I’m running 11:28.24 and don’t initially mind if a suspicious file is identified. However if,after due investigation, I am satisfied that the identified file is okay, is there a way of marking to file ‘good’ so that the same suspicious file is not reported over and over again and thus risking the ‘cry wolf’ scenario?
File Activity Anomaly Alert
• Description: A suspicious file
Monitoring Criteria: (Event Code equals to 7:211|7:212|7:293|7:269|14:325|69:52)
Best answer by Remi Sprangers
Hi
As Collin mentioned we don't have the ability to exclude a single file. We can only exclude files based on extension or based on path.
This is the link for sAnomalyFilters, to filter single or multiple paths
Additional Settings Description (commvault.com)
And this is the link for sExcludeExtensions
Additional Settings Description (commvault.com)
In the last description there is typo “To specify multiple paths,” must be “To exclude multiple extensions,”
From 11.28.23 there is also a key available to include certain extensions. Reason for this is that some extensions are hard coded by Commvault and are only updated if Commvault suspect malicious files that needs to be added for detecting, when upgrade to higher Maintenance or Feature release versions.
The key is called: sIncludeExtensions and can be set the same as described with the sExcludeExtensions additional setting.
PS. I requested to have this last key also documented in our documentation.
Hope it helps!!
Kind regards,
Remi
Hello
Is this an alert you are receiving in Commvault or something else like an AV Software? Can you post a screenshot of the alert?
Thank you,
Collin
Hello
Based on that screenshot the File from the alert is not a Commvault file. Additionally, the file type appears to be “.enc” which I would suspect is an encryption file.
It appears the anomaly detection was successful in identifying a genuinely malicious file. I would recommend reaching out to your Security Team to investigate.
Thank you,
Collin
+24There are ways to whitelist, which you could consider putting into place.
Appreciate the feedback. Our Security Team have already investigated this particular file so I now effectively want to stop it generating repeated alerts for the same file going forwards as I am getting swamped with emails. Is there a procedure? Very much appreciated
This .HTA file has been scanned several times by our Security Team and confirm that the file is good to stay. I’ve had to remove the Team from the alerts as the same files are repeatedly identified. Effectively I need some procedure to mark that particular file as ‘good’/ignore.
Monitoring Unusual File Activity - https://documentation.commvault.com/11.26/expert/134333_monitoring_unusual_file_activity.html
Thank you,
Collin
+24
If I call recall correctly this setting is the one that allows you to filter out files file paths from anomaly monitoring https://documentation.commvault.com/additionalsetting/details?name=sAnomalyFilters
Hi
As Collin mentioned we don't have the ability to exclude a single file. We can only exclude files based on extension or based on path.
This is the link for sAnomalyFilters, to filter single or multiple paths
Additional Settings Description (commvault.com)
And this is the link for sExcludeExtensions
Additional Settings Description (commvault.com)
In the last description there is typo “To specify multiple paths,” must be “To exclude multiple extensions,”
From 11.28.23 there is also a key available to include certain extensions. Reason for this is that some extensions are hard coded by Commvault and are only updated if Commvault suspect malicious files that needs to be added for detecting, when upgrade to higher Maintenance or Feature release versions.
The key is called: sIncludeExtensions and can be set the same as described with the sExcludeExtensions additional setting.
PS. I requested to have this last key also documented in our documentation.
Hope it helps!!
Kind regards,
Remi
+24Thanks for the clarification
Hello
Thank you,
Collin
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
