Skip to main content
Version: 4.4.0

Snapshot Settings

Introduction​

Ransomware Defender can take snapshots automatically when it detects suspicious activity. Snapshot Settings control which containment actions trigger a snapshot and how many snapshots Ransomware Defender is allowed to create before it stops.

Two independent snapshot modes are available:

  • Share Snapshots — snapshots are taken on the SMB shares a detected user has access to, based on AD group permissions. This is useful when most shares grant broad (for example, Everyone Full Control) permissions, since a single detection can otherwise trigger snapshots across many shares.
  • Critical Path Snapshots — snapshots are taken on specific paths you define, regardless of whether the detected user can access that path. Use this to protect applications or critical cluster data that should always be snapshotted on a detection event.

Share Snapshots and Critical Path Snapshots can be enabled independently, and both can be enabled at the same time.

Requirements​

Release 2.5.8 or later.

Considerations​

If Share Snapshots is disabled, the manual "create snapshot" action is also disabled from the event action menu.

Configure Snapshot Modes and Snapshot Quota​

  1. Open the Ransomware Defender view from the Eyeglass UI.
  2. Click the Snapshots tab.
  3. Configure the settings you need:
    • Toggle Enable Share Snapshots off to disable snapshots on user SMB shares detected by AD group permissions.
    • Toggle Enable Critical Path Snapshots on, then click + to add each path that should always receive a snapshot on a detection event.
    • Set the Snapshot Quota to the maximum number of snapshots Ransomware Defender can create. Once the quota is reached, no new snapshots are created until existing snapshots expire — the default expiry is 48 hours, after which quota becomes available again.
  4. Click Submit to save your changes.

Critical path snapshots are taken on the default tenant unless the path is entered in the format tenantName:/path/to/file.

Notes​

If more than one cluster or platform is protected, the snapshot quota applies to each one independently — for example, a quota of 500 allows up to 500 snapshots on one cluster and up to 500 on another. The quota value itself is a single, global setting shared across all platforms.