---
title: "Setting Up CTERA Ransom Protect"
slug: "setting-up-ctera-ransom-protect-1-1"
tags: ["7.11", "Edge Filer", "Gateway", "Filer"]
updated: 2025-11-05T11:37:24Z
published: 2025-11-05T11:37:24Z
canonical: "kb.ctera.com/setting-up-ctera-ransom-protect-1-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting Up CTERA Ransom Protect

You can enable the behavioral engine and the honeypot engine independently of each other.

**To enable Ransom Protect: behavior and honeypot engines:**

1. In the **Configuration** view, select **Security > Ransom Protect** in the navigation pane.  

The **Ransom Protect** page is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-Y8JR6UT9.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
2. Click **Settings**.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-72WLZL18.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
3. To enable setting ransomware protection, slide **Enable Behavioral Detection** on.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-BYBX689T.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
4. The **Detection Threshold** is the number of suspicious events that must occur before ransomware protection is triggered. If the threshold is set too high, an attack could cause more damage than necessary or may go undetected. However, if it is set too low, the number of [false positive detections](/v1/docs/setting-up-ctera-ransom-protect-1-1#coping-with-false-positive-detections) may increase. The default value is based on extensive testing but can be tuned if needed.
5. To enable the honeypot engine, slide **Enable Honeypot Detection** on.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-Q4Y3LGSI.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
6. CTERA recommends leaving the **Advanced** setting with the default 30 seconds **Detection Interval** value. The default value is based on extensive testing but can be tuned if needed. The **Detection Interval** is the number of seconds between checks on user behavior records for potential attacks. Choosing a lower value leads to quicker ransomware detection, but it may also increase CPU load.
7. To enable only the honeypot engine, slide **Enable Behavioral Detection** off.
          **Note**

          

Whether to enable one engine or both is dependent on factors such as the type of the data being protected.
8. If you change the **Directory Name** value for the honeypot, the name must be at least 16 characters long and cannot be more than 20 characters.
9. If you made any changes, click **Save**, otherwise click **Revert** to revert to the last saved configuration.
          **Note**

          

If you make changes to the ransomware settings, you have to restart SAMBA services and a confirmation window is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-P60KZ0NY.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D) Depending on the connectivity, clicking **Confirm** can result in notifications until the services are restarted. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-3RTH4C5M.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)

CTERA Ransom Protect is active.
10. In the **Configuration** view, select **Security > Ransom Protect** in the navigation pane.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-92RAF9AX.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)

          **Notes**

          

To disable CTERA Ransom Protect, click **Settings** in the **Ransom Protect** page and slide both **Enable Behavioral Detection** and **Enable Honeypot Detection** off and then click **Save**. After disabling honeypot detection, all honeypot directories immediately disappear.

## Coping with False Positive Detections

If you find that you are getting too many false positive results, you can [exclude specific users from detection](/v1/docs/setting-up-ctera-ransom-protect-1-1#excluding-specific-users-from-detection).

## Excluding Specific Users From Detection

If you get false positive results for specific users, you might find that some users perform actions that are acceptable within the organization but would trigger a false positive result. You can exclude these users from having their actions checked by CTERA Ransom Protect and these users will not see the honeypot directory, or see it as empty.

**To exclude users from ransomware detection:**

1. In the **Configuration** view, select **Security > Ransom Protect** in the navigation pane.  

The **Ransom Protect** page is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-92RAF9AX.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
2. Click the number below **Exclude Users**.  

The **Specify Group Name** window is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-AZ457EZD.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
3. Click **Next**.  

The **Select Group Members** window is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-QU6781SP.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
4. Select the user to exclude from ransomware detection.
  1. Select **Local Users**, **Domain *domainName* Users**, or **Domain *domainName* Groups**.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-PJ03TCN9.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
  2. In the **Quick Search** box start entering the name of the user or group to exclude or click **...** and select the user from the list.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-BT17YCX8.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
  3. Click **Next**.  

The **Wizard Completed** window is displayed.
  4. Click **Finish**.

The user is excluded from ransomware detection. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-PN9YVK0I.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)

A user that has been excluded from being detected can be removed from the excluded group (for example, if the user leaves the organization).

**To remove a used from the Excluded Users group:**

1. In the **Configuration** view, select **Security > Ransom Protect** in the navigation pane.  

The **Ransom Protect** page is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-PN9YVK0I.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
2. Click the number below **Exclude Users**.  

The **Specify Group Name** window is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-AZ457EZD.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
3. Click **Next**.  

The **Select Group Members** window is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-BT17YCX8.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D)
4. Select **Local Users**, **Domain *domainName* Users**, or **Domain *domainName* Groups** to display the excluded users from that group and click the ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-11LX02HN.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A28%3A45Z&se=2026-11-11T05%3A28%3A45Z&sr=c&sp=r&sig=lLdqnzuCEswBoX56dgZLxgMUlAKmmcSROZLMljaxVrA%3D) icon next to the user to remove from the list.  

The user is removed from the exclude list.