Creating a New Threat Scan Plan

You can configure a new Threat Scan plan.

Start the Wizard

From the Command Center navigation pane, go to Secure > Threat scan.

The Threat Scan page appears.

The Plans tab shows all existing plans.
Click Create plan at the top of the page.

The Create Threat Scan Plan wizard appears.

Anomaly detection is enabled by default and cannot be disabled. It automatically monitors backup metadata and file attributes to identify suspicious or unusual activity patterns.
For Threat detection, select from the following:
- Encryption detection. Scans backups for encrypted files and ransomware threats.
- Malware detection. Scans backups for known malware signatures to identify threats.
Optional: To upload an IOC hash file, do the following:
1. In the Indicators of Compromise section, under Upload your own files, click Select File.
  
  A file dialog box appears.
2. Browse and select the IOC file. Note the following:
  - Supported file types: YAR and YARA
  - YARA rule format:
```
rule RuleName
{
      meta:
           key1 = "value"
           key2 = "value"

      strings:
           $a = "text string"
           $b = "hex pattern"
           $c = /regex_pattern/

      condition:
           <logical expression>
}
```
  The new file (with a type of YARA Rule Match) will appear in the Indicators of Compromise table.
Select the checkboxes for IOC files you wish to use, and then click Next.

The Storage page appears.

Either select Commvault managed storage, or select Bring your own storage to use your own computing resources to run Threat Scan scans.
If you select Bring your own storage, do the following:
- For Storage, select your storage.
- For Access nodes. Either select an existing access node, or click the Add button and then add a new access node.
Click Next.

The Advanced Options page appears.

To create a schedule for the plan, click the Edit button and then enter criteria for the schedule.
If you enable the Auto scan anomalous resources only option, resources flagged as anomalous are scanned automatically.
Click Submit.