Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

How to Configure a Dell ECS and Data Protection Use Cases

Introduction​

This page covers how to add an ECS cluster to Eyeglass inventory and license it for Ransomware Defender, plus common ECS data protection use cases. For the audit-side prerequisites shared with PowerScale, see Storage Platform Agent Configuration.

Deployment options​

ECS integration is based on the same ECA deployment used for PowerScale — an existing ECA cluster can be enabled for ECS event processing. Two topologies are supported:

  • Standard ECA deployment — a single ECA cluster processes ECS events directly.
  • Distributed (Mini-ECA) deployment — Mini-ECA nodes collect local web access logs at each ECS site and forward events to a central ECA cluster for processing. See Mini-ECA Installation.

Adding license keys​

  1. Log in to Eyeglass as an administrator.
  2. Open Inventory → License Management.
  3. Retrieve your license keys using the standard license key procedure.
  4. Upload the ECS node license zip file and accept the license terms.
  5. Upload the Ransomware Defender for ECS agent license zip file and accept the license terms.
  6. Reopen Inventory → License Management after the page refreshes.
  7. Open Inventory → Manage Devices.
  8. Under the Ransomware Defender column, locate the ECS cluster(s) and switch the license type to User Licensed. Click Submit.

Adding ECS to Eyeglass inventory​

  1. Before you begin, create the Eyeglass service account on the ECS cluster following the minimum-privileges procedure for your release.

  2. Log in to Eyeglass as an administrator.

  3. Open the Eyeglass main menu (bottom-left of the console) and click Add Managed Device.

  4. Select the ECS tab.

  5. Enter the ECS management IP address, the Eyeglass service account username, and password.

    note

    A recovery service account is required in each namespace that has a bucket you want to protect. Add this service account to each bucket's object access configuration with read and write permissions.

  6. Click Submit, then answer yes or no to add an additional device.

  7. Monitor the inventory collection job in the Jobs icon, under Running Jobs.

  8. Open the Inventory icon to confirm the ECS inventory completed successfully. Expand the entry to verify nodes, namespaces, and storage buckets were discovered.

Configuring Security Guard on ECS​

To configure Security Guard for an ECS cluster, select the ECS network element as the source and enter the target namespace and credentials. If the data network differs from the management network, enter the IP address of a data node (this can be a load balancer IP) — Security Guard uses this address to write its test objects. See Health Check — Security Guard for the full Security Guard configuration and validation workflow, including the dedicated Bucket Object users required for ECS.

Data protection use cases​

The following are common scenarios where ECS-stored data is exposed to ransomware risk. Ransomware Defender for ECS provides alerting and early warning for each, in addition to per-user account lockout to stop encryption in progress:

  • Backup data on ECS — Backup applications storing backup data on ECS are a common target for attackers seeking to destroy backups before an attack, to prevent recovery.
  • Long-term legal hold data — Data retained on ECS for legal compliance is a high-value target, since destroying it can inflict compliance and legal damage beyond the data loss itself.
  • Dell ECS Geo Drive — Geo Drive syncs local PC data to ECS as object-backed storage, mounted as a Windows drive letter. Ransomware on the endpoint can attack Geo Drive data through this mounted drive.
  • Archive data — Long-term enterprise archive data on ECS is often written by server applications using a single user and secret key, potentially exposing petabytes of data to a single compromised credential.

See also​