Abstract: Mitigating a network security threat is disclosed. Information associated with a data protection event is received. The received information is evaluated for an indication of a network security threat. One or more remedial actions are performed if it is determined that a potential threat has been indicated. Optionally, the received information is stored.

Abstract: In one embodiment, a backup/restore mechanism is contemplated which may be used to consolidate application servers from a cluster to a single node and/or to restore a clustered environment. The mechanism may automatically consolidate shared resources on a node during a restore, even if the resources were external to the nodes in the cluster (e.g. on a shared storage device). Thus, complex and error prone manual intervention may be avoided, in some embodiments. In some embodiments, the backup mechanism may include checking identifiers for each node and application server in a cluster server data base, to identify node backups as opposed to application server backups. Local node resources may be associated with the node backups, and shared resources may be associated with the application server backups.