System Manager信息板显示x个卷存在异常活动、但卷安全选项卡未显示查看可疑文件类型按钮

适用场景

• ONTAP 版本、包含修复版本 CONVA-105971CORTP-105971：无法清除防病毒可疑文件、并且未检测到新扩展名
• 自主  防病毒软件保护(ARP)或防病毒软件(ARW)

问题描述

• System Manager事件部分引发警报、其中x个卷存在异常活动。
• 在 "Storage"(存储)>"Volumes"(卷)>"Security"(安全性)>"Anti-Ransority"( 防反向)下没有[View可疑文件类型]按钮
• 仅基于新文件扩展名检测ARW攻击。

::> security anti-ransomware volume attack-detection-parameters show -vserver svm1 -volume vol1
                       Vserver Name : svm1
                        Volume Name : vol1
       Is Detection Based on High Entropy Data Rate? : true
  Is Detection Based on Never Seen before File Extension? : true
 Never Seen before File Extensions Count Notify Threshold : 20
    Never Seen before File Extensions Duration in Hour : 24

• 威胁较低的卷会报告ARW攻击。

::> security anti-ransomware volume show -vserver svm1 -volume vol1

  Vserver Name: svm1
   Volume Name: vol1
   State: enabled
Dry Run Start Time: -
Attack Probability: low
  Attack Timeline: 4/5/2025 12:06:48
 Number of Attacks: 1

• 在 工作负载行为输出的Newly Observed File Extensions 中未观察到浪涌、也未找到任何条目：

::> security anti-ransomware volume workload-behavior show -vserver svm1 -volume vol1
                     Vserver: svm1
                      Volume: vol1
             File Extensions Observed: log,...
        Number of File Extensions Observed: 433

 Historical Statistics
        High Entropy Data Write Percentage: 57
  High Entropy Data Write Peak Rate (KB/Minute): 298340
        File Create Peak Rate (per Minute): 9
        File Delete Peak Rate (per Minute): 5
        File Rename Peak Rate (per Minute): 3

 Surge Observed
                 Surge Timeline: -
        High Entropy Data Write Percentage: -
  High Entropy Data Write Peak Rate (KB/Minute): -
        File Create Peak Rate (per Minute): -
        File Delete Peak Rate (per Minute): -
        File Rename Peak Rate (per Minute): -
         Newly Observed File Extensions: -
    Number of Newly Observed File Extensions: -