Abstract: Recovery of a primary image is facilitated by using consistent snapshots on a primary storage array and consistent snapshots on a secondary storage array to avoid the need to transmit entire secondary replicas of storage objects from the secondary storage array to the primary storage array. Consistent snaps of the primary replicas are generated by the primary storage array. Consistent snaps of the secondary replicas are generated by the secondary storage array. The primary image is recovered by linking consistent snaps on the primary storage array to primary staging volumes, linking consistent snaps on the secondary storage array to secondary staging volumes, synchronizing the primary and secondary staging volumes, and migrating host IO traffic to the synchronized staging volumes.

Abstract: Attributes of snapshots are provided that ensure snapshot preservation and enable utilization of snapshots to be restricted. If a cyber intrusion event is detected, fence attributes are set on snapshots that were created after the time of the possible cyber intrusion event to restrict those snapshots from being used for cyber recovery until after the data contained in the snapshots has been validated. If a snapshot is selected for use, the fence attribute is checked and, if set, prevents the snapshot from being used until the data of the snapshot is validated. Additionally, keep attributes are set on snapshots that were created before the possible cyber intrusion event, to preserve those snapshots to prevent the snapshots from termination. If a snapshot is selected for termination, the keep attribute is checked, and if set, prevents the snapshot from being terminated until the keep attribute is reset.

Abstract: A method, comprising: retrieving a VDG definition; processing the VDG definition to identify a primary storage system and one or more secondary storage systems; detecting a consistency formation event; transmitting a first instruction to initialize one or more data structures for a first snapshot of a volume that is stored in the primary storage system; transmitting, to each of the secondary storage systems, a respective second instruction to initialize one or more data structures for a respective snapshot of a copy of the volume that is stored in that secondary storage system; suspending servicing of input-output (I/O) by the primary storage system; transmitting to the primary storage system a third instruction to complete the first snapshot of the volume; transmitting to each of the secondary storage systems a respective fourth instruction to complete a respective snapshot of the copy of the volume; and resuming servicing of I/O.

Abstract: Cyber intrusion detection (CID) and data protection (DP) are coordinated within a storage node to enable the capabilities of DP to be automatically and quickly utilized in response to detected threats to help protect data. CID sends an alert message to DP in response to detection of a ransomware attack or other threat. DP responds to the alert message by implementing at least one countermeasure, such as: generating new targetless snapshots of the storage objects under attack, the version data group of which the storage objects are members, or all storage objects maintained by the storage array; securing and/or preserving some of the targetless snapshots that existed before the infection; changing the targetless snapshot generation and retention schedule; and temporarily halting generation of new targetless snapshots.

Abstract: A storage node maintains storage objects that contain decoy datasets that are used to detect cyber-attacks. The decoy datasets may be deployed at logical block addresses (LBAs) including the first and last LBAs of the LBA range of the storage object. Real active data may be stored on the storage object with the decoy datasets. A cyber-attack is detected based on receipt of a suspicious IO command that accesses decoy data. Access to the decoy data may be detected by maintaining an IO access bitmap, calculating digital signatures of decoy datasets, or monitoring for decoy data that is marked for remote replication.