Beginning with ONTAP 9.10.1, you can configure storage VMs (SVMs) such that new volumes are enabled by default for Autonomous Ransomware Protection (ARP) in learning mode.

What you’ll need

The correct license is installed for your ONTAP version.

ONTAP releases License

ONTAP 9.11.1 and later

Anti_ransomware

ONTAP 9.10.1

MT_EK_MGMT (Multi-Tenant Key Management)
Optional but recommended: Beginning in ONTAP 9.13.1, you can enable multi-admin verification (MAV) so that two or more authenticated user admins are required for anti-ransomware operations. Learn more.

ONTAP releases	License
ONTAP 9.11.1 and later	Anti_ransomware
ONTAP 9.10.1	MT_EK_MGMT (Multi-Tenant Key Management)

About this task

New volumes are created by default with ARP in disabled mode, but you can change this setting in ONTAP System Manager and at the CLI. Volumes enabled by default are set to ARP in learning mode. Beginning in ONTAP 9.13.1, adaptive learning has been added to ARP analytics and the switch from learning mode to active mode is done automatically.

Enabling ARP by default for new volumes in an SVM does not automatically enable ARP for existing volumes in that SVM. Learn how to enable ARP in an existing volume.

Autonomous ARP switching from learning to active mode

Beginning in ONTAP 9.13.1, adaptive learning has been added to ARP analytics and the switch from learning mode to active mode is done automatically. The autonomous decision by ARP to automatically switch from learning mode to active mode is based on the configuration settings of the following options:

 -anti-ransomware-auto-switch-minimum-incoming-data-percent
 -anti-ransomware-auto-switch-duration-without-new-file-extension
 -anti-ransomware-auto-switch-minimum-learning-period
 -anti-ransomware-auto-switch-minimum-file-count
 -anti-ransomware-auto-switch-minimum-file-extension

If the criteria for these options is not met after 30 days, the volume automatically switches to ARP active mode.

For more information on ARP configuration options, including default values, see the ONTAP man pages.

Example 1. Steps

ONTAP System Manager

Click Storage > Storage VMs and then select the storage VM that contains volumes you want to protect with ARP.

In the Settings tab, [in the Security section], click pen icon in the Anti-ransomware box, then check the box to enable ARP for NAS volumes. Check the additional box to enable ARP on all eligible NAS volumes in the storage VM.

If you have upgraded to ONTAP 9.13.1, the Switch automatically from learning to active mode after sufficient learning setting is enabled automatically. This allows ARP to determine the optimal learning period interval and automate the switch to active mode. Turn off the setting if you want to manually transition to active mode.

CLI

Modify an existing SVM to enable ARP by default in new volumes:
vserver modify -vserver svm_name -anti-ransomware-default-volume-state dry-run

At the CLI, you can also create a new SVM with ARP enabled by default for new volumes.
vserver create -vserver svm_name -anti-ransomware-default-volume-state dry-run [other parameters as needed]

If you upgraded to ONTAP 9.13.1 or later, adaptive learning is enabled so that the change to active state is done automatically. If you do not want this behavior to be automatically enabled, use the following command:

vserver modify svm_name -anti-ransomware-auto-switch-from-learning-to-enabled false