Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Ransomware Audit Events Required for All Deployments

Introduction​

The required and recommended audit-event lists below (per OneFS version) are the source of truth for what Ransomware Defender and Easy Auditor need to detect activity. If a required event type is missing from your audit configuration, the result is a silent detection gap — events for that type simply aren't audited, with no error raised — so it's worth double-checking your configuration against the lists below after any OneFS upgrade.

This page covers the required audit events for a supported Ransomware Defender deployment. It applies to all OneFS releases. Complete this alongside the audit configuration steps in Storage Platform Agent Configuration — that page covers enabling the audit protocol per access zone; this page covers exactly which event types must be included.

Required audit events for Ransomware Defender​

Ransomware Defender requires the following audit success events enabled on every audited zone, on all supported OneFS releases:

close | create | delete | read | rename | write

Verifying current settings​

To verify current settings on a cluster over SSH:

isi audit settings global view
isi audit setting view --zone=<zone_name>

Repeat the zone-level check for every access zone Data Security monitors.

If you are also licensed for Easy Auditor, its recommended audit event configuration is more granular than the Ransomware Defender minimum above:

  • OneFS 8.2 and later — audit success: close_file_modified, create_directory, create_file, delete_directory, delete_file, get_security_directory, get_security_file, logoff, logon, open_file_noaccess, open_file_read, open_file_write, read_file, rename_directory, rename_file, set_security_directory, set_security_file, write_file
  • OneFS earlier than 8.2 — audit success: close | create | delete | get_security | logoff | logon | read | rename | set_security | write

Reducing ECA processing load​

To reduce ECA processing load without losing ransomware detection coverage, you can bypass select high-volume event subtypes at the ECA layer (rather than at the cluster audit-settings layer) by editing /opt/superna/eca/eca-env-common.conf on each ECA node:

export BYPASSED_EVTARCHIVE_EVENT_TYPES=FILE_CLOSE, CLOSE_FILE_UNMODIFIED, CLOSE_FILE_MODIFIED

Consult Superna support before changing this value — bypassing the wrong event types can create detection gaps.

See also​