Multi-Domain Detection with the Zero Trust API

Introduction

Multi-domain detection integrates network-level threat detection (IDS/IPS) with storage-level data protection. When a third-party network security device detects an attack against a critical application server, it can call the Zero Trust API to trigger an immediate critical-path snapshot on the PowerScale cluster storing that server's data — providing an automated recovery point before the attack can spread to storage.

This extends Ransomware Defender's storage-native detection with an early-warning path driven by devices that see network traffic Ransomware Defender does not, such as intrusion detection/prevention systems (IDS/IPS).

Architecture

A third-party network security device (IDS/IPS) detects an attack and calls the Zero Trust API's critical-path snapshot endpoint. Superna Eyeglass creates a job — visible in the Jobs section of the left sidebar — that triggers a snapshot of all configured critical paths. See Critical-Path Snapshot Request Hold-Off Timer for the endpoint used and its rate-limiting behavior.

Supported Third-Party Devices

• Progress Kemp Flowmon

Any device capable of making an authenticated HTTPS POST request to the Zero Trust API can be integrated using the same pattern — this is not limited to the vendor listed above.

Requirements

• A Smart Airgap API feature license.
• Critical-path snapshots configured and enabled in Ransomware Defender — see Critical-Path Snapshots. Critical paths are the target of the snapshot request, whether triggered by a storage-native detection or by an external Smart Airgap API request.

Features

• Network security devices can request an immediate snapshot of all critical paths through the Zero Trust API.
• User lockout requests can be triggered from the same integration, using the affected user's SID or username.
• Detection details passed to Ransomware Defender from the external device — source device name, IP address of the device under attack, and attack type — are intended to become visible in the Ransomware Defender interface in a future release.

Best Practices

• Disable SMB-share snapshot mode to reduce the number of locations where snapshots are created in response to a request.
• Enable critical-path mode and target snapshots specifically at business-critical application data (for example, PACS data or other regulated application data).
• Use the default 1-hour snapshot request hold-off and 4-hour snapshot expiry as a starting point. Increase the snapshot expiry if your SOC needs more time to respond to an incident while still having a valid, unexpired snapshot protecting the data.

Configuration

note

By default, the Zero Trust API honors one critical-path snapshot request per hour, with a 4-hour snapshot expiry. This prevents excessive snapshot creation from repeated or false-positive detections on the network device. See Critical-Path Snapshot Request Hold-Off Timer for how to adjust these defaults.

1. Apply the Smart Airgap API license key using the standard license key procedure to activate the external API for third-party integration.
2. Confirm that critical-path snapshots are enabled and that SMB-share snapshot mode is disabled, per the Best Practices above.
3. Log in to the Eyeglass VM.
4. Open the Eyeglass main menu and select REST API. Generate a new API token and give it a descriptive name (for example, smartairgap). Copy the token.
5. Open the API Explorer, select the Ransomware Defender API section, and select the critical-path route. Use Generate to produce a curl command that requests a critical-path snapshot — this is the request your network security device will call.
6. Configure your network security device (or other IDS/IPS platform) to issue this request as an automated trigger response when it raises a detection.

Example request:

curl -k -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' \
  --header 'api_key: <your-api-token>' \
  'https://<eyeglass-ip>/sera/v2/ransomware/criticalpaths' -d "{}"

Recommendation

Configure this as a trigger response only for high-confidence, critical detections on the network security device, to avoid excessive snapshot requests from lower-severity or noisy alerts.

Integration is not limited to network IDS/IPS devices — email security gateways, endpoint protection consoles, and SIEM platforms capable of issuing an authenticated HTTPS request can trigger the same endpoint.

Use Case: Kemp Flowmon Example

In a validated deployment, a custom script trigger was attached to Kemp Flowmon event severities. When Flowmon detected an SSH brute-force attack against a critical application server under monitoring, the trigger fired the Zero Trust API snapshot request, producing an immediate critical-path snapshot of the affected server's data — before the attack could progress to the storage layer.

See also

• API Guide — Zero Trust API authentication, the critical-path snapshot endpoints, and the request hold-off timer.
• Snapshot Settings — Critical-path snapshot configuration and snapshot budget logic.
• Webhook Configuration — The outbound counterpart to this integration: pushing Data Security events out to external systems, rather than external systems triggering Data Security actions.