Abstract: Aspects of the disclosure provide continual backup verification for ransomware detection and recovery of fileless malicious logic. On an ongoing basis, even prior to detecting an attack within a production environment, each of a plurality of backup virtual machines (VMs) is executed in an isolation environment and subject to behavior monitoring to detect malicious logic (e.g., ransomware). If malicious logic is detected in a backup VM, an alert is generated and/or that backup VM is marked as unavailable for use as a restoration backup, in order to avoid re-infecting the production environment. In some examples, a backup VM with malicious logic is cleaned and returned to the pool of available backups that are suitable for use. Because the production environment is not burdened, in some examples, the probability of detection for finding malicious logic in the isolation environment is set higher than what is used in the production environment.

Abstract: Aspects of the disclosure accelerate recovery using a combination of local and remote backups. A backup selector identifies a latest unencrypted remote backup (e.g., created prior to an encrypted backup), a latest unencrypted local backup created prior to the latest unencrypted remote backup, and a penultimate unencrypted remote backup created prior to the latest unencrypted local backup. A restoration manager restores a local computing asset to the state of the latest unencrypted local backup. In a disaster recovery (DR) environment, two differences are generated: one between the latest unencrypted remote backup and the penultimate unencrypted remote backup and another between a newly-generated failback backup and the latest unencrypted remote backup. The two differences are sent to the restoration manager to roll the state of the local computing asset forward in two stages. This approach is faster and reduces egress charges in cloud-based DR environments.

Abstract: A method for virtual computing instance remediation is provided. Some embodiments include retrieving a first backup of a virtual machine from storage, the first backup comprising configuration information and data of the virtual machine, the configuration information comprising network connectivity information in a first software defined data center (SDDC) running on a first set of host machines. Some embodiments include configuring a second SDDC running on a second set of host machines based on the configuration information, where the second SDDC is network isolated from the first SDDC and powering on the virtual machine from the first backup in the second SDDC. Some embodiments include sending, from the virtual machine to a security platform, behavior information of the virtual machine running in the second SDDC and determining, based on the behavior information, whether the virtual machine running in the second SDDC is infected with malware.

Abstract: Methods and apparatus to manage configuration of policy-based hypervisors are disclosed. An example method includes generating, by executing an instruction with a processor, a specification for a target configuration of a host based on a policy-based profile, the policy-based profile describing a source configuration of a source host at a virtualization software level; applying, by executing an instruction with the processor, the specification to the target configuration; and in response to an update to the policy-based profile, updating, by executing an instruction with the processor, the target configuration to place the host in compliance with the updated policy-based profile.

Abstract: Methods and apparatus to manage configuration of policy-based hypervisors are disclosed. An example method includes generating, by executing an instruction with a processor, a specification for a target configuration of a host based on a policy-based profile, the policy-based profile describing a source configuration of a source host at a virtualization software level; applying, by executing an instruction with the processor, the specification to the target configuration; and in response to an update to the policy-based profile, updating, by executing an instruction with the processor, the target configuration to place the host in compliance with the updated policy-based profile.

Abstract: At least one target configuration of a host at a virtualization software level is automatically assembled based on a source configuration. A policy-based profile describing the source configuration is processed. A configuration specification describing the target configuration is automatically created, based on the policy-based profile describing the source configuration. The configuration specification is automatically applied to target configurations, such that the target configurations are compliant with the policy-based profile.

Abstract: A method of determining compatibility of a virtual machine or virtual machine disk file with a host, including a storage host, is disclosed. A lookup matrix is created to provide a fast compatibility lookup. To create the lookup matrix, computing object properties are retrieved from each of the plurality of computing objects. The computing object properties include resource requirements of each of the plurality of computing objects. Further, host properties are retrieved from each of the plurality of hosts. The method further includes creating host logical groups of a subset of the plurality of hosts having substantially same host properties and creating a plurality of computing object logical groups of a subject of the plurality of computing objects having substantially same computing object properties. The lookup matrix answers whether each member of a selected computing object logical group can be transferred to a selected host logical group.

Abstract: A method of determining compatibility of a virtual machine or virtual machine disk file with a host, including a storage host, is disclosed. A lookup matrix is created to provide a fast compatibility lookup for a group of computing objects and a group of hosts. To create the lookup matrix, computing object properties are retrieved from each of the plurality of computing objects. The computing object properties include resource requirements of each of the plurality of computing objects. Further, host properties are retrieved from each of the plurality of hosts. The method further includes creating a plurality of host logical groups of a subset of the plurality of hosts having substantially same host properties and creating a plurality of computing object logical groups of a subject of the plurality of computing objects having substantially same computing object properties.

Abstract: A method of determining compatibility of a virtual machine or virtual machine disk file with a host, including a storage host, is disclosed. A lookup matrix is created to provide a fast compatibility lookup for a group of computing objects and a group of hosts. To create the lookup matrix, computing object properties are retrieved from each of the plurality of computing objects. The computing object properties include resource requirements of each of the plurality of computing objects. Further, host properties are retrieved from each of the plurality of hosts. The method further includes creating a plurality of host logical groups of a subset of the plurality of hosts having substantially same host properties and creating a plurality of computing object logical groups of a subject of the plurality of computing objects having substantially same computing object properties.

Abstract: At least one target configuration of a host at a virtualization software level is automatically assembled based on a source configuration. A policy based profile describing the source configuration is processed. A configuration specification describing the target configuration is automatically created, based on the policy based profile describing the source configuration. The configuration specification is automatically applied to target configurations, such that the target configuration(s) are compliant with the policy based profile.