Enabling Ransomware Prevention

Prerequisites

• You have enabled premium, WTP, or container edition.

Constraints

• Only premium, WTP, and container editions support ransomware protection.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the page, select a region, and choose Security > Host Security Service.
3. In the navigation pane, choose Prevention > Ransomware Prevention. Click the Protected Servers tab. Click Add Server.

4. In the dialog box that is displayed, select the target system to be protected and configure a protection policy.
   • OS: Select the server system to be protected.
   • Ransomware Prevention: Enable or disable ransomware prevention.
     • Enable:
     • Disable:
   • Policy: Select an existing policy or create a protection policy.
     • Use policy: Select an existing protection policy. For details, see Parameters for selecting an existing policy.

       Table 1 Parameters for selecting an existing policy

       Parameter	Description
       Policy	Select an existing policy.
       Action	Select a ransomware event processing mode supported by the selected protection policy. Report alarm and isolate Report alarm
       Honeypot Protection	After honeypot protection is enabled, the system deploys honeypot files in protected directories and key directories (unless otherwise specified by users). A honeypot file occupies only a few resources and does not affect your server performance. If ransomware prevention is enabled, this function is enabled by default. NOTE: Currently, Linux servers support dynamic generation and deployment of honeypot files. Windows servers support only static deployment of honeypot files.

     • Create new: Create a protection policy on the current page. For details about the parameters, see Parameters for creating a protection policy.

       Table 2 Protection policy parameters

       Parameter	Description	Example Value
       Policy	Policy name	test
       Action	Indicates how an event is handled. Report alarm and isolate Report alarm	Report alarm and isolate
       Honeypot Protection	After honeypot protection is enabled, the system deploys honeypot files in protected directories and key directories (unless otherwise specified by users). A honeypot file occupies only a few resources and does not affect your server performance. If ransomware prevention is enabled, this function is enabled by default. NOTE: Currently, Linux servers support dynamic generation and deployment of honeypot files. Windows servers support only static deployment of honeypot files.	Enabled
       Honeypot File Directories	Protected directories (excluding subdirectories). Separate multiple directories with semicolons (;). You can configure up to 20 directories. This parameter is mandatory for Linux servers and optional for Windows servers.	Linux: /etc/lesuo Windows: C:\Test
       Excluded Directory (Optional)	Directories where honeypot files are not deployed. Separate multiple directories with semicolons (;). You can configure up to 20 excluded directories.	Linux: /test Windows: C:\ProData
       Protected File Type	Types of files to be protected. More than 70 file formats can be protected, including databases, containers, code, certificate keys, and backups. This parameter is mandatory for Linux servers only.	Select all

5. Click Next and select servers. You can search for a server by its name or by filtering.
6. Click OK.
7. In the navigation pane, choose Prevention > Ransomware Prevention. Click the Protected Servers tab and check protected servers.