ransomware_reports

Creates, updates, deletes, gets or lists a ransomware_reports resource.

Overview

Name	ransomware_reports
Type	Resource
Id	azure.netapp.ransomware_reports

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
clearedCount	integer	The number of cleared suspects identified by the ARP report.
eventTime	string (date-time)	The creation date and time of the report.
provisioningState	string	Azure lifecycle management.
reportedCount	integer	The number of suspects identified by the ARP report.
severity	string	Severity of the Advanced Ransomware Protection (ARP) report. Known values are: "None", "Low", "Moderate", and "High". (None, Low, Moderate, High)
state	string	State of the Advanced Ransomware Protection (ARP) report. Known values are: "Active" and "Resolved". (Active, Resolved)
suspects	array	Suspects identified in an ARP report.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
clearedCount	integer	The number of cleared suspects identified by the ARP report.
eventTime	string (date-time)	The creation date and time of the report.
provisioningState	string	Azure lifecycle management.
reportedCount	integer	The number of suspects identified by the ARP report.
severity	string	Severity of the Advanced Ransomware Protection (ARP) report. Known values are: "None", "Low", "Moderate", and "High". (None, Low, Moderate, High)
state	string	State of the Advanced Ransomware Protection (ARP) report. Known values are: "Active" and "Resolved". (Active, Resolved)
suspects	array	Suspects identified in an ARP report.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, account_name, pool_name, volume_name, ransomware_report_name, subscription_id		Get details of the specified ransomware report (ARP) ARP reports are created with a list of suspected files when it detects any combination of high data entropy, abnormal volume activity with data encryption, and unusual file extensions. ARP creates snapshots named Anti_ransomware_backup when it detects a potential ransomware threat. You can use one of these ARP snapshots or another snapshot of your volume to restore data.
list	select	resource_group_name, account_name, pool_name, volume_name, subscription_id		List all ransomware reports for the volume Returns a list of the Advanced Ransomware Protection (ARP) reports for the volume. ARP reports are created with a list of suspected files when it detects any combination of high data entropy, abnormal volume activity with data encryption, and unusual file extensions. ARP creates snapshots named Anti_ransomware_backup when it detects a potential ransomware threat. You can use one of these ARP snapshots or another snapshot of your volume to restore data".
clear_suspects	exec	resource_group_name, account_name, pool_name, volume_name, ransomware_report_name, subscription_id, resolution, extensions		Clear ransomware suspects for the given Advanced Ransomware Protection report. You should evaluate the report to determine whether the activity is acceptable (false positive) or whether an attack seems malicious. ARP creates snapshots named Anti_ransomware_backup when it detects a potential ransomware threat. You can use one of these ARP snapshots or another snapshot of your volume to restore data",.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
account_name	string	The name of the NetApp account. Required.
pool_name	string	The name of the capacity pool. Required.
ransomware_report_name	string	The name of the ransomware report. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
volume_name	string	The name of the volume. Required.

SELECT examples

get

Get details of the specified ransomware report (ARP) ARP reports are created with a list of suspected files when it detects any combination of high data entropy, abnormal volume activity with data encryption, and unusual file extensions. ARP creates snapshots named Anti_ransomware_backup when it detects a potential ransomware threat. You can use one of these ARP snapshots or another snapshot of your volume to restore data.

SELECT
id,
name,
clearedCount,
eventTime,
provisioningState,
reportedCount,
severity,
state,
suspects,
systemData,
type
FROM azure.netapp.ransomware_reports
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND account_name = '{{ account_name }}' -- required
AND pool_name = '{{ pool_name }}' -- required
AND volume_name = '{{ volume_name }}' -- required
AND ransomware_report_name = '{{ ransomware_report_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

List all ransomware reports for the volume Returns a list of the Advanced Ransomware Protection (ARP) reports for the volume. ARP reports are created with a list of suspected files when it detects any combination of high data entropy, abnormal volume activity with data encryption, and unusual file extensions. ARP creates snapshots named Anti_ransomware_backup when it detects a potential ransomware threat. You can use one of these ARP snapshots or another snapshot of your volume to restore data".

SELECT
id,
name,
clearedCount,
eventTime,
provisioningState,
reportedCount,
severity,
state,
suspects,
systemData,
type
FROM azure.netapp.ransomware_reports
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND account_name = '{{ account_name }}' -- required
AND pool_name = '{{ pool_name }}' -- required
AND volume_name = '{{ volume_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

Lifecycle Methods

clear_suspects

Clear ransomware suspects for the given Advanced Ransomware Protection report. You should evaluate the report to determine whether the activity is acceptable (false positive) or whether an attack seems malicious. ARP creates snapshots named Anti_ransomware_backup when it detects a potential ransomware threat. You can use one of these ARP snapshots or another snapshot of your volume to restore data",.

EXEC azure.netapp.ransomware_reports.clear_suspects 
@resource_group_name='{{ resource_group_name }}' --required, 
@account_name='{{ account_name }}' --required, 
@pool_name='{{ pool_name }}' --required, 
@volume_name='{{ volume_name }}' --required, 
@ransomware_report_name='{{ ransomware_report_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"resolution": "{{ resolution }}", 
"extensions": "{{ extensions }}"
}'
;