---
title: "Handling a Ransomware Incident"
slug: "handling-a-ransomware-incident-1-1-1-1-1"
tags: ["Edge Filer", "Gateway", "Filer", "7.13"]
updated: 2026-05-14T11:35:57Z
published: 2026-05-14T11:35:57Z
canonical: "kb.ctera.com/handling-a-ransomware-incident-1-1-1-1-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Handling a Ransomware Incident

If a ransomware attack is identified by CTERA Ransom Protect, the following occurs:

- The **Ransom Protect** page displays the analyzed events over time and the status changes from **Active** to **Alert**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-XJWP8V4T.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A44%3A01Z&se=2026-11-11T05%3A44%3A01Z&sr=c&sp=r&sig=lqysunhOccMPCqLfn30eksZOyEeDKOQLWozEldgE114%3D)
- If **Block Malicious Users** is checked in the **Ransom Protect Settings** window, the user who initiated the suspected attack is added to the **Blocked Users** group.

An email is sent to the administrator by the edge filer describing the attack.

**Note**

The alert status is displayed for one hour.

## Recovering From a Ransomware Attack

Once a ransomware attack has been identified, every affected file is listed. You can then go through the list and rollback the affected files to the state immediately prior to the attack. For details, see [Accessing Previous File Versions](/v1/docs/accessing-previous-file-versions-5-1-1-1-1)

You display the list of affected files by clicking **Details** to the right of the attack details.

The **Incident Details** page is displayed. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-JCIM9YX4.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A44%3A01Z&se=2026-11-11T05%3A44%3A01Z&sr=c&sp=r&sig=lqysunhOccMPCqLfn30eksZOyEeDKOQLWozEldgE114%3D) The top part of the **Incident Details** report provides the following information about the incident: **Start Time** – The date and time that the suspected ransomware attack started. **Username** – The name of the user that initiated the suspected attack. **IP Address** – The IP address from where the attack was initiated. **Detection Threshold** – A number between zero and one that is used to determine the detection sensitivity. **Detection Engine** – Either the behavioral engine or the honeypot engine.

| Behavioral Engine | Honeypot Engine |
| --- | --- |
| ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-2O22YWWM.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A44%3A01Z&se=2026-11-11T05%3A44%3A01Z&sr=c&sp=r&sig=lqysunhOccMPCqLfn30eksZOyEeDKOQLWozEldgE114%3D) | ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-0JOG5LIE.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A44%3A01Z&se=2026-11-11T05%3A44%3A01Z&sr=c&sp=r&sig=lqysunhOccMPCqLfn30eksZOyEeDKOQLWozEldgE114%3D) |

The second part of the **Incident Details** report provides detailed information about each operation: **Time** – The date and time that the suspect operation started. **Operation** – The operation that is suspected of being a ransomware attack. **Source Path** – The full path and file name of the file that the suspected attack affected. **Destination Path** – If the file was moved, the full path and file name of the destination.

**To export the incident details report to Microsoft Excel:**

1. Access the **Incident Details** page for the ransomware incident.
2. Click **Export to Excel**.

The incident details are exported as an Excel file to your computer.

## Investigating Ransomware Incidents

CTERA is dedicated to providing the best user experience possible and can investigate false positive incidents to better configure CTERA Ransom Protect.

To analyse ransomware incident, send the support report to CTERA support. The support report includes the CTERA Ransom Protect service logs, as well as the incident details report. For details about sending a support report to CTERA Support, see [Generating a Support Report](/v1/docs/generating-a-support-report-5-1-1-1-1).