Transcript
Hello everyone, my name is Shelley Calhoun-Jones and I'm a Technical Marketing Director here at Cohesity. Our customers are telling us that they need the ability to orchestrate recovery from a wide variety of situations that include data disasters, catastrophic events and cyber attacks. In the context of this demo, I'm an incident responder and I'm currently dealing with an active security event. To address this situation, I plan to secure the system in an isolated space to investigate without the risk of further spread. Additionally, I need a safe and repeatable process to ensure that I can respond quickly. In this demo, we'll explore how organizations can utilize Recovery Agent to set up a digital jump bag and a clean room for incident response. But first, let's set the stage. As an incident responder, I can use recovery groups to accelerate incident response and disaster recovery during a ransomware attack. I can automate workflows without guesswork or miscommunication. It could be a critical workload which requires a quick recovery time objective, like with a CRM application. Or you may have a recovery group for your digital jump bag. Let's take a closer look at how this works. A recovery group can help me coordinate resources and tools to restore systems after a cyber attack or outage. This recovery group acts as my digital jump bag. And if you've ever worked with digital jump bags, you know that it's important not to wait for an actual emergency to use it for the first time. As an incident responder, I need to ensure that our tools are functioning properly. It's also vital that I prepare my team to handle incidents and identify any gaps in readiness. In the configuration section, you'll find options for a threat scan and a rehearsal, along with the ability to set up multiple configurations for testing. And you'll also notice that we have a blueprint. You can think of a blueprint as an automated workflow. It's designed to help bring your systems back online quickly and safely after a ransomware attack. When applied in clean room environments, it can automatically create a safe, isolated space that you can use for investigating and recovering data. And with the digital jump bag, the blueprint can launch ready-to-use virtual tools and configurations, ensuring that my responders have everything they need to conduct their Speaking of which, let's take a look at blueprints and how it helps in automated workflows. You can set up recovery options, dependencies, and automation rules to ensure that incident response happens consistently and efficiently. It's a virtual runbook that you can run once or periodically. In this workflow, you can see that we're performing a threat scan and rehearsal on our digital jump bag. We're also looking to determine if we need to recover a CRM application into our clean room environment. So we're performing a threat scan and rehearsal on different components that represent the application. This gives us a workflow that's threat aware and repeatable. At the end of the workflow, you'll notice that we have a five-minute pause and a teardown from an automation server. If I want to add additional steps, I can click on the ellipsis, choose add new task, and we can add those steps here. Let's take a look at how to run a blueprint. On this screen, you can choose a specific recovery point, which can be helpful if you need to test recovering a snapshot from a specific date range into the clean room environment. For example, we could be looking for an infected snapshot to analyze. For right now, I'll click on submit. I can also monitor from the orchestration activities view and see each completed activity. And if I click on the completed activity, you can see the different tasks that were completed in this workflow. And I can also generate a report for my internal documentation. This really gives a lot of good details here. If you are going in and analyzing snapshots for your clean room, this gives you a list of items that are performed. If it ran into any threat detections, it gives a lot of really good information that you can add to your internal documentation. Another new feature in Recovery Agent is the new Copilot integration, which can help incident responders through standardized workflows. Let's take a look at how we can use Copilot to create a recovery group and blueprint. I'll choose the workload that I want to create a recovery group for, and then confirm that I want to create a blueprint. I can also take a look at the new blueprint and add additional business logic. In this example, you can see that we have a recovery workflow. I can also look at the new blueprint and add additional business logic. For example, I may want to choose to run a threat scan before performing the recovery. And if I click on the recovery group, we can see objects from the end of the recovery group and the NBU workload that will be recovered. This completes the demonstration. We took a look at Cohesity Recovery Agent and how organizations can use it for incident response.
