Numerous "File Activity Anomaly Alert" emails following upgrade to 11.28.

Looking at the Unusual file activity pages in the Command Center, I see files are flagged across multiple folders from C:\Program Files to C:\Users to C:\Windows.  I thought CommVault might somehow learn to accept the flagged files when I got a File Anomaly email this morning that said there were only 32 files.  When I go into Command Center and navigate to Monitoring > Unusual file activity and look at the server from the email, instead of 32 files I find over 77,000.  I’ve actually opened ticket 220727-508 to get some help cleaning this up.  There’s not much benefit to an email that says there’s 32 questionable files but then getting a list of 77,000 files to dig throiugh.

Ken

Hello there, @Ken_H 

Have you heard anything from Commvault support about this?

We have begun to receive numerous alerts that have been identified as suspicious, and Microsoft SCCM and SSMS files (which, per the customer, are not malicious) are triggering multiple file anomaly warnings.

I'm aware that we can add exclusions using sExcludeExtensions, but we don't want to go that route because we'd end up spending all of our time adding exclusions despite knowing that these are false positives.

One improvement that will soon be available (likely in the October maintenance Release) will be the ability to define the minimum number of suspicious files to trigger MIME classification anomalies.

Keep an eye out for the release notes looking for enhancement 2384.