Name: The Blind Spot in Your Ransomware Response: Unstructured Data
Uploaded: 2026-09-24T19:13:07.091Z
Duration: 55 min 16 s
Description: The Blind Spot in Your Ransomware Response: Unstructured Data

Transcript for "The Blind Spot in Your Ransomware Response: Unstructured Data": Hey, everyone. Good morning. Good afternoon. Depending on where you're joining us from. I'm going to give us a couple of minutes for everyone to join and settle in. In the meantime, if you can tell us where you're from, that'd be great. I'm from Palo Alto, by the way. So it's 11AM my time. Just let us know where you're from. We'll get started shortly. North Carolina. Nice. Ohio. Sacramento. Nice. Baltimore. Oh, wow. We have someone from New York. I love New York. It's not Long Island, but it's still New York. Yeah. It looks like we're hitting both coasts and a few in the middle, some from Ohio. Yes. Oh, Canada. Nice. Yeah. All the way up there, Winnipeg. Where exactly is it? Like, is it super up north? My guess is I think it's north and west, oh, but please forgive me please. forgive me if I'm wrong. Western Canada. Still in Canada. Nice. I was good I was good on the West part. Yeah. Yeah. Myrtle Beach. Hope it's a beachy day out in South Carolina. Folks, just another minute, and we'll get started. Okay. Two minutes past eleven. We'll get started. Folks, if you're joining us a little later, that's fine. You'll be able to catch up. But, thank you very much for joining us to meet the ransomware response team. And again, once again, good morning and good afternoon, to all of you. We'll get started. So with me here is James. Before we dive in further, just wanted to introduce ourselves. So, James, why don't you introduce yourself first? Certainly. Thanks, I'll pick up. Hey, folks. My name is James Knott. I'm a director of support here at Rubrik, one of the cofounders and leader of our ransomware response team process. Just celebrated my nine year anniversary here at Rubrik a couple of weeks ago. Congrats, James. And I'm Alpika Singh. I'm a senior technical marketing manager at Rubrik, and I deal with products, all our AI, SaaS, unstructured data, as well as databases. So between James and I, we have a lot of breadth of coverage. So if you have questions regarding any other product, let us know. We'll be happy to help you out. And with that, just a quick agenda of what we will be covering today. So first, James, we'll get us started as to what the ransomware response team is all about, what we do, how can you engage with us. And once you start the engagement process, what can you expect from it? Also, we will dive into the Rubrik Security Cloud demo, which will showcase all the features and functionalities that are available as part of Rubrik, which you can use, in collaboration with your other cybersecurity products and tools. Of course, q and a, but don't be shy. We will actually do q and a, during the entire presentation as well as the demo. If you put in a question that is relevant to what you're presenting, we do like to take it up and, take a pause sometimes. Like, if you're talking from a long time and there's interesting question, we do like to address that as well. So don't be shy. Put in your questions. Don't wait till the end. We want to answer as many questions as we can. That's our main goal. We will try to wrap everything up in the next forty minutes or less, but our main focus is just to talk to you folks about the questions you have. With that, over to you, James. Great. Thanks, Alpika. So, hey, folks. Before I get into the ransomware response team process, just a quick how did we get here? So as mentioned, I've been here with Rubrik just a couple of weeks over nine years. So that was September 2017 for me. And it was the last couple of months of 2018, in the support center, we saw a couple of these ransomware attacks come in. And these were unlike, you know, really anything we'd ever seen before, and they immediately piqued our interest, you know, in terms of, what was going on, how could we help our customers, was this something we needed to pay attention to, were we gonna see more of these. As we went into 2019, it was very clear that these were here to stay, that they were getting more pervasive, more sophisticated, and growing in numbers. So really from that time, we started building process and procedure and support on how we engage with our customers, how we assisted them, what did we learn from these, driving these improvements back into our product in our in our process. So we've been doing it since that time, but it was probably about mid twenty twenty when things really picked up and things really took a turn, for the worst. You know, in terms of the sheer numbers of attacks, the, pervasiveness of the threat actors, the increasing sophistication, things kind of reached a critical point. And we took a step back in support, and we said to ourselves, what do we need to do to keep pace with what's going on in the world and and, with our customers? And through that brainstorming session came the, official development and deployment of the ransomware response team process in early twenty twenty one. And what it is is RRT is not a separate team. It is a support driven, process and overlay. So, again, it is Rubik support powered and delivered by Rubik support. So it is 24 by seven by three sixty five. And what we do is for a customer cyber incident, we create virtual teams, for each and every incident we engage upon to assist our customers, through these incidents and help them recover. And key members and and components of these teams are incident managers such as myself and my folks, senior support staff, so that's gonna be support engineers, escalation engineers, even dev engineers if they were to be required. Your sales team will be a very integral part and a very key player of these virtual teams as well as folks from our executive leadership team. And folks immediately raise an eye or an eyebrow when they say, well, what are the executives doing in these virtual teams? Well, they're not gonna be pushing the buttons or pulling the levers by any means, but since really day one, since the very beginning, they were very keen on understanding what's happening, during these incidents. What's going on? How is it affecting our customers? So they've been in these since the beginning, and I don't ever see that changing. So how do we engage? It's very simple, actually. Since this is powered and delivered by Rubrik support, there's no separate phone number to call. There's no separate web form to fill out. You don't have to, tear box tops off your serial and mail them in or anything like that. Simply call Rubrik support as you would with a normal support case and just mention, you're undergoing or have undergone a cyberattack, ransomware attack. There's anomalous or suspicious behavior, hack, compromise, any of those keywords, the support engineer who picks up that call and, again, you wanna call in, for a cyber incident. You don't wanna open up the case, say, via the support portal or email. You wanna get somebody on the line who can immediately begin assisting you. That support engineer is gonna immediately begin their process. They're gonna notify their management, and subsequently, we spin up the RT process, assembling these virtual teams and getting to work to, get our customer back on their feet again as quickly as possible. So, really, at the onset of a of an attack or even if something is happening, something doesn't look right, open up that priority one support case. I'll talk about this later in the, presentation, but, really, every minute matters. So even if there's nothing we can do at that moment, certainly open up that support case, and we wanna listen, we wanna learn, we wanna understand what's happening in the event we have to take action and we're already up to speed and we can act quickly and efficiently. So what do we bring from the rubric perspective? Really, it's incident management in terms of urgency, ownership, continuity, communications, above all else confidentiality, and I really wanna underline the confidentiality part. So by having a Rubrik support contract, we're already under NDA. That said, we don't speak a word of any customer incident outside the company unless they were to do a public testimony for us, and you would see that up on our public website. Even internally, we keep these strictly on a need to know basis. So for instance, today, as of right now, we're managing five concurrent customer incidents in in various stages of the life cycle. But when we create these virtual teams, say virtual team number one helping customer a, they may know nothing about what's going on with virtual team two helping customer b. So even internally, we keep these strictly on a need to know basis. And what we bring to the table is assisting our customer, collaborating with, complementing the recovery plans and their priorities. And that's working with all the requisite customer teams that come to that, war room call, backup admins, leadership, technical teams, sec ops, whoever the customer brings to the table in addition to any third parties, security vendors, incident responders, insurance companies, maybe other technology vendors. We want to partner and open openly work with everyone involved with the common goal of getting our customer, back on their feet and whole again as quickly as we can. And one key, aspect and one key differentiator here with with Rubrik is there's no additional cost for this service. This is part of your standard support contract. So in other words, if you have a valid Rubik support contract, you have access to the RRT process. And from that first phone call until you tell us everything is fully recovered, everything is back to normal, we're there from beginning to end. We're there until you tell us to go away. One thing I do want to highlight, and thank you, James, for that, entire process and how we actually engage with the, with our customers. You have to think about, like, once we do our backups, like, it could be your unstructured data that lives on prem, or it could be the unstructured data that lives in the cloud, and it's spread across multiple accounts, or it could be spread across multiple, filers. Right? Once we back up, we actually compare your current backup with your previous backup to look for all the anomalous activity, which James just mentioned. Right? So, once we see any encryption once you see any encryption event or, any anomalous activity, which will be visible to you, on your Rubik's security cloud, portal, Once you do that, you know, it can the tools can be used in conjunction with your existing, existing products. So we do a lot of post backup analysis to give you that information via a couple of different applications so we can tell you all about your anomalous activities, threats that are present. It could be, day zero threats, which you are not even aware of. And I'll showcase that, how it works in just a little bit. But we do a lot of, things in the background with the data, with the backup data to give you that information, like, even where your sensitive data is and who has access to it. So, that can also come in handy when you're talking to your third party vendors to tell them what kind of, sensitive data exposure you're looking at if you have in cyber event. Thanks, Abhika. And, you know, I certainly wanna piggyback on that because even though we're focused on unstructured data in this particular call, the RT process. and Rubrik support and just everything in general is everything that's being protected under the Rubrik umbrella, whether it's unstructured. data, databases, virtual machines, whatever the case may be. We are, you know, from an engagement standpoint, supporting our customer through any workload they protect, whether it's cyber or otherwise. So just a quick RT by the numbers. Once again, RT is a risk support. We're available 24 by 7 by 365. We never close. Immediate response, as mentioned, in a cyber incident, you definitely want to call in and get a support engineer immediately on the line. At that point, we can begin immediately assisting as opposed to, some just natural delays that occur when you open up a support case via the support portal or email. $0 additional cost as mentioned. This is part of just having a rubric support contract. The RT process has been up and running since five years, but we've been we've been doing it much longer as mentioned going back to, the last couple of months of 2018. And unified virtual team so this virtual team is going to be assembled and assisting our customer throughout the, life cycle event from that first phone call up until everything is completely online, back to normal, and business as usual. So we're always asked a question. This comes across, very frequently, whether through formal engagements like this or even, things carried back through account teams or or just, other presence that we have with customers, we're always asked, what can we do to be better prepared? And the answer is, interestingly enough in the question, by actively being better prepared. So in terms of a cyber attack, you never know when they're gonna happen, what they're going to look like, what's gonna be the impact, all the variables that go with a cyber attack. But the one thing our customers can do is actively be prepared to respond to and recover, from an attack. And that's by developing a comprehensive response and recovery plan and testing that plan and evolving that plan. So run through your tabletop exercises and your tests and determine what worked as anticipated, what took longer than we expected, what didn't we consider, From a, like, say, from a human perspective, what two teams needed to collaborate or interact, or was there was there dependencies that we didn't consider? Recalibrate, test again, improve the plan, turn it into muscle memory. Certainly having a relationship with a reputable cybersecurity vendor, very important. It's something you don't want to try to engage after an attack has already happened. We've worked with literally all of them, all the big ones, most of the medium sized ones, and, even some great success with some very small ones, you know, kind of regional or or or even city or town based. But what we've seen time and time again is having that cybersecurity vendor already familiar with your business, your key players, your recovery plan, makes a big difference as opposed to trying to spin one up after an attack has occurred. Spinning one up would take a minimum of eight to twelve hours before anything even closely meaningful would happen. Sometimes it's a day or two, and they're coming in cold. They won't really know anything, and they're learning on the fly. So, again, highly recommended. From the Rubik perspective, the Rubik support portal is a wealth of information, not only in your normal day to day just, support, type aspect. You can manage your support cases there. We have a wealth of documentation. Not only our product guides and KB articles and things like that, but also security best practices, hardening guides, things of that nature, all up in our white paper section. Once you have access to the portal, there's no gating. You have access to everything. These documents are constantly reviewed and revised. They're always up to date, so certainly take advantage of the information we have up on the portal. And lastly, understanding and leveraging the tools at your disposal from the rubric side to secure your data and be able to recover your data. So one thing I do want to highlight, and I actually, it's not highlight, but reiterate what James just said. Testing your creating a test plan and testing it regularly is the key to success. Like, if you think back, if you ever had to give an a final exam or take SAT or GMAT or any, test, you had to prepare, right, before you take the final test. So similarly, if you if you get in a situation where you have to do a ransomware recovery or a cyber recovery, in cyber recovery, you don't want that to be your first incident of doing so. So it's very important that you keep testing it. Not saying do it every day, but, you know, have a regular cadence. Test your plan. Figure out if the right personnel information is present or not. Like James mentioned, make sure, if you learn something new, add that to the plan and then reiterate on it. A lot of time, the you have connections with a cybersecurity vendor, but the phone number changed or the person who you are supposed to call has left the company or is on vacation. Anything can happen. So just knowing that information, beforehand, what is the backup plan. It's really important, and that can come, to play only if you keep testing it. So please do test your plans. And if you don't have a recovery plan, you can always, look at our documentation, figure out what the best practices are, what are the usual steps for recovery. We have that information, ready to, for consumption, and it's really updated very frequently. So, do take advantage of it. Yep. That's it. And I will hand it back to you. Thanks, Avika. And I just wanna close with one last bit of information with regards to preparedness. So certainly from the rubric perspective, we have a lot of good documentation that we can provide from a general preparedness and response, the CISA website, government website, c I s a, they have a wealth of information on their website as well, including a, template really where you can take this template, tailor it to your business and your needs, and be able to build on that template from an overall incident response and recovery plan. And we've seen this as well, and I wanna mention this, also. This is very important. What we see is preparedness really sets the stage for how quickly and efficiently, our customers can recover. There's so many different variables in terms of what's the blast radius, what's the impact, you know, just in terms of sheer scale. There's forensics to be considered. So many other variables that are just, you know, kind of in the it depends category. But what we see are customers that are well prepared fare much better than those that don't. And it's not even really isolated to large versus small. We've seen very small customers with very limited budgets and maybe a couple of people, really running the entire recovery fare very well because they were very prepared. We've also seen large enterprise, where they have lots of people, lots of budget, lots of tools, and they struggled. So, really, it does make all the difference in terms of being prepared. Just a couple of things in terms of preparedness. We'll get the, the eye roll from the security operations folks in the room, but, enable MFA or pass keys on all administrative accounts, Rubrik and otherwise. It's a no brainer. It goes without saying, but don't make it any easier on the, for the threat actors to gain administrative access to your environment. And just kinda coming back, from the rubric side, if there's something going on, we wanna know. Even if there's nothing we could do at the moment, once again, we wanna listen. We wanna understand. In that way, if we need to act, we're already fully up to speed, and we can move quickly and with purpose. So, certainly, make that call. Minutes can matter. Even if it's your test account, do have the MFA enabled. Awesome. 100%. Thank you so yep. Thank you so much, James. I will get into the demo. Give me a second. Let me share my tab. So once you become a Rubrik customer for your unstructured data or any other data, what you will get access to is this Rubrik Security Cloud. This is our SaaS platform, that centrally manages everything. So all the apps I will talk about, all the data protection, so backup, and even kick starting your recovery is via this, console. What we what you're looking at is the global dashboard, which will give you all the information about all the different app all the different objects that are project, protected, so across different clouds. So if your, unstructured data lives in different, clouds, different buckets. You can protect it using the same interface. We also support on prem, unstructured data support. So, it can be any filers. We do have API integrations. Now this is not the forum where I get into depth, but, believe it or not, we do support, protecting, pretty much all the filers that are available out in the market. So, you can protect your cloud as well as on prem data. We do have support for SaaS workloads. So your confluence, Google Workspace, m three sixty five, Jira, what else? Salesforce of the world. We do have support for identity as well. So your Okta, Active Directory, and even Microsoft, what is that, AD as well. Right? So now what I want you to, get out of this is that, yes, we are talking about unstructured data, but we do support protecting all of the data. And everything that James talked about for from the RRP perspective. So if you have a ransomware incident, we we will help you recover across all the workloads, not just unstructured data. Now, once we do the backups, we compare your current backup with your previous backup and try to understand if there are any massive, deletion, encryption, or, events that are not normally in your infrastructure. If anything ongoing, if that is if if that is actually ongoing, we present that information to you in the, in the data threat analytics application. We can also do a lot of threat hunting and threat monitoring, which I will get into in just a little bit. But anything related to threats analysis is all part of the data threat analytics portfolio. Then we get into data security posture portfolio where we are scanning your back, backups. Now this again, like, the data could be spread across multiple filers, multiple cloud. It doesn't matter. We will still scan that data and give you the information where your sensitive data lives, who had access to it, especially if you're talking about HIPAA compliance and if if you are a huge health care provider or finance, wherever there is more importance given to your sensitive data exposure, it's really important to know where your data lives. Right? So we give you that information across all your platform on prem or cloud. Again, like, you can run orchestrated recovery of your data, and we you can track that in the orchestrating orchestrated recovery application. So we'll first get started with anomalous objects. I am going to click anomalous objects. It takes you to the anomaly detection, dashboard, And I actually have, some filters applied so we can just talk about unstructured data. But, essentially, it'll give you the list of all the, objects that actually have any anomalous, activities going on. It'll tell you if there are any, encryption, what kind of encryption, what are how many suspicious files are there, etcetera. So if you want the details as to which folder, you can click on the object and, sorry. Let me go to the other one, which will be better. Yeah. So it'll give you the in, information regarding when was this incident first detected, which is the snapshot where it was detected. If there's an anomalous, activity, like, what kind of it it is, if there are any ransomware note, where it's located, the list of suspicious files. And you can download this information for your SOC team so that they can perform further analysis and, figure out what's going on. It also gives you how many files are deleted, what are the, like, essentially a timeline of when the activities first started, when it picked up. So, that can come in handy as well. And, again, like, any sensitive information, if any sensitive data lives on that object, it will give you that information as well. Digging in deeper, you can actually figure out exactly where most of your data lives or your or your activity has happened. Like, here you can see that the icar.com was actually deleted, and then it was reencrypted, by a LockBit extension. Now let's go to the public share folder, and you can see, like, there's a whole bunch of, files that were actually deleted. Original like, the actual files, and then they were added with a log bit encryption. So if you want to just, recover these, you can, click I'm just gonna select the file and click on recover. What it will do is that it will select a snapshot which is free from this malware, and you have multiple options to actually recover the file as well. The same thing is true for your cloud workloads or, like, if you have a virtual machine, the same operations are supported and the same kind of information is also available for you. Okay. I wanted to touch something of oh, yes. Let's talk about threats first, and then we can go to data security posture. Now, in this setup, I don't have, specifically NAS cloud direct or unstructured data setup. So So I'm just gonna give you an example with, with one of the other file share. Now what threat monitoring does is that it uses Rubrik's threat in Tel Feed. Now this threat in Tel Feed is from Mandiant, and then it contains the latest indicators or compromise or IOCs in the form of file hashes or Yara rules. And after every backup, it actually scans your backup for these threats. Now if there are any threats present in your unstructured data, it will flag that. Typically, what you want to see is that this, dashboard has, no objects listed. But if you do see it, that means there are some problem. There are some threats available, in your environment so you can get that info the details by clicking onto the object. It'll tell you the exact file, that is of the concern where it's first observed and what is the file version of that, of that, of that observation. It can all it will also give you the hash value of the threat. What is the threat source? So what you can see here is that, the threat intel source here was both from CrowdStrike as well as, Google threat intelligence. So, this comes in very handy, especially if you want to run, a threat hunt to find all the objects, that have any such threat present. So it gives you the hash values or m d hash values in various formats, and you can copy and run through, a threat hunt. Now one thing I do want to add is that when we launched first launched this, feature, it we supported only, our own threat intel source. But now we do have the option for you to onboard your own intel source. Now it can you can, either, add in the form of your own IOCs or in the form of third party sources. Like, what you see here is that we have, CrowdStrike added as well. So you can add, your own personal, threat intelligence feed, and Rubrik will take that in account while running, and searching for threats after every backups. Now this is a very proactive format of, looking for threats. And this was done on purpose because passively sure, like, after an incident has occurred, if you're running for threats, threat hunt, you know, you already know there is an indicator of compromise. But we want to we wanted to make sure that we are actually actively, monitoring for threats as well, and that's why this feature came about. Now if you want to run threat hunts across your entire data center, very simple process. Just click on hunt. You can add multiple hash values for, looking for threat. Sorry. Give me a second. It's as simple as just click on start threat hunt. We're going to perform turbo threat hunt because it's much faster, and it's only using hash values, for files. Now I'm going to select all eligible data sources, but you can choose to select eligible data sources as well. Like, right here, you see NAS CloudDirect. It will if I select NAS cloud direct, it's going to look specifically for your unstructured data across cloud, and on prem. Now I'm just going to enter the hash value for the thread, give it a name, and kick start the process. I oh, sorry. Okay. So I'm going to find my, existing one which I ran yesterday. Give me a second. So, Abhika, while you're looking for that, a question came in. Very good. question. So, the question is the threat hunt will be on the backup data or on the virtual server too. Oh, it will be on the backup, not in the, live infrastructure. It'll be on the backup copy that we captured on the Rubik's side. And, yeah, that's a great question. And that is actually, yeah, done on purpose because if we start running these threat hunts, the adversary might become aware of, you taking measures to, stop the attack. They can, you know, preemptively start deleting data, so it we we have designed this to run it on your backup data. Great question. So once you, once the threat hunt finishes, it will list all the objects that have the matches. Right? Now to begin with, we saw only one file, but as you can see here, there are multiple objects that have the same threat, and it will list the match type, the actual location, the match snapshots as well. What can you do with it? You can simply click, get the entire detail. You can actually start quarantining these files so, no one can accidentally, you know, recover from this snapshot and further spread the attack. Right? So it's important, that you quarantine it and make sure to, prevent the spread from happening on other objects. Now one thing I do want to highlight is that once you quarantine, that doesn't mean, you cannot use it. Admins with, special privileges essentially, admins with all privileges can actually, still use this quarantined, snapshot as well. Now a lot of times, your, sec ops team, they want to do more analysis on the data as in do a cyber recovery. Now this feature is not currently supported for unstructured data, but I'm going to still show you for, our virtual machine infrastructure. So how this work? Actually, it is supported. No. It's not. Okay. So, what we can do is that if I click on, our one of our virtual machines and click on start Stival Recovery, this process can automatically create, a virtual machine with, with a snapshot that is actually either quarantined or non anomalous or with anomalous, objects or anomalous snapshot. Now why do I want to showcase this? Now if you have a ransomware attack, it's typically across hundreds of objects. Right? And if you try to spin this virtual machine up for your sec ops team, across hundreds or thousands of virtual machine, it can take a long time because you have to manually select a snapshot, that is either clean in nature or has, the anomalous activity. So what Rubrik does is that just by selecting, the right type of snapshot, it automatically finds the snapshot for you. If I click here, you can see that, across, all the snapshots, it already knows what is a clean snapshot, what is an anomalous snapshot. So, and it took, like, a few seconds to get this information. Now if you want to do this across thousands of virtual machines, it can take you forever. It can take you days or weeks to get this up and running, but Rubik can do this for you within seconds. Now once I select my snapshot, if there are multiple virtual machines, you obviously have to select a boot order to get the application up and running. You select your compute resources. Select I'm not going to go further, but, yeah, select your compute resources, select your isolated network, give it a name, and, the virtual machine is ready to go within minutes. So this is a very cool feature that we have added, for our customers. So now we will move to, our object inventory for data security postures. Now how does this work? Sorry. Let me go back and actually show you how this actually works. So if we had to the data security posture, application, what you will get is a dashboard, that would have categorized, all the objects, with all the different sensitive data types. Now how do we do that? That's the first question which our customers ask. We do have a lot of data, data analyzers to look for specific sensitive data. Now what you will see here is a list of predefined and custom data types. Now what you see here is, like, Netherlands patient number, and it's a predefined data type. It looks for your license, your bank routing information, bank account number, your Social Security number as well. But we are also aware of the fact that across different geographies, there are different types of data, sensitive data. So we have started adding more and more, analyzers to look for the sensitive data for different geographies. Now if your specific data type is not there, you can actually use regular expression and, regular expression and dictionary words, to create, create your analyzers. So reg x dictionary. You can actually test it out, before you even create this analyzer using the validate button. So these are some ways you can add analyzers. Now once these analyzers are created, we map it to data categories or policies. So CCPA will have, analyzers to look for your street address, name, phone number, your Social Security number, things like that. So depending on, which industry your organization belongs to, which, compliance it needs to adhere to. You can apply different, data categories to, your unstructured data. And a lot like, we have the most common ones, HIPAA, medical, even personal financial stuff. Right? So if you don't have it, you can create something to match your needs as well. So once this is applied to your data, we start after every backup, we start scanning your backup to look for sensitive data, and that's what you see on the dashboard. Now I'm going to get, very specific into, unstructured data. So I have my filter set up, and what you see here is unstructured data, unstructured objects that actually have sensitive data all over the place. So, again, like, this works for on prem or even cloud workloads. So you it'll tell you exactly where, the sensitive data is located, what are the different data types. It fits all the files that are in this folder that are sensitive in nature. So what can you do with this information? On a day to day basis, you can actually use this information to, you know, tie down your sensitive data to make sure that no one, other than, the the required personnel has access to this information. Like, it could happen that I accidentally shared it with my personal account, and now my Gmail actually has access to my company sensitive information. And and it can happen, or you have accidentally shared it, outside your organization. Right? So you can, log down your data and make sure that your data is safe, at rest. And, also, in cases where there's a cyber event, you can download this information in the form of CSVs and share it with your legal team in case you need to talk to certain, regulatory organizations to figure out what your, sensitive data exposure looks like and start talking about fines and things like that. So we we make this process very simple for you. You can use this information, on a day to day basis or in a cyber event as well. Now, we are helping you protect your information or sensitive data at rest. It's very important to protect the same information in motion as well. So what we've done is we've collaborated with, a lot of our DLP providers, partners, such as Zscaler. And what we do is that we take all this information, like which object has sensitive information, where it's located, what is the file sensitivity. And essentially, give it to, to Zscaler where you can create DLP policies, to make sure that when this data is in motion, it's protected as well. So if this, folder, is shared outside the engineering organization or if someone is trying to upload it to their personal, Google Drive. All this can be, prevented using the DLP policies. So Rubrik is helping you protect your data on prem, rather, sorry, at rest and in motion. So, with that, I will pause. James, any questions, or did I miss anything? No. Awesome. I do want to mention one more thing. It's not relevant, but we relevant to this webinar. But just as a FYI, we have our identity resilience suite as well where we have started protecting your, identity data. So like I mentioned before, so Okta, Active Directory, and UltraID. And similar to what I talked about, like, we scan our backups to tell you information about anomalous activity. We do, something very similar to your identity data and try to figure out if there are any violations. If, if your configuration is, is moving away from what it's supposed to be, if there are passwords changing, users being deleted, All of that information is, again, like, we are comparing your current backup to your previous backup and giving you a lot of identity insights, because, you know, identity is the key to all of your data, all of your unstructured data, or any other data which your organization holds. So it's very important to know if there are any adversaries. So that's one of the reasons why we started, we started sorry. I'm sharing the wrong screen, and I was talking about it. So this is the identity resilience dashboard. Like, you can see if there are they can it shows all the active violations, summary of all violations. So in case there are adversaries present in your environment, you can actually figure it out much earlier than them taking over your entire infrastructure. The other cool part about identity resilience is that it helps you with recovery as well. I don't know if you've seen, but if the the recovery plan for, active directory is about 1,200 pages, I believe, and Rubrik automates that entire recovery process, for you. So it's like you select the snapshot, figure out what you want to recover. If it's a forested infrastructure, we can do that as well. So, answering few questions, can save you a whole bunch of time and make sure that you get the same immutable and air gap protection, for your like, your unstructured data as well. So, if you want to talk to our sales team more about identity or for your unstructured data, please let us know or reach out to your account exec as well. Now with that, I will stop and head back to the presentation. Anything we need to cover, James? No. I think that covers everything. Awesome. And, guys, don't be shy. Please put in your questions. We are very happy to answer them. Okay. With that oh, yes. Rubrik Agent Cloud. Now this is our latest offering for your agentic, protection. We don't back up your agents. Don't worry about it. This is more from the compliance aspect, enforcement aspect, where Rubrik Agent Cloud sits in between your agent and your LLMs. So we become the gateway, and we monitor all the tool calls and all the responses, that happens between your agent tools and your LLMs. And we can give you an overview of your what your agents are doing across multiple platforms as well. You can actually enforce guardrails. Like, you can prevent a read only agent, from updating or deleting or modifying or adding data to your Salesforce or any other tools or, any any other data from your infrastructure. So, it's you think of it is that as as more of a monitoring and your enforcement tool. You can look here like it's it's, it comes in very handy as we scale our AI infrastructure as well. With that, we come to ransomware recovery warranty. This we started a couple of years ago, maybe four years ago if I'm not mistaken. And we started offering to our customers up to 5,000,000, in ransomware warranty. But quickly, we doubled it, and we've made it 10,000,000. And how our customers are eligible, only two things. You do need to have Rubik enterprise edition as license, and you need to follow standard data security best practices. Now what are those policy, data security best practices? James mentioned MFA. So don't forget, and it's very important that you have MFA in your infrastructure or you have, our back in your infrastructure. You are not only Rubrik. It's across your organization. You are patching your OS updates. You are, you know, having most up to date firewall and, you know, all your settings are in place. So and I will let James, add some more color to the entire warranty process. But, yeah, it's it's a cool feature which we've been, we've and we've never paid it, James. Nope. Never paid it. Not once. Nope. Not once. Yeah. If you can add some more light to the warranty process, that'll be great. Certainly. So, once again, a must is Rubrik Enterprise Edition features and functionality having that license. Really, the key to the ransomware recovery warranty is having, formerly called a CEM, customer experience manager, now called a customer resilience manager, CRM. Very similar to in other vendors where you'll see the title of TAM or SAM, support account manager or technical account manager. That's gonna be your, really your virtual team member on the Rubrik side, from a support aspect, from a product aspect. And they're required for this warranty because they're gonna ensure that everything is kept up to date, you know, in terms of security hardening. All Rubrik best practices are here to and followed. Things are made up to date and things like that. So that's a key part of, the rent to our recovery warranty. Awesome. Thank you. There's one question on please share the phone number for support and what's what is needed to open a support case. Yep. Absolutely. I have that. So best place to go, and I'll I'll share the number, as well. But if you go to support.rubric.com, that is the link to our support portal. You don't even have to log in. You can just scroll to the very bottom of the page without any login whatsoever, and it'll detail all of our global support phone numbers. The US, support number is 809975896. And we have a number of other, support numbers for other areas of the world. We have dedicated lines for US Federal and our FedRAMP customers all up here on our, support portal. In terms of opening up a support case, the person contacting Rubik support has to be a contact within our database, within, our Rubik support portal. And at the very top, if you look at our Rubik support portal, you'll see a link to register. And all you need to do is enter your name, full name, email address, title. Thank you very much. Appreciate that. And that will get you registered to our support portal and, really, just calling in or logging in to support portal. Being a registered contact is really all you need. And, of course, it goes without saying that any of the workloads that you're calling in on need to be protected by. Thank you so much. Okay. That was the last, question I had, up here. Any other questions? We have we still have six minutes. Questions, comments, feel free to add it. But, otherwise, I'll give you your six minutes back. Just wanted to thank you all for, coming and attending the session with us and taking the time to ask questions and listening to the entire process. Thank you so much. Thank you,