Transcript
are becoming more sophisticated, leveraging automation and AI to bypass defenses, move laterally, and risk operational continuity and brand integrity. The challenge? Staying resilient when your data may already be compromised. Without unified intelligence and collaboration, threats can persist undetected, contaminating recovery points, and eroding trust in your ability to bounce back from an attack. Fragmented tools, hybrid sprawl, and endless alerts add complexity, risking delays in recovery. In this demo, you'll see how Commvault's threat detection and response platform empowers your team too. Rapidly detect ransomware and suspicious file activity. Leverage a unified threat detection dashboard that correlates signals, assigns risk, and helps you prioritize response. Simplify integration with your security ecosystem, including security information and event management and threat intelligence partners. Simplify complex threat data with Arli, our AI assistant. Restore clean, uncompromised data using synthetic recovery and clean room validation. Let's see what a real-world scenario looks like. You're on a virtual machine server and open what should be a simple PDF report, but it's locked. The file has been encrypted. Your security team has already neutralized the threat, but now you need to recover your data. The issue is, if you recover your latest data, will it restore the encrypted versions instead? If you perform a full recovery, could you reinfect your environment by restoring threats? How can you identify clean data while quarantining threats so you can restore your system effectively within the timeframes your organization requires? Fortunately, this system is protected by Commvault. Our automated threat scanning makes it simple to identify safe recovery points. Let's see how the platform responds. This is the Commvault Threat Detection Dashboard, your central hub for recovery readiness. It analyzes protected data in the background using multiple threat intelligence tool sets. On the left, you see all correlated signals, including anomalies, encryption alerts, malware alerts, and partner integrated signals. The resources are assigned a risk level, making it easier for you to determine which should be prioritized, helping you make faster, more informed decisions. On the right, you see outcomes, how many files are verified clean, which have been quarantined, and what's already been resolved. This makes it simple to see what's wrong, what's been handled, and what needs attention. This dashboard also makes operational tasks easier. If malware scanning isn't enabled, you can activate it right here. For slow or failed scans, change settings quickly, everything, from threat response to performance tuning, is unified in one view. Now, let's look at what the system found. You can see that several resources are flagged as critical, malware detected. Others are high risk, with multiple anomalies and threat signals. These signals are automatically sent to your SIEM, like CrowdStrike NextGen, so your security analysts can respond immediately. Here, in the CrowdStrike NextGen SIEM view, you can see Commvault signals integrated alongside product alerts. One shows sensitive data exposure, and another highlights an anomaly event. Security analysts can now investigate and respond, armed with context from their standard threat intelligence platforms and backup environments. This helps bridge the gap between backup and security operations, reducing the need for manual data sharing and context switching. Let's return to the Commvault platform. To achieve a clean recovery, you'll begin by investigating. Since Commvault detected suspicious activity, let's drill into the critical resources to understand what's happening. You're now viewing a list of critical resources that all require attention. You can quickly see the signals detected by clicking on each number within the columns. Anomalies indicate various changes in the backup using machine learning. Partner signals are indicators of attacks detected on the resource through partner integrations like CrowdStrike. Threats refer to malware and encryption detection, using a combination of built-in threat intelligence, AI encryption models, and SOC analyst tools like Yara and Hash on the resource. You can explore each of these items more thoroughly as you delve deeper, helping you understand root causes and take targeted action. Notice the pattern. Backup size spikes, unusual file activity, and mismatched file extensions. Some malware and encryption were detected, and we have partner signals as well. These aren't random events. They're digital breadcrumbs left by a possible ransomware infection. From the action panel, you can mark resources as safe, disable data aging, or perform threat hunting. Before you select Restore and experience how you can achieve a clean recovery, let's first examine the details of the threats on the system. When you click on a resource, you'll see detailed information about the threats detected on that specific system. The Overview tab displays a complete history of threat activity, indicating when anomalies and threat signals were detected throughout the entire lifecycle of your data protection environment. You can easily identify trends and patterns over time, providing a clear view of how the system's risk posture has evolved. The Timeline view in the Overview tab consolidates all this information, presenting anomalies and signals detected over time. Clicking the RLE button activates AI-generated summaries and recommendations. This helps you interpret the data, understand its impact, and confidently decide on your next steps. RLE effectively consolidates all threat information and offers simple instructions for action, translating complex threat data into clear, actionable steps, making it easier to respond effectively. Now let's explore the details further. The Anomaly tab breaks things down into four main categories. Each one tells part of the story. Backup size anomalies, file activity anomalies, file type, MIME mismatches, extension changes. These anomalies serve as early warning signals. On their own, they're clues. But when combined with Commvault's deeper scanning, they uncover the full extent of the threat before it spreads. Now let's click on the Threats tab and select a threat to view its details. Commvault's Threat Detection Platform performs both background and on-demand analysis using signature, heuristic, and machine learning engines to identify both known and unknown threats. Our AI models intelligently distinguish between legitimate encryption activities and ransomware and can accurately predict file encryption. By embedding hash and Yara rules into the scanning process, Commvault equips SOC analysts with tools to detect both known and unknown threats, enabling them to be contained within backups and supporting clean recovery. This helps you stay ahead of evolving threats, supporting proactive risk management. Clicking on the threat provides more details helpful for investigation. Arli, our AI assistant, offers clear, actionable insights into each threat, explaining what it is, how it behaves, and the next steps to take. Finally, let's look at partner signals, the ones we mentioned earlier. Commvault ingests signals from partners like CrowdStrike, Netscope, and Darktrace, mapping XDR, EDR, and NDR insights directly to your protected data. Ingesting signals from our security partners is an excellent way to identify indicators of attack. IOAs are patterns or behaviors indicating an active attempt to compromise a system or gain unauthorized access. This means you gain early visibility into potential threats. Now, let's perform a clean recovery. Return to the resource screen and click on Actions. You can choose to run a threat hunt operation or a restore test in the clean room to verify that your backups are safe before restoring anything back into production. Click Restore to start restoring the system cleanly. Commvault offers three recovery options. Manual recovery offers a calendar view for identifying clean points. You can easily see which recovery points are marked as infected with threats, select a clean one, and recover. Synthetic recovery retrieves the previous clean files from all available backups to minimize rollback and provide a clean recovery. Forensic recovery, select this option to recover infected data to a clean room for forensic analysis by your security team. Let's choose the recommended option. Synthetic recovery uses automated threat detection and data integrity validation to generate a clean, synthesized restore point from multiple backups, removing malicious payloads and minimizing rollback during recovery. Next, you can choose the recovery destination that best fits your operational or security requirements. In-place recovery restores validated data directly back to the original source system, ideal for rapid recovery scenarios where the source environment has been verified, clean, and secure. Out-of-place recovery restores data to an alternate target location. This option is commonly used for validation testing, staging, or when the primary source remains under investigation. Clean room recovery stages data within the Commvault clean room, an isolated recovery environment designed for post-recovery validation and threat analysis. For this scenario, we'll choose clean room recovery. This isolates the restored data from production, allowing you to perform automated and manual validation checks to confirm data integrity and verify it is free from malware or compromise before reintroducing it into the operational environment, giving you confidence that your recovery is both clean and business-ready. Once the restoration is complete, we can return to our virtual machine server and verify that the PDFs are no longer encrypted. Commvault provides unified visibility and automated threat detection across your backup and recovery environment. Our AI-enabled platform helps you quickly identify and isolate risks, accelerate investigation, and restore clean data with confidence. By integrating with your security ecosystem and enabling clean room validation, Commvault provides rapid, clean recovery so your business can become more resilient.
