Configure the NetApp Autonomous Ransomware Protection integration

Configure the NetApp Autonomous Ransomware Protection (ARP) integration to receive ransomware events from NetApp ONTAP and automatically start the Commvault response workflow. This procedure configures the NetApp environment, establishes mutual TLS (mTLS) authentication, creates the webhook connection between NetApp ONTAP and Commvault, validates the connection, and configures the workflow that processes ARP events.

Configure the NetApp environment

Complete the following tasks before configuring the webhook integration.

Configure the NetApp cluster in Commvault

1. Add the NetApp cluster as a client in Commvault by using the required credentials.

Use Commvault version 11.46.10 or later.

1. On the NetApp cluster client, verify that the Storage Virtual Machines (SVMs) are automatically discovered.

2. Configure subclients under the appropriate SVMs, not under the cluster client.

3. Configure subclients by using share paths, not raw volume paths.

4. Verify that the mount path for each volume matches the volume name.

   If the mount path and volume name do not match, backups can fail.

If SVMs do not appear in the Files view:

1. From the Command Center navigation pane, go to Manage > Infrastructure > Servers.

2. Select the SVM.

3. Click Maintenance > Reconfigure.

4. After the SVM appears in the Files view, configure the required subclients.

Note: Subclients must use share paths instead of volume paths. If the configured share paths and volume paths do not match, backups fail. In the NetApp cluster configuration, the mount path for a volume must match the volume name.

Enable NetApp Autonomous Ransomware Protection

1. Enable Autonomous Ransomware Protection (ARP) on every volume that you want Commvault to monitor.

Configure email notifications

1. Configure an SMTP server in Commvault.

2. From Manage > CommCell > Email settings, configure email notifications.

The workflow uses the configured email server to send approval notifications and summary email notifications.

Configure mutual TLS

The webhook integration uses mutual TLS (mTLS) authentication between NetApp ONTAP and the Commvault Command Center web service.

Gather the required certificates

Obtain the following certificates before you begin.

• A Certificate Authority (CA) root certificate. For instructions, see Creating a CA-Signed Certificate for the Tomcat Server

The CA certificate must be available in:

• PEM format for ONTAP.

• CER or CRT format for the Commvault Tomcat server.

• A client certificate and private key for the ONTAP client in PEM format.

The client certificate that you register for a Commvault user can be in PEM or PFX format.

Configure the Tomcat SSL certificate

1. Configure the HTTPS certificate for the Commvault Tomcat server.

For instructions, see Configure the SSL certificate for the Tomcat server.

Configure client certificate verification

1. Open an elevated Command Prompt.

2. Change to the Commvault Base directory.

3. Run the following command:

   cvCertTool.cmd -trustcert-filename "path_to_ca_certificate" configure-client-verification

   Example:

   cvCertTool.cmd -trustcert-filename "E:\MTLS\crt\ca.crt" configure-client-verification
   

The tool automatically performs the following actions:

• Creates a Tomcat truststore.

• Imports the CA certificate into the truststore.

• Updates the Tomcat HTTPS configuration.

• Enables client certificate verification.

• Configures the Tomcat truststore.

Verify that the command completes successfully.

CvCertTool exiting with code SUCCESS(0)

Install the CA certificate

1. Install the CA certificate in the Windows Trusted Root Certification Authorities certificate store on the Command Center server.

For instructions, see Trusted Root Certification Authorities Certificate Store.

Register the client certificate

1. Authenticate to Commvault and obtain an authentication token.

2. Register the client certificate for the Commvault user by sending the following REST API request:

curl -k -X PUT "https://commvault-host/commandcenter/api/User/userId/clientcertificate" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Authtoken: login-authToken" \
  -d "{
    \"certificateName\": \"netapp-ontap-client-cert\",
    \"certificateType\": \"PEM\",
    \"certificateData\": \"-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----\"
  }"

The request registers the certificate for the authenticated user and enables certificate validation for subsequent Event/NetApp API calls.

Configure the webhook

After you configure mutual TLS, configure the webhook destination in NetApp ONTAP.

Prepare the webhook configuration

1. Add the required certificates to ONTAP.

For instructions, see the NetApp documentation.

Create the event filter

1. In NetApp ONTAP System Manager, go to Notifications management.

2. Go to Event filters and create a new filter.

Configure the following include rule.

Configure the following exclude rule.

Create the webhook destination

1. Go to Event destinations and click Add.

2. Configure the endpoint URL.

   https://Hostname/commandcenter/api/Event/NetApp

3. Configure the webhook to use the event filter.

4. Enable client certificate authentication.

5. Select the client certificate that you configured earlier.

Validate the webhook connection

Verify that mutual TLS communication between NetApp ONTAP and Commvault is working correctly.

1. Run the following command:

   curl -k -u username:password "https://cluster-IP/api/support/ems/destinations/Webhook_name?fields=connectivity"

   Example:

   curl -k -u mockadmin:password "https://192.0.2.10/api/support/ems/destinations/Mock_mTLSWebhook?fields=connectivity"
   

2. Verify that the response contains "state": "success".

   A successful response is similar to the following:

   {
     "name": "Mock_mTLSWebhook",
     "connectivity": {
       "state": "success"
     },
     "_links": {
       "self": {
         "href": "/api/support/ems/destinations/Mock_mTLSWebhook"
       }
     }
   }
   

Configure the Commvault workflows

The NetApp Autonomous Ransomware Protection integration uses Store alert definitions and workflows to receive webhook events and automate the response.

Import the required Store artifacts

Import the following workflows from the Store before you configure the alert definition.

Configure the alert definition

Configure the alert definition to invoke the NetApp ARP response workflow.

1. Open Command Center.

2. Create an alert definition.

3. Set the alert type to Notify NetApp Event.

4. Set the notification type to Workflow.

5. Select the NetAppARPEventsResponse workflow.

6. In the workflow input field, enter the following token so that the event table data is passed to the workflow.

<TABLE DATA>

The workflow starts automatically whenever Commvault receives a NetApp ARP webhook event.