NetBackup™ Web UI Administrator's Guide

Configure risk engine-based anomaly detection

The NetBackup risk engine detects certain system anomalies in a proactive manner and sends appropriate alerts. It helps you take corrective action before you face any security threat in your environment.

You can configure the following options that the risk engine uses to detect anomalies for the given operations:

Use this option to detect when images are expired in an unusual or a suspicious manner.

By default, a system anomaly is generated when the risk engine detects an unusual or a suspicious image expiration attempt and allows the operation to proceed.

However, for additional security, you can configure multi-person authorization for such image expiration attempts, where an MPA approver needs to approve the operation.

Important notes on the Detect suspicious image expiration option

Select Edit and select the Generate multi-person authorization ticket if images are deleted in a suspicious manner option.

See About multi-person authorization.

See RBAC roles and permissions for multi-person authorization.

Use this option to detect when a user attempts to sign in to the NetBackup web UI at an unusual time. NetBackup identifies deviations in user sign-in patterns, and flags them.

A notification is generated when an unusual user login is detected.

For additional security, you can configure multi-person authorization for such unusual login attempts, where an MPA approver needs to approve the operation.

See Configure multi-person authorization.

Click Edit and use the Place user's sign in on hold and generate multi-person authorization ticket if a user signs in at an unusual time option to enable multi-person authentication.

By default, a system anomaly is generated when the risk engine detects an unusual deletion or update of a policy. An alert is generated and the operation proceeds.

For additional security, you can configure multi-person authorization for such unusual policy update or deletion attempts, where an MPA approver needs to approve the operation.

See Configure multi-person authorization.

Click Edit and use the Generate multi-person authorization ticket if policy is being modified or deleted in an unusual manner option to enable multi-person authorization for the Detect unusual updates to policies type of anomaly.

Use this option to protect critical operations such as modifying global security settings and creating API key. When you select this option, you are required to reautneticate yourself by entering the one-time password that you see in the authenticator application on your smart device before you perform the given critical operations.

Ensure that you have configured multifactor authentication for your user account. If multifactor authentication is not configured, you are not prompted to reauthenticate.

See Configure multifactor authentication for your user account.

Use this option to detect if there is a possible user session hijack by a malicious source.

The risk engine detects if the same user session token is used by another IP address, and sends a maximum of 10 alerts per day.

Select Edit and select the check box to terminate the user session when the risk engine detects that there is a possible session hijack.