Abstract: A request associated with identifying a backup snapshot to restore among a plurality of backup snapshots is received. At least a first scanned backup snapshot of the plurality of backup snapshots was scanned for one or more vulnerabilities. In response to the request associated with identifying the backup snapshot to restore among the plurality of backup snapshots, a predetermined identification of one or more vulnerabilities of the first scanned backup snapshot is provided via a display interface. The predetermined identification indicates corresponding criticalities of the one or more vulnerabilities of the first scanned backup snapshot. A request to restore a scanned portion of the first scanned backup snapshot is received via the display interface. Data associated with the request to restore the scanned portion of the first scanned backup snapshot is provided.

Abstract: Techniques are described for recovery of compromised snapshots. An example method comprises identifying, by a data platform implemented by a computing system, a baseline snapshot from a plurality of snapshots of protected data, wherein the baseline snapshot comprises one or more files that each exhibits no indication of compromise; for each file in an anomalous snapshot of the plurality of snapshots, identifying, by the data platform, from one or more intermediate snapshots between the anomalous snapshot and the baseline snapshot in the plurality of snapshots, a clean version of the file; and storing, by the data platform, a clean snapshot comprising the respective clean versions of the respective files identified for the files in the anomalous snapshot.

Abstract: Techniques are described for incrementally determining checksums for a snapshot. An example method comprises identifying, by a data platform implemented by a computing system, a plurality of leaf nodes and a plurality of intermediate nodes in tree data corresponding to a snapshot of a storage system at a particular time, wherein the intermediate nodes each comprise one or more pointers identifying one or more of the leaf nodes, and the leaf nodes each include an indication of file system data of the storage system. The method includes determining, by the data platform, a checksum for each of the leaf nodes, determining, by the data platform, a checksum for each intermediate node based on the checksum of the one or more leaf nodes identified by the pointers of the intermediate node; and storing, by the data platform, the checksum for each of the leaf nodes and each of the intermediate nodes.

Abstract: A set of data changes to a storage associated with a source system is received. One or more data logs among a plurality of data logs stored in different nodes of a storage system is dynamically selected based at least in part on a dynamic analysis of metrics of the different nodes of the storage system. The at least one data change of the set of data changes are logged in the one or more selected data logs.

Abstract: In general, techniques are described that enable a computing system to execute an artificial intelligence model for data security analysis. A computing system that includes a memory and processing circuitry may be configured to implement the techniques. The memory may store a query from an end user regarding security services provided by the data platform. The processing circuitry may parse the query to identify one or more intents, and process the one or more intents to retrieve data for formulating a natural language response to the query. The processing circuitry may also process, using a large language model, the intents and the data to generate the natural language response, and output the natural language response to a user interface for display to the end user.

Abstract: Techniques are described for optimizing reconciliation between cloud networks. In some examples, a data platform may store a local copy of data, in which a remote cloud service stores a source copy of the data. The data platform may initiate a resynchronization of the local copy with the source copy stored by the remote cloud service and obtain an indication the resynchronization is incomplete. The data platform may determine if a first subset of the data satisfies one or more validity checks and determine if a second subset of the data is out-of-sync with the source copy of the data at the remote cloud service based on the one or more validity checks. According to at least one example, The data platform initiates a full download of the second subset of the data to the storage system of the data platform from the remote cloud service.

Abstract: Metadata included in a certificate received from an application or service is analyzed. The application or service is permitted to communicate with other applications or services associated with a data management as a service infrastructure based on a version number associated with a storage tenant included in the analyzed metadata.

Abstract: Events from one or more primary systems associated with one or more tenants are received. The received events are stored in a message queue. At least a portion of the events in the message queue are ingested for organization and storage in a data store. One or more progress identifiers associated with ingesting of the events in the message queue are tracked. An event query is received from an external system. The event query is rewritten into a first component query for the data store and a second component query for the message queue based at least in part on a progress identifier. A result of the first component query and a result of the second component query are combined to determine a result of the event query.

Abstract: An amount of expiration time extension for one or more objects associated with a first archive of a first snapshot of a source storage is determined based at least in part on a second data management policy associated with a second archive and one or more dynamically determined metrics. The first archive that includes the one or more objects is caused to be stored to a remote storage. At least a portion of content of the first archive is referenced by data chunks stored in a first chunk object of the remote storage and the first archive is associated with a first data management policy. Based on the determined amount of expiration time extension, an expiration time for the one or more objects associated with the first archive is stored in an archive metadata of the one or more objects associated with the first archive.

Abstract: File metadata structures of a file system are analyzed. At least one metadata element that is duplicated among the analyzed file metadata structures is identified. The at least one identified metadata element is deduplicated including by modifying at least one of the file metadata structures to reference a same instance of the identified metadata element that is referenced by another one of the file metadata structures.

Abstract: Techniques are described for efficient and secure key rotation for backup storage. An example method comprises generating, by a data platform implemented by a computing system, a first encrypted key and a second encrypted key, wherein the data platform stores one or more encrypted chunks encrypted using a first encryption key of the first encrypted key and a second encryption key from the second encrypted key, the first encrypted key and the second encrypted key encrypted with a first system key, replacing the first system key by determining a second system key, and encrypting, with the second system key, the first encryption key to generate a replacement first encrypted key and the second encryption key to generate a replacement second encrypted key.

Abstract: Techniques are described for identifying deleted keys during snapshot comparisons managed by a data platform. A computing system that implements the data platform comprising a memory and processing circuitry may be configured to perform the techniques. The memory may store metadata identifying, at least in part, one or more deleted keys representative of deleted data that has been deleted from a storage system. The processing circuitry may identify a first tree data structure corresponding to a first snapshot of the storage system at a first time, and identify a second tree data structure corresponding to a second snapshot of the storage system at a second later time. The processing circuitry may traverse the first tree data structure and second tree data structures to identify the one or more deleted keys, and perform, based on the deleted keys, a data protection operation.

Abstract: A backup of one or more objects is determined to be performed. Based on one or more conditions, a corresponding deduplication option among a plurality of deduplication options to utilize when backing up the one or more objects is selected. The one or more conditions at least include a condition based on a detected data change pattern. The plurality of deduplication options include a deduplication option associated with utilizing at least in part a plurality of variable-length data chunks for one or more mismatched ranges and/or one or more missing ranges associated with one of the one or more objects associated with the source system. A request to perform the backup of the one or more objects according to the corresponding selected deduplication option is provided to the source system. Backup data associated with the one or more objects is received and stored.

Abstract: Techniques are disclosed for adaptive throttling based on rate-limiting signals from cloud infrastructure. An example method comprises receiving, by a data platform implemented by a plurality of nodes, a service identifier from a cloud infrastructure system, receiving, by a first node of the plurality of nodes, a rate-limiting signal from the cloud infrastructure system, updating, by the data platform, context information associated with the service identifier based on the rate-limiting signal, sending, by a second node of the plurality of nodes and based on the service identifier, a request for the cloud infrastructure system to the first node, and throttling, by the first node, the request for the cloud infrastructure system based on the context information at least for a delay period.

Abstract: One or more event logs are received. The one or more event logs are analyzed using a plurality of models to detect one or more anomalous events. A graphical representation of risk entities associated with at least one of the one or more detected anomalous events is provided. A visual representation of automatically detected relationships between the risk entities associated with the at least one of the one or more detected anomalous events is provided in the graphical representation. Indications of measures of anomaly associated with detected anomalous events are provided for the associated risk entities.

Abstract: An archival storage of data backed up from a repository storage of a primary storage is maintained. Access to data stored in archival storage is limited by one or more access policies based on whether a corresponding data restore has been authorized. A request for specific data stored in the archival storage is received. The one or more access policies are automatically managed based on status and timing of one or more data restore authorizations for the specific data stored in the archival storage.

Abstract: Techniques are described for data management across cloud environments. An example method comprises restoring, by the data platform, a selected copy of the one or more copies from the one or more second storage systems by, for each chunk of the selected copy: identifying, by the data platform, the chunk in the chunk metadata, determining, by the data platform, whether a matching chunk is stored on the first storage system based on the chunk metadata, responsive to determining the matching chunk is stored on the first storage system, retrieving, by the data platform, the matching chunk from the first storage system, wherein the matching chunk is included in the selected copy, and responsive to determining the matching chunk is not stored on the first storage system, retrieving, by the data platform, the chunk from the one or more second storage systems, wherein the chunk is included in the selected copy.

Abstract: In general, techniques for efficient data retrieval from a backup system are described. An example computing system includes one or more storage devices and processing circuitry having access to the one or more storage devices and configured to: process an input to generate a filter, wherein the input indicates a context for one or more queries; apply the filter to backup data to obtain filtered data from the backup data; generate an index of embeddings from the filtered data; process, based on the index of embeddings, a query to generate a response for the query; and output the response.

Abstract: Range information associated with one or more objects is received from a storage system. One or more missing ranges and/or one or more mismatched ranges associated with the one or more objects is determined based on the received range information. A plurality of data chunk identifiers associated with a plurality of variable-length data chunks included in the one or more determined ranges associated with the one or more objects is provided to the storage system. A response that is used to identify among the plurality of variable-length data chunks, one or more variable-length data chunks not already stored in a storage associated with the storage system is received from the storage system. Content of the identified one or more variable-length data chunks is provided to the storage system.

Abstract: Techniques are disclosed for prefetching data using predictive analysis. An example method comprises storing, by a data platform implemented by a computing system, objects of a file system, wherein a first subset of the objects is stored to a first storage tier and a second subset of the objects is stored to a second storage tier, classifying objects into one or more classifications, storing a data access record for the objects, applying a machine learning model to generate a prediction of future data access to one or more objects of the second subset based on the one or more classifications and the data access record, wherein the prediction includes a predicted time for the future data access, and retrieving, based on the prediction, the one or more objects of the second subset from the second storage tier prior to the predicted time.