ONTAP 9.13

Fujitsu ARP includes an initial learning period (also known as “dry run”), in which an ONTAP system learns which file extensions are valid and uses the analyzed data to develop alert profiles. After running ARP in learning mode for enough time to assess workload characteristics, you can switch to active mode and start protecting your data. Beginning with ONTAP 9.13.1, adaptive learning has been added to ARP analytics and the switch from learning mode to active mode is done automatically.

Although you can switch from learning to active mode anytime, a learning period of 30 days is recommended. Switching early might lead to too many false positives. The adaptive learning introduced in ONTAP 9.13.1 might determine that a shorter period is sufficient. In the ONTAP CLI, you can use the security anti-ransomware volume workload-behavior show command to show file extensions detected to date. It is recommended that you not use this tool to shorten the learning period.

In active mode, if a file extension is flagged as abnormal, but then you evaluate it and mark it as a false positive, the alert profile is updated so that the extension is not flagged as abnormal in future alerts.

To manage this feature in the ONTAP CLI, you can use the security anti-ransomware volume command. You can also use the volume modify command with the -anti-ransomware parameter.