Abstract: Embodiments for generating user customized alert notifications for application operations and activities based on monitored performance metrics. Key performance indicators for the application and user behavior are defined, and a monitor process collects behavior statistics of the application for each user with respect to data assets for each of the key performance indicators. Anomaly detection policies are provided to define anomalous behavior of the users with respect to data assets of the computer network. An anomaly detection process detects anomalous user behavior and an alert notification is sent to administrative or security personnel upon each detected instance of abnormal user behavior. The alert notification rules are defined by the user based on operation severity, asset type, operation, and defined metrics to tailor and minimize the number of alerts sent to the user.

Abstract: A lightweight, workload-agnostic application management agent (AMA) automatically upgrading application agents on a virtual machine (VM). The AMA is installed in the VM as part of a Gold image installation. The AMA detects a workload-type of the VM and sends the workload information to an application manager. The AMA continuously monitors the VM for any change in workload type, and any change causes the AMA to install a respective workload-specific agent (WSA) for the new workload in the VM. The AMA accesses the new WSA from the application manager though a push or pull operation. Applications are thus automatically upgraded through VM resident agents. The user needs only to update policies and load updated software to the application manager without manually upgrading the WSA agents themselves.

Abstract: Embodiments are described for a method and system of applying data protection software mechanisms to network equipment devices to auto-discover the networking equipment, save changes from memory (TCAM) to local storage, backup changes to protection storage, provide auditing and tracking history of changes, and provide the ability to deploy test/development copies of changes using software defined networking techniques.

Abstract: Embodiments for a method of storing e-mail messages using a cloud native e-mail data protection process. E-mail messages are first compressed and stored in a container along with selected metadata. An Email Record is created for each e-mail message. A Container Record is created for each newly created container, and a Backup Record is created for each container for each backup. Once the required records are created, the process facilitates the execution of backup operations, such as full or incremental backups of the stored e-mail messages. Data tiering is supported so that low cost object storage in the public cloud is used instead of expensive processing methods, such as deduplication backups.

Abstract: Embodiments for optimizing a backup operation for a data protection system, by connecting with network devices in a network implementing the backup operation, the backup operation implementing a policy that specifies a plurality of service requirements and that is initiated at a time within a plurality of time windows, and determining a size of dataset to be backed up by the backup operation. The method further monitors a flow of data between a source and a destination of data in the network, compiles historical data of operational parameters for data transfers between the source and destination, and determines an optimum time within the plurality of time windows based on the dataset size and the historical data.

Abstract: Embodiments for a method of storing documents using a document data protection process. Documents are first compressed and stored in a container along with selected metadata. An Document Record is created for each document. A Container Record is created for each newly created container, and a Backup Record is created for each container for each backup. Once the required records are created, the process facilitates the execution of backup operations, such as full or incremental backups of the stored documents. Data tiering is supported so that low cost object storage in the public cloud is used instead of expensive processing methods like deduplication. A user interface receives a user setting dictating a storage media storing the container based on a relative availability of the storage media versus cost of storage.

Abstract: Optimizing backups for a data protection system by determining a size of a dataset to be saved in each backup operation and an available bandwidth in each transfer window of transfer windows for data transfers between a source and destination. An order of the backup operations is defined based on first ordering the backups based on decreasing dataset size and second ordering the transfer windows in order of decreasing bandwidth, and matching the backups to the transfer windows in accordance with these orderings. A dynamic window sizing process determines an initial change between the minimum and maximum bandwidth utilization over a period of time and then iteratively split and consolidate the time blocks until optimal utilization over the time period is reached.

Abstract: Tracking changes to a document by defining a document record having a unique document record and comprising an index and a file name of the document, and defining a backup record for the document in a series of backups, which includes a timestamp for each backup, and a bitmask for the document. The bitmask has a single bit position for each document in the container which is set to a first binary value to indicate that the corresponding document is unchanged and a second binary value to indicate whether the document is changed or deleted. A primary query is received and resolved for the document by analyzing the document record to find the file name. A secondary query using the document record ID is resolved to find all tracked versions of the document, and the results are returned to the user in the form of a version history list.

Abstract: Embodiments for a method performing data migration such as backups and restores in a network by identifying characteristics of data in a data saveset to separate the data into defined types based on respective characteristics, assigning a data label to each defined type by receiving user selection or automatically merging or selecting a priority label, from among many labels associated with a file, defining migration rules for each data label, discovering assigned labels during a migration operation; and applying respective migration rules to labeled data in the data saveset. The migration rules can dictate storage location, access rights, replication periods, retention periods, and similar parameters.

Abstract: Embodiments for monitoring performance metrics of a computer network by defining key performance indicators for the computer network, collecting performance data for the key performance indicators, and providing one or more anomaly detection policies to define anomalous performance of the computer network using defined threshold values. A policy is applied to the collected performance data to detect abnormal performance and a notification is sent to a user upon each instance of the detected abnormal performance. An alert tracking component is used to reduce alert generation by compiling and displaying past alert response data to allow a user to directly modify threshold values for alert generation and define temporary parameters to increase alert thresholds.

Abstract: Optimizing multiple backup operations for multiple sources by discovering shared data routes between sources and targets for backup operations performed in a certain time period. Backups using shared routes use a Best Time Algorithm that determines a size of a dataset to be saved an available bandwidth in each transfer window of the time period, and then determines an order of the backup operations based on first ordering the backups based on decreasing dataset size and second ordering the transfer windows in order of decreasing bandwidth, and matching the backups to the transfer windows in accordance with the first ordering and second ordering. The optimum time represents a time to initiate each backup of the multiple backups that results in a shortest data transfer time over the entire time period.

Abstract: Optimizing backups for a data protection system by determining a size of a dataset to be saved in each backup operation and an available bandwidth in each transfer window of transfer windows for data transfers between a source and destination. An order of the backup operations is defined based on first ordering the backups based on decreasing dataset size and second ordering the transfer windows in order of decreasing bandwidth, and matching the backups to the transfer windows in accordance with these orderings. A dynamic window sizing process determines an initial change between the minimum and maximum bandwidth utilization over a period of time and then iteratively split and consolidate the time blocks until optimal utilization over the time period is reached.

Abstract: Embodiments for optimizing a backup operation for a data protection system, by connecting with network devices in a network implementing the backup operation, the backup operation implementing a policy that specifies a plurality of service requirements and that is initiated at a time within a plurality of time windows, and determining a size of dataset to be backed up by the backup operation. The method further monitors a flow of data between a source and a destination of data in the network, compiles historical data of operational parameters for data transfers between the source and destination, and determines an optimum time within the plurality of time windows based on the dataset size and the historical data.

Abstract: Restoring data stored by a backup process in an object store of a cloud network by initiating a restore request to a server accessing the object store, by providing a source identifier of one or more data blocks of the requested data and a timestamp for a backup image at a requested point in time (PIT). The server manages a queue of blocks in temporary storage to provide blocks for retrieval by the client, and initially fills the queue with blocks from a full backup and unchanged by any incremental backup to the requested PIT. In response to the request, the server assembles blocks that are changed from the full backup through one or more incremental backups to the requested PIT using a full block synthesis process employing forward and reverse delta objects, and sends to the client the blocks initially filled in the queue with the assembled blocks to return a full PIT backup image for the requested PIT.

Abstract: Embodiments for a system and method of selecting data protection policies for a new system, by collecting user, policy, and asset metadata for a plurality of other users storing data dictated by one or more protection policies. The collected metadata is anonymized with respect to personal identifying information, and is stored in an anonymized analytics database. The system receives specific user, policy and asset metadata for the new system from a specific user, and matches the received specific user metadata to the collected metadata to identify an optimum protection policy of the one or more protection policies based on the assets and protection requirements of the new system. The new system is then configured with the identified optimum protection policy as an initial configuration.

Abstract: Embodiments for a data protection method of grouping assets for protection policy assignment based on asset metadata by defining a set of metrics characterizing each asset in the system and comparing each metric of an asset with corresponding metrics of other asset groups each containing one or more other assets. A unique protection policy is assigned to each group for application to each asset within a respective group. An overall affinity percentage of the metrics of asset with the corresponding metrics of each group is determined, and the asset is automatically grouped into the group based with the highest overall affinity percentage. The user is prompted to confirm the automatic grouping or to select a different group for assigning to the asset.

Abstract: Embodiments for a storage classifier that provides recommendations to a backup server for storage targets among a plurality of disparate target storage types. The storage classifier receives metadata (name, type, size), and the Service Level Agreement with information such as: retention time, Recovery Point Objective, and Recovery Time Objective) from the backup software. The backup software itself receives policy recommendations from a data label rules engine based on certain file attributes. The storage classifier receives an initial recommendation for the storage type and location (e.g., on-premises deduplication storage or public-cloud object storage, etc.) from a data classifier. Based on these inputs, the storage classifier provides recommended specific storage targets to the backup software on a file-by-file basis for data stored in a backup operation.

Abstract: Tracking changes to a document by defining a document record having a unique document record and comprising an index and a file name of the document, and defining a backup record for the document in a series of backups, which includes a timestamp for each backup, and a bitmask for the document. The bitmask has a single bit position for each document in the container which is set to a first binary value to indicate that the corresponding document is unchanged and a second binary value to indicate whether the document is changed or deleted. A primary query is received and resolved for the document by analyzing the document record to find the file name. A secondary query using the document record ID is resolved to find all tracked versions of the document, and the results are returned to the user in the form of a version history list.

Abstract: Embodiments for optimizing multiple backup operations for a data protection system, by determining a size of a dataset to be saved in each backup operation and an available bandwidth in each transfer window of a plurality of transfer windows for transfer data between a source and destination; then determining an order of the backup operations based on first ordering the backups based on decreasing dataset size and second ordering the transfer windows in order of decreasing bandwidth, and matching the backups to the transfer windows in accordance with the first ordering and second ordering. The optimum time represents a time to initiate the backup operation that results in a shortest data transfer time over all of the transfer windows from as compared to other possible transfer windows in a defined backup period.

Abstract: Embodiments for a method performing data migration such as backups and restores in a network by identifying characteristics of data in a data saveset to separate the data into defined types based on respective characteristics, assigning a data label to each defined type by receiving user selection or automatically merging or selecting a priority label, from among many labels associated with a file, defining migration rules for each data label, discovering assigned labels during a migration operation; and applying respective migration rules to labeled data in the data saveset. The migration rules can dictate storage location, access rights, replication periods, retention periods, and similar parameters.