Setting Up CTERA Ransom Protect

2 Minutes to read

Article summary

Did you find this summary helpful?

Thank you for your feedback

Note

To prevent false positive events, CTERA recommends initially enabling CTERA Ransom Protect in Ransomware Detection mode. In this mode, CTERA Ransom Protect only monitors the traffic without blocking malicious users. After the system has proven to work well for a while, you can then enable Ransomware mitigation. If you encounter false positives, refer to Coping with False Positive Detections for guidance.

To enable Ransom Protect:

In the Configuration view, select Security > Ransom Protect in the navigation pane.
The Ransom Protect page is displayed.
Click Settings.
The Ransom Protect Settings window is displayed.
Check Ransomware Detection.
Leave the Advanced settings with the default values unless you encounter too many false positives. If this happens, see Coping with False Positive Detections to resolve the issue.
Note
The advanced settings default values are based on extensive testing but can be tuned if needed.
- Detection Threshold is the number of suspicious events that must occur before ransomware protection is triggered. If the threshold is set too high, an attack could cause more damage than necessary or may go undetected. On the other hand, if it's set too low, the number of false positive detections may increase.
- Detection Interval is the number of seconds between checks on user behavior records for potential attacks. Choosing a lower value leads to quicker ransomware detection, but it may also increase CPU load.
Click Save.

CTERA Ransom Protect is active.

Note

To disable CTERA Ransom Protect, click Settings in the Ransom Protect page and uncheck Ransomware Detection and then click Save.

Coping with False Positive Detections

If you find that you are getting too many false positive results, you can reduce this number by Tuning the Detection Threshold or Excluding Specific Users From Detection.

Tuning the Detection Threshold

The Detection Threshold is the number of suspicious events that must occur before ransomware protection is triggered. To reduce the detection sensitivity, and as a consequence, the number of false positive results, you can increase the value of Detection Threshold.

Excluding Specific Users From Detection

If you get false positive results for specific users, you might find that some users perform actions that are acceptable within the organization but would trigger a false positive result. You can exclude these users from having their actions checked by CTERA Ransom Protect.

To exclude users from ransomware detection:

In the Configuration view, select Security > Ransom Protect in the navigation pane.
The Ransom Protect page is displayed.
Click the number below Exclude Users.
The Specify Group Name window is displayed.
Click Next.
The Select Group Members window is displayed.
Select the user to exclude from ransomware detection.
1. Select Local Users, Domain domainName Users, or Domain domainName Groups.
2. In the Quick Search box start entering the name of the user or group to exclude or click ... and select the user from the list.
Click Next.
The Wizard Completed window is displayed.
Click Finish.

The user is excluded from ransomware detection.

A user that has been excluded from being detected can be removed from the excluded group (for example if the user leaves the organization).

To remove a used from the Excluded Users group:

In the Configuration view, select Security > Ransom Protect in the navigation pane.
The Ransom Protect page is displayed.
Click the number below Exclude Users.
The Specify Group Name window is displayed.
Click Next.
The Select Group Members window is displayed.
Select Local Users, Domain domainName Users, or Domain domainName Groups and click the icon next to the user to remove from the list.
The user is removed from the exclude list.

Was this article helpful?

What's Next

Blocking Malicious Users

Table of contents

Coping with False Positive Detections