commvault.com commvault.com
Solved

File Activity Anomaly Alert

B
Rank
Badge +1

Hİ,

Our security team want to follow file activity anomaly alert on Commvault side.We configured SNMPV3,and they are watching on Arcsight. And they want to configure this in the real time on test server.How can we configure on test server ?

Is there anybody can advise?

 

Regards

 

icon

Best answer by Scott Moseman 25 August 2022, 14:35

View original

10 replies

Onno van den Berg
Rank
Userlevel 7
Badge +19

You will have to configure it via the Commcell console. There is a default alert named "File Activity Anomaly Alert”". You can copy it or alter the existing one and configure SNMP.

 

B
Rank
Badge +1

Hi Onno,

 

Thanks for your reply. Actually, I want to ask how can I alert from the client. I created text document on the Media Server. Then I deleted. The mail didn't come us.

 

Regards,

 

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@barbaros , the conditions of what the anomaly alert triggers from is internal information, though I’ll add @DMCVault to see if he has a test you can use.

https://www.linkedin.com/in/michael-struening
Onno van den Berg
Rank
Userlevel 7
Badge +19

So basically you are looking for a tool that can simulate a pattern which triggers the file activity anomaly alert?

Scott Moseman
Rank
Userlevel 6
Badge +18

So basically you are looking for a tool that can simulate a pattern which triggers the file activity anomaly alert?


Scripts to generate a large number of files are easy to create, if the above statement is true and you’re trying to create a File Anomaly alert manually to test the process?

Thanks,
Scott
 

Commvault Enterprise Success
Onno van den Berg
Rank
Userlevel 7
Badge +19

@Scott Moseman sure this is fairly easy to created but I'm not sure if this will trigger the alert, but you can always give it a shot. 

B
Rank
Badge +1

Hi,

 

@Scott Moseman , @Onno van den Berg  How can I create scripts to generate this? ıf ı managed to create this will be alert still coming? 

 

Regards,

Scott Moseman
Rank
Userlevel 6
Badge +18

 

@Scott Moseman , @Onno van den Berg  How can I create scripts to generate this? ıf ı managed to create this will be alert still coming? 


These are scripts which I have used in labs to create a large amount of files to trigger the anomaly alert.  You will only get the alert once if the anomaly happens once.  It will exist in the Unusual File Anomaly dashboard where you can review the details and clear the alert.

Linux Clients

$ cat create.sh
#!/usr/bin/bash
for i in {000000..100000}
do
echo QWERTY > "file${i}.txt"
done

Windows Clients

> type create.bat
@ECHO ON
for /L %%i in (1,1,100000) do fsutil file createnew file%%i.tmp 4096

Thanks,
Scott
 

Commvault Enterprise Success
B
Rank
Badge +1

Thanks everyone. 

Surendra Nadh Arla
Rank
Badge +1

Is there a way that we can send in individual alerts of a clients those have morethan 2000 files modified or created or deleted or renamed?

Arla

Reply


Terms & ConditionsCookie settings