encrypted or high-entropy data patterns that might indicate ransomware activity.

Supported Workloads

Threat Detection for Databases currently supports the following database workloads:

• BigQuery

• PostgreSQL

Monitor Threats

Use the Anomalies dashboard to monitor detected anomalies across protected database workloads and investigate potential threats.

Summary Support Matrix