Name: Govern Your Unstructured Data and Make it AI-Ready
Uploaded: 2026-10-07T18:30:53.511Z
Duration: 59 min 24 s
Description: Govern Your Unstructured Data and Make it AI-Ready

Transcript for "Govern Your Unstructured Data and Make it AI-Ready": Hey, everyone. Good morning. Good afternoon. Depending on where you're joining us from, we'll get started shortly. We're just giving everyone a minute or two to get settled. We already see great attendance, so thank you very much for joining in early and on time. Just give us another minute, and we'll quickly get started. And in the meantime, if you don't mind, just let us know where you're from in the chat. I am from Palo Alto. I'm based out of our headquarters in, in Palo Alto. Thank you so much. Okay. In the interest of time, we will get started. So once again, good morning, good afternoon, depending on where you're joining us from, and thank you for joining us for this version of, the workshop, public workshop, focusing specifically on the unstructured data. And this is for unstructured data everywhere. When you go through the session, you will see, why I said everywhere. But let's dive in. Quick introduction. So my name is Alpika Singh, and I'm a senior technical marketing manager here at Rubrik. Been here for about five years, and I say I primarily work on everything that is technical in nature customer facing, like presentations, doing these workshop, webinars, lot of blogs, videos, and other content, for our unstructured data, SaaS, AI, and databases. So if you have questions about other products, feel free to ask us in the chat as well. Not chat, but q and a tab. And, Mike, would you like to introduce yourself? Sure. Sounds good. Hi, everyone. I'm Mike Preston. Work in the same same team as Alpica, except my responsibilities mainly focus on cloud and automation. So like Alpica said, any questions at all, feel free to drop them in. We'll, like... We we don't have to wait till the end. We can make this as interactive as possible. But, yeah, like, Apica, I help with creating different content, videos, demos, a lot of webinars. My absolute favorite thing though is these workshops because I find they're, like, so much more interactive than, you know, explaining something on YouTube or something like that. So looking forward to the hour that we have. Absolutely. And same. Like, we love these workshop sessions. We will pause if we see a lot of questions that is very relevant to what we are presenting or something very interesting comes up. So please do ask us questions. And instead of using the chat functionality, please use the q and a tab, which is to the right, like Hannah has mentioned. Please, ask us questions from the beginning. We love them, so keep them coming. Just a quick agenda. So both Mike and I are going to dive deep into what unstructured data protection looks like and how it actually works. And, we have q and a at the end, but like we said, we'll have questions, so put it upfront. We will leave you with a lot of, good content in terms of GuidedLab, how the solution works so you can, you know, figure out how the solution actually works. But, you know, just a... We will do a quick run through if time permits, what the lab will look like. With that, we'll get started. So just to level set, let's figure out what unstructured data is. So my favorite definition is any data that doesn't fit into your structured data, like your sequels or MongoDBs of the world. That is unstructured data. And the best example, in my opinion, is your own desktop. If you see there are multiple PDFs, a Word doc, there are multiple audio files, video files. Now depending on your job profile, that data may vary. But, you know, at the bare minimum, you will have PDFs, Excel sheets, and, your Word docs. Now the type might be same, but the size is different. And if you think about it from... At an enterprise level, you are, hosting multiple applications, using, these apps are saving multiple types of data. They have... They are using multiple types of data to make your business function. Right? So all the PDFs of the world, all the audio files, video files, it could be your medical images, things like that. Right? And they not only live on on prem, but they also live on, your cloud. Right? So there is cloud file, there's cloud object, same thing for on prem file and on on prem object. And this is... When I say cloud, there are four different vendors, that offer, cloud protection or where you can, save your data. And same thing for object as well. And there are multiple vendors that offer, you know, filers where you can, store your data. So think about all the data at an enterprise level where they're located, and it's hard to keep track of. In the world of AI, you're constantly moving your data from on prem to cloud or vice versa, maybe to train your data or may... To... Maybe to make sure that all the different applications, that need this data have it accessible. Right? So, we live in a very hybrid world, and it's very important that we understand where these data actually lives. And if you think about it, a large portion of this data is also sensitive in nature. It could have your employee information, customer information. Think about the health care industry. Everything is sensitive in nature. So it's really important to know, where your data actually lives, whether it's on prem, cloud file, object, however, whichever cloud vendor, you need to know where this data is and what percentage of that is sensitive in nature and also who has access to it. Now this will help you, to identify any, any access issues. If the data has open access, you know, you can lock it down before any, cyber attack happens. So it's important to know and make sure your data posture is secure. I'm gonna skip this slide because I just explained it. But think about, you know, in case you do have a cyber attack, knowing where your data is and who has access to it, what is sensitive, what kind of exposure you're looking at, what kind of malware you're looking at, where it's located, how far it spread. It's really important to know, for your data. With that, over to you, Mike. Awesome. Sounds good. Do you want me to drive a picker or do you wanna drive? Sorry. I was talking on mute. I can drive. No problem. Okay. Alright. So... Alright. That's good because I am I am out at sector right now in Toronto, so I only have one screen. So it makes it hard to watch q and a and, you know, click and deliver slides. But like Opika said, you have a lot of unstructured data now. Right? It's spread out across cloud on prem everywhere. And, actually, the number here is 92% of it is unstructured, which is a very, very high number with almost half of that being sensitive. So some of the stuff that I'll pick a set around data classification and data, sensitive data monitoring and stuff like that is more and more important, when we look at unstructured data because, you know, these are often terabytes or petabyte scale. Like, who can name what all lives within those buckets and what all lives on those giant NAS systems? Like, I know I couldn't at my previous job. It just seems to be a dumping ground. And we're seeing more and more of it, and AI is only sort of increasing that. Right? We're we're using things like lake houses to consolidate a whole bunch of databases. What... For what used to traditionally be like business intelligence, but now it's being used, for a lot of the, agentic, initiatives that that companies are deploying within their environments. So with that, you know, we also see some stats here around breaches. Right? Being 44% of them are, you know, cyber attacks. And and with that, we also see the growth. Right? 22% unstructured growth over the next five years. So the... What that means if it's a petabyte today, you know, you know, the next year, it's gonna be 1.2 petabytes. The next year, it'll be, I don't know, 1.44 petabytes. I can't do the math in my head, but the idea is that it's growing. So moving on to the next slide, this kinda just illustrates that it's not enough to protect just one location. Right? Attackers are getting into your environments. They're sitting there for, you know, what it used to be, like, sixty days when I I think is the average dwell time. So they're moving from on prem into cloud, into SaaS, into your identity providers, things like that. They're getting all sorts of time, and that sort of time frame is even expedited more with with AI, like we've seen the latest jade puffer attack and its dwell time was something like thirty seven minutes. So they're they're actually having less dwell time and affecting more data. So it's not like, just because your data is sitting in cloud or just because it's sitting on prem, it's protected. Right? We need to protect that data everywhere, no matter where it it lives. And the problem is, you know, when we go to recover from this... And go ahead. You can go to the next slide, Apica. Is, it's a long time. Right? Especially from a cyber attack. Like, operational type recover is easy. Right? If we delete a file, we know we can just go to last night and restart. That's that's table stakes sorta data protection stuff. However, cyber attacks introduce a lot more and I'll pick up... We'll go through near the end sort of how old this works, but Rubik does a lot more than just allow you to recover. We actually start the recovery process long before attacks even take place. So after each and every backup job, we do things like scan for anomalies, look for signs of encryption. We use a machine learning model that's been trained on real world and simulated ransomware, attacks. So we can easily help you, you know, determine that blast radius. And as well, the next piece is like threat monitoring, being able to ensure that when we go to restore, those backups are free of the malware. They're free of attacker tools, things like that. So Rubrik really differentiates itself, amongst all our competitors here. And, again, you know, we're a modern platform. It's SaaS delivered. We use a software appliance, in terms of, like, on prem. It's a it's a virtual machine that gets that gets put into your environment. It's a femoral. You don't have to manage it or anything. Rubrik Rubrik handles all of that, but it's there to do the data movement. This is so we can get away from, you know, the old, like, NDMP and and how slow and painful that was to to take a backup of a petabyte NAS system using that. You just... You'd never finish. By the time your your window's up, you know, it'd be time for the next backup. So that's how Rubrik really differentiates ourselves by doing things like what we call the preemptive recovery engine, which is all that scanning and things ahead of time. It's all done in peace time. So when the time comes to recover, you already know the latest clean restore point. You already know how far that attack is spread, and you could just focus on the incident itself and the recovery piece is ready to go whenever you need it. So with that, I think we're now going to... Oh, no. We're not. In terms of sort of what I said there, the data on prem, you'll often see us refer to this as NAS CD or NAS cloud direct. You can see the breadth of coverage there. It's a lot of stuff. Right? All of the big giant NAS systems that you're used to. And, I mean, if you don't see yours on here, I mean, there's more and more coming out all the time. There's also sort of generic SMB and and NFS providers that we have. So we can... As long as your NAS system provides SMB NFS, Rubrik can usually back that up for you, archive that to cloud, do all the data discovery, all the data classification, all that fun stuff. The next piece is going to be CMP or what what I mean by that is cloud native protection. So this is for your unstructured data in the cloud because, obviously, it's gonna be a little bit different there. Instead of having that transient VM, we have a transient, Kubernetes pod that we deploy and it gets spun up. But it's pretty much the same code. It's just optimized for cloud, and that's how we back up things like s three, blob, all the new sort of iceberg data lake stuff, Google BigQuery, all that all that sort of fun stuff, as well as the filers and different things in the cloud like EFS and and FSX. But the whole message here is no matter what you're backing up, we're a platform. Right? Rubrik is a platform place, so we can deliver you a consistent sort of look and feel, to everything. So number one, whether it's on prem or whether it's in cloud, it's a single policy engine. Right? You define what you wanna back up, how long you wanna keep those backups, how often you wanna take them, whether you wanna archive or do replication, things like that into a policy, and you just apply it to your workloads no matter where they are. The same deal with ensuring that our backups are air gapped and immutable because backups are pretty useless if they get encrypted right along with the entire attack payload. So we ensure that those are air gapped. They're outside of your identity domain. They're marked as immutable. So once they hit the Rubrik platform, they can't be changed. They're basically always gonna be there as your last line of defense. The flexible restore options, again, when you go to restore, you know, where do you wanna restore to? Do you trust that production environment still? If so, go ahead, restore in place. We can we can do that very quickly. Do you need to go to a new environment, whether that's a new data center or a new cloud account? Simply onboard that new account to Rubrik, and we can start placing your data there. So the options with Rubrik are are... In terms of recovery are are very, very flexible. Same with, like, granular surgical recoveries. So if you want to, recover, you know, just a few files or things like that, if it's if it's more of an operational concern, we can do that as well. The pre populated clean recovery, we talked about that. That's our preemptive recovery engine. That's a huge, huge value add that Rubrik provides. It's really what sets us apart from, you know, sort of traditional data protection vendors and moves us into sort of the security and the resilience piece. We do all that work ahead of time. So as soon as you log in to the platform, you already know what you need to re... What you need to recover and when you need to recover too. And then, of course, everything's, underpinned by an API first architecture. I stress this because we have a lot of cool things, in terms of AI coming out like Rubrik AI where you can manage the platform, using Rubrik Intelligence inside the console as well as the Rubrik MCP, which allows you to, you know, connect Claude or Codex or or whatever you have to Rubrik and to other solutions as well and kinda just chat back and forth and and, you know, just start creating some pretty cool automations and things like that. So with that, we're gonna get into actually how the... These solutions work. I'm gonna go through a few different examples here in cloud. And you can just build this right out of Pickup if you want. It's probably the easiest way. So essentially how we back up, in this case, what are we looking at here? We're looking at s three. So so how we back up s three? And this is gonna be very similar in terms of Azure Blob and as well as in terms of, GCS, which we have coming out shortly. But the idea really is in terms of AWS s three, we're gonna gain access from a Rubrik account using customer specific credentials. We're gonna leverage a cross account role that gets deployed into your environment. I should mention for that cross account role to be deployed and for what we call Rubrik exo compute, which we can see down in the the middle of the second box there. That's that transient Kubernetes pod that responding up to do data movement. But how they get deployed is through a CloudFormation template. So, you don't have to go into your account and create a bunch of configurations. You simply give us your account number in the Rubrik platform. We'll go out create that that CloudFormation template, and then you can launch that. Or you can use Terraform, you know, which a lot of our organizations do. Or if you use AWS organizations and you have a 100 accounts, you can onboard them all at once. But, basically, we assume that cross count role, it has a number of permissions that allow us to, number one, take backups, and you can leave it at that. We can just take backups if you want. And then when we go to restore, you can elevate those so it adds restore permissions. That's kind of like a true least privileged access, solution that we have. Or you can give us all the permissions we need. Either way, it's just gonna be whatever permissions we need to do backup and recovery. We're not gonna, you know, take a new in type per, permissions into... So what we do is exocompute gets spawned up. We'll go ahead and we'll mount that, source s three bucket to exo compute. And this is kinda simplified, but it is like parallel processing. We can do, you know, up to, like, into the billions of objects in terms of of what we can back up, and we can do this at at really good performance and really good scale. You know, we kinda pride ourselves on that. So if it's a first backup, obviously, it's a full that we're we're gonna take. If it's subsequent stuff, we're gonna create, a delta of all the changes that have changed between the latest backup and this backup time, and then we're just gonna start transferring that into, a backup location of your choice. Now this slide illustrates that we can put it in, you know, the same region within the same account or an alternate region within the same account, or you can go to an alternate region in a completely different account. That's obviously best practices. You wanna get that data outside of one account, host it in another account. That way if, you know, your production account becomes compromised and you can't trust it, it's an easy path to sort of walk away from. Or you can use Rubrik Cloud Vault, which is essentially storage hosted by us. So in the terms of AWS, we're gonna host it in AWS, but Rubik's gonna own and manage all that. You don't have to do... To basically lift a finger to to do that. So we're gonna move those backups over. We're gonna use s three object lock to mark them as immutable. Hopefully, we're gonna air gap them into another account, generate a bunch of metadata around what we just backed up, things like file hashes and, things like deltas and changes. That information all gets uploaded to Rubrik Security Cloud. Data stays within the confines of of your organization. We just get the metadata. That's what we use to do things like anomaly detection, object level recovery, and different things like that. And whenever we're done, we go ahead and we spin down exit impute and, basically, get rid of all those mount points that we had access to. Restore for this, pretty much the opposite of this this process. But this one is is pretty unique in terms of, feature that we released. Oh, I don't know when it was. Probably probably about a year ago now. But prioritize recovery is a a pretty cool solution. So like I mentioned, if you have billions of objects sitting in an s three bucket and you go to restore them, you know, you kinda wanna dictate the priority of that because you might have a bunch of garbage data that you just keep around for for compliance reasons. Right? But you might actually have some really critical data that you'd like to get back first. What prioritized recovery allows you to do is you can specify within Rubrik Security Cloud sort of a regex, or a glob pattern to say, hey. I want this data to be recovered first. And what Rubrik will do, we'll go ahead and we'll assume that cross count role. We'll spark up exit compute. We'll mount to the the bucket that contains the backups, whether that's in the same account, different account, or Rubrik Cloud Vault. And Rubrik will start putting that prioritized list of objects back, first. So back into the production account if that's where you're recovering to or into another account like that. Basically, that prioritized list is gonna come back first. So you can get your critical sort of mission critical data back first and then let, you know, things like holiday pictures from from last year's Christmas party or something like that trickle in after. Right? There's no point in waiting on them before you get your your mission critical stuff backed up. We move on to the next one. We're gonna talk more about some of the lakehouse solutions now. So like I said, lakehouse... And I see questions there as well about Databricks. I don't know how far we can go on this. Databricks is coming. It's on the short term road map. We started with AWS and Iceberg. We moved into BigQuery. Databricks, is the next solution that we will be we'll be coming out with. So, Ayush, hang tight. We will definitely, get you covered there. Now in terms of, again, Lakehouse here, we're, illustrating AWS again. So in AWS, we support s three tables and we support AWS Glue. So those are the two ways we we support in terms of backing up your Iceberg data. Same sort of deal. We're gonna assume that cross account role. When you onboard, we add the additional permissions for the the lake house stuff for the iceberg stuff. And we're gonna go ahead and call sort of the API endpoints to back up, you know, a targeted snapshot. So there's a few different options. You can... You you know, by default, we're gonna go after the latest compacted snapshot. If if we don't see that, we'll just we'll just pull the latest one by default. You can also specify a tag snapshot as well. So if you have, like, a a month end process or something like that and you tag that snapshot, we'll go ahead and and, we can... You could point us at that tag, and we'll go pull all the data there. The big thing about this is, you know, we're gonna transfer all that. We're gonna mark it immutable just the same as s three, everything like that, but we're actually gonna back up everything. Right? So not just the s three bucket that contains the data. Obviously, you know, backing up just just the tables is kinda useless without the catalog, without the manifests, without all the snapshots and different things like that. You won't be able to query it. So we back everything up. We mark all that immutable. And if you flip again to the next slide, Opika, when we go to restore all this stuff, it's kind of that same process. We're gonna put it all back in place and we're gonna re register everything, in the recovered branch. So I should have mentioned this. You can target recovery at a new branch. So if you are, you know, going back in place, you don't have to overwrite what you currently have. You can you can test on a new branch. But we're gonna target all that stuff. We're gonna rewire all the catalog and everything to point at that, and you can query this stuff immediately. Right? There's no, like, need for engineering time afterwards to rebuild catalogs or reimport or reregister tables. Rubrik's got all of that, taken, taken care of for you. So that's what I have do... For you today in terms of of cloud unstructured, and I'm gonna pass it back to Opika to talk a little bit about how the on prem stuff works. Thank you so much, Mike. So very similar to what you saw what... When Mike was presenting, there was an exocompute that gets spun up to do all the data movement. We do have very similar concept for your on prem stuff as well. Now, essentially, for the NAS CloudDirect solution, there are three, components. The first one is, of course, your own data center or your cloud tenant, where the source lives. And this is where the stateless virtual machine gets spun up. Like I said, it's stateless, so, it's not going to be around for long. It only gets spun up when the backup or recovery op... Operation is actually ongoing. So this stateless virtual machine needs to live in your cloud tenant or your data center, but it needs to be close to the source. The next part is the Rubrik managed control plane, which is what is Rubrik control... Rubrik Security Cloud. That's the centralized platform. Again, like, you will get an account. You don't have to do anything. We do have, another control plane, basically, that hosts all the index database, and all the metadata. Again, you don't have to do anything. We we manage it. All communication is secure. All the data is encrypted. Just FYI, we have a white paper to... Detailing that, but, be rest assured, everything is safe and secure. And the third component is your target, like, where the backed up data actually is. So, surely, we do offer multiple options just like the cloud. We do have the RCV or Rubrik Cloud Vault option where Rubrik manages all the storage, etcetera, and you just pay a subscription fee for it. Or it could be your own cloud account. We don't care which cloud, but, it's all up to you. Or it could live on prem, your own data center. Now, the way it works is that, again, like, right when you, onboard, you will obviously apply some SLA engine, detailing when the backup should happen, how often, how long it, needs to be retained for. Right? And that's it. Once you apply it, you're good to go. Rubrik manages the entire data life cycle. So when it's time to back up, the stateless virtual machine is spun up. It connects to your source and scans the entire file system. Now whatever data is identified is as new is red. Now, if it's your first time backing up just like the cloud, the entire back, like, the entire data backup happens. After that, it's all incremental. Once the data is identified, it's, indexed and then moved essentially to where your target is. So it could be one of the other options, multiple options of target. And then the metadata is then, moved to the control plane and committed as well, like the job status and whatever the metadata was calculated. Like Mike said, the metadata essentially is when was the file created, who owns it, what are the directory permissions, things like, when it was last modified, hash values. We do a lot of calculation. I'll get to that in just a little bit. But it's it's never your data. It's data that can help you identify that file so you can actually do, file level recovery. You can search, through RSC, and if you need to figure out which snapshots have that file, you know, you can search in Jupyter, Security Cloud. Once the metadata and the job status is completed, the virtual machine gets spun down. So that at a high level, that's what the architecture look... Looks like. Now let's get into how it, like, a little bit granular details as to how the entire backup process works. The stateless virtual machine has multiple steps to figure out, how the backup will take place. And I do want to, highlight one thing that the stateless virtual machine, the total throughput is about five GBPS. So, based on what performance you need, for backing up your data, you can actually multiplex the VM. So you can have multiple VMs in your infrastructure, and it will go at line rate. So your backups can actually finish faster. And, also, to, for backup or recovery operation, we actually spin up multiple threads. It's not a single threaded operation. So these multiple threads will actually do, you know, the scanning, the indexing process, or even moving the data. Everything that happens is done in parallel so we can actually get, a a faster solution, and, also, we can maximize, the throughput at this point and the bandwidth as well. So first off, again, like, first will be the scanning process. The stateless VM will connect to your source NAS and, read the data and identify what is new. And then... Actually, it'll read the data first, and then it'll talk to the index database that lives in the control plane, and gets the previous snapshot to do the comparison of what is new. Once that, diff is calculated, essentially figure out, like, what is current and what is previous. And if there is new data, the diff is calculated. And then that diff data is then read directly from the source, and then it's either grouped or chunked. Now the concept of grouping is is that if if the diff files are smaller, we group them together, into a single 100 MB file. Or if the files are larger than 100 MB, we chunk them, in 100 MB files, so that it's easier to essentially... It's it's more efficient, essentially. And then we apply data compression using l z four algorithm. Essentially, we compact the data and then move it to your destination, where the data will live. Once that process is completed, we also take the metadata, commit to the, IndexedDB. Once the acknowledgment from host, from the target, storage comes that, yes, the operation completed. So this is, at the high level how the backup process, works. We do wait for all the data to be basically backed up to the target storage before we commit to just to make sure that, there is no data corruption issue that arises later. Now the recovery is literally the reverse. Once the user... It can be for an entire file share, your entire directory. It can be a single file. The process is the same. The user goes to the UI, figures out which snapshot, it wants to recover from what data, identify it, and then kickstacks the process. As soon as that happens, stateless virtual machine gets into action, and, the restore service kicks in. It, essentially, contacts the index database and, figures out all the files that needs to be restored and also figures out where exactly in target, storage it's, it's actually living. Then it creates a restore plan. Now do you remember, right, like, we actually chunk the data or we group the data. So we need to figure out, as in when... At what step, what data gets restored, right, to stitch them together. So it essentially creates a restore plan. And then once that is created, the data is then read from your target, storage. Now it's collected in two passes, one for the small files and one for the large files. And while we are putting it back to the storage NAS, the the sequence of operation is essentially when you are... It's NAS storage. The... First of all, the directory tree will be restored if you're obviously restoring the entire directory. Then the large file is restored, then the small files, and then the permissions are up... Are, applied. Now if you're just doing a file, of course, there won't be any directory tree, but this is for, like, large scale mass restore operation scenario. And if you are recovering your object data, then first, the object data with metadata is restored and, for... Then the small, object with metadata is restored. We do also offer another cool feature with NAS CloudDirect, which is a copy functionality. It's a slight... It's slightly different than backup or recovery. So this is... This can be a onetime operation if you are migrating from, an older NAS to a newer NAS or if you're migrating from on prem to cloud, one vendor to another, it could be multiple use cases. Or if you're moving data for your... Because you want to train your AI. Right? So it can be for multiple use, but it's the same functionality underneath the covers. Now how does it work? Once you... Either you create an SLA to do it at a regular, interval, or it can be a one time operation. So once the job is scheduled, the stateless virtual machine again gets into action. It reads and scans the source NAS. We'll go talk to the IndexedDB in the control plane and get the previous copies, index data. If it's your first time, it'll move to the... It'll skip this step essentially, but let's take, like, subsequent copy as an example. So, again, it will produce the diff, between the two copy operation and read the data that is, the diff data. And then just copy it to the target NAS or cloud. One thing to keep in mind is that, like, you know, when... In the previous, like, backup operation you saw, we did, like, the grouping or chunking, and then we also did compression. But in the copy copy operation, we do not touch the data. We literally take the data and move it In the same format, we don't do anything to the data. So, it's best, use... It's a best copy tool when you are... Like I mentioned, like, if you are moving across different vendors or moving across on prem to cloud or vice versa. And then, of course, at the very end, we will commit the metadata to the NextDB, once the operation is completed. I will just pause to see... Mike, any questions I need to answer so far? Oh, there's a question about compression ratio. I don't know if we have hard and fast numbers because I know, like, it it varies, right, depending on the type of data we're processing. of... Like, Exactly. video files don't compress well. But. there is reports I believe in RSC though. Right? Like, reduction. reports, So... I think, that Yes, that will have it, but, yeah, it'll... That will depend on the type of data, you are moving. So, your Rubik Security Cloud will have that information handy for you. Now Mike also talked about identifying, you know, a clean snapshot for recovery, and we do a lot of, lot of, things with the backup. When I say things, there are multiple things we do with the backup, to identify the blast radius, especially for our preempt... Preemptive recovery engine, to to make sure that when you recover, you have... You are recovering from a clean copy. So how does that work? Now just remember this process works the same way, whether it's the cloud piece, which Mike talked about on NAS CloudDirect. It's the same process. It doesn't matter, what, what, it could be hypervisor. It'll be the same. Okay. So first off, during or rather the... After the backup process is completed, we do a entropy scan on the backup data, and the results are sent to Rubik's Security Cloud. Now the second piece of that is actually the anomaly detection detection aspect. So we, you know, we both talked about, like, committing metadata. Now we take the committed metadata, of the previous snapshot, and we compare it to the most current, backed up data's, metadata, and we essentially create a diff. Now this diff is then sent to an anomaly detection machine learning model. It's a multistage machine learning model, and it's trying to figure out if there are any massive deletion events. Now think about it. Mike, if you don't mind, can you go on mute? Sorry. Thank you. So, Rubrik, over time, learns about your infrastructure and sees what's a regular pattern, what what is a regular rate of deletion, And it's essentially looking for, anything that is out of ordinary in your infrastructure. So, once it goes through the machine learning model and if there are any anomalies present, like, which objects will... Which objects have these anomalies, things like that. What is the anomaly? Which folder had these massive deletion events? What, what files were added? What were the new files that were updated, things like that. That information is then sent to our anomaly detection UI. Moving on to the entropy aspect, you know, once the entropy scan is completed, it is the results are sent to the ransomware SS table if there is any entropy. If there is none, it'll skip it. But if there are any, entropies found, any encryption events, it is sent to, the SS table, and then that goes through the encryption detection machine learning model to look for what kind of encryption we are looking at. We obviously look for the most common to the most oldest. And once the results are out, that is sent to the anomalydetection.netnet, you will get the list of the objects that are affected with snapshot it was seen in, what kind of encryption you are looking at. So that way, you have a holistic picture of, what to recover from and what are the affected snapshots. And if you're going for granular recovery and if you don't want to, you know, recover your entire bucket, you might do selective recovery, based on, the the, details from anomaly detection as well. We have two more products that fall under the data threat analytics bucket. One is called data hunting... Threat hunting, and one is called threat monitoring. Now threat hunting is, is is sort of passive tool, or post attack tool that you can use, to figure out, which other objects are affected. So, essentially, you can, hunt for threads. It could be in the form of Yara rules or it could be, hash values. Just depends, how fast you want the results. And, also, you know, if if there are objects that you're not protecting probably, or it was not seen initially, why are threat hunting? You can figure out if other objects are affected. And, again, it gives you the same information with snapshot, the threat was first detected and how well... How far it spread. Threat monitoring becomes the active monitoring of your environment, where Rubrik is continuously looking for any active threats. How does it work? So, once the backup is complete, Rubrik uses a threat intelligence feed. That is, initially, it just comprises of, our threat feed. Essentially, it's from Google Threat Intelligence, and it has the latest and greatest zero day threats available. So anything that is most prevalent currently across the globe is what this threat intelligence has, and it's updated several times during the day, to keep up with anything new that has, that has popped up in the threat intelligence feed. Now customers also have the options to, have option to add their own, threat intelligence feed if you are subscribing to other vendors or you have list of your own IOCs. You can add it to the threat intelligence feed. Once this is ready and the backup is complete, Rubrik will scan the backup and essentially create a threat catalog. This basically is the hash values, of all the all the data we've backed up, and we look for threats. And then if there are any threats in the trash, threat dashboard, the results are, published. So this will also contain, again, like, the object that is affected, the snapshot, that is affected, which is a safe recovery point and things like that, to make sure that you can recover from a clean snapshot. Right? So it will give you that holistic picture. Now if you are running, threat hunting, as a user, you will go to Rubik's Security Cloud, enter the Yara rules or hash values, and then it will scan the backup for, those threads. Again, like, if if Rubrik missed some objects, via threat hunting or anomaly detection, Turbo Threat Hunting can also help you figure that out. Or if there are more snapshots that are affected, more than what the other two tools gave you, it it will again give you the holistic picture of every snapshot that is affected. Again, the results are displayed on the thread dashboard. What can you do with it? You can actually quarantine the affected snapshot so, you know, an admin doesn't accidentally recover from that, affected snapshot. So that helps you contain the thread and... So it doesn't move to other parts of the backup or, other parts of your own objects. Okay. Now the next set of tools is data discovery and classification. Now remember I talked... We both talked a lot about sensitive data, actually. You know, unstructured data has a lot of sensitive data, so it's important to know where the sensitive data lives and who has access to it. And, again, like, across cloud, across your on prem, it's it's it's a vast, you know, data store out there. So once the backup is complete, essentially... Oh, before that, from Rubrik Security Cloud, you, can go and apply, some policies to your data, like, policies, like, what are you looking for? Like, if you pertain to, medical industry, do... Are you following HIPAA compliance or not? So Rubrik has, a lot of data analyzers and data, policies, to look for that kind of sensitive data. So when I say data analyzer, it will look for patient record number. It will look for if there are X rays, where is it located, things like that, your Social Security number. So it's trying to figure out, where that sensitive data is located. So, essentially, once you apply the policy to the backup, to to your objects, once the backup completes, the Azure Compute is launched, and then it will apply all the, you know, different policies. So it could be HIPAA, PII. It could be one... It could be your own your own policy. If you don't have it, you can create your custom policy as well. So once this is applied, it will start scanning your backups, for figuring out where this sense... If you have any sensitive data, who has access to it, and where it's located. So if there are any violations found. So if there are supposed HIPAA HIPAA data and if everyone has access to it, that is actually a violation, because only people who need access should have access to that data. So we are looking for these kind of violations. And if there are no violations, great. Nothing is displayed. But if there are violations, we will, display, the object essentially where that data is located and who has access to it. So you can lock down your data before any cyber event happens. You can give it to your compliance team, and they can take care of... Take it... Take care for you. Or, if you do have a cyber event, you can give it to your legal team to figure out any sensitive data exposure you have. And that's about it. So, I'm gonna pause here first. So, just to complete the story from where we started, Rubrik offers you a single SLA policy that, with which you can manage your unstructured data everywhere. So whether it's in cloud, or on prem on prem object, everything, can be managed via Rubrik. The backup and recovery operation works the same way. We do have, multiple tools, that can help you identify the blast radius and help you recover from a clean copy. Again, like, it's very important to know, where your sensitive data lives. So about 40%, I believe, is the stats which Mike shared that it's sensitive in nature, 40% of your data. So you could be looking at a lot of sensitive sensitive data exposure, if you don't log down your data. And for that, it's important to know where it lives and who has access to it, and Rubik helps you do that. And all of these operations, again, can be performed via a... The APIs. You don't need to log in to RSC. So, again, like, we offer you a platform, for your data. We have others... We have very similar solution for SaaS and for your on prem databases as well. Not going to cover that. But, again, like, it's a platform for all your, unstructured data and other type of data. Mike, did I miss anything? No. No. I think you you summed that up good. You You know, just a re... There was a there was a question around the anomaly detection model and, like, the types of data that was sent up there, but I think I addressed it. But just to kinda. say it out loud, we don't actually have customer data itself go through the the model. It's just metadata around things like access times and the type of file it was, number of files added, stuff like that. The only time Rubrik actually reads the data is for things like sensitive data classification because, obviously, we have to read it to to determine whether it's sensitive or not, and. that happens within the customer account. Like, that doesn't happen up within Rubrik Security Cloud. That... All that work happens within the customer account. So that's... We'll use exo compute or the stateless VM or whatever to to actually read that data, and classify it. Okay. There's something about the gov cloud. I am not sure about this one. Like, the... Does this apply to gov cloud as well from data classification perspective? I believe so. Yeah. All the the census data, the monitoring's available on the provide... The hyperscalers cloud. like government, yeah, the the one that might be different would be anomaly detection, and I'd have to double check on that. Okay. There's an interesting question. Like, let's say my data point is at point a and additional data is added between point a and b. Okay, if Rubrik anomaly detection identifies corruption at point b and I roll back to point a, can I still recover to the noncorrupted data that was added between a and b? In other words, can Rubik selectively recover the valid data from... Yes. Oh, that's a great question. So say you'd recover to point a, and you have identified the files that were not corrupted or not infected by, the ransomware or the entropy event, then you can actually use the, the search functionality. Like, you know, when we talked about metadata, you can go to Rubrik Security Cloud, and search for those files and, recover them on an, file to file basis as well. Okay. I think we have answered pretty much everything. We have a few minutes. I just wanted to, show you the story lane which Mike and I have put together for you. This is what, you will get from our team. Hannah, if you don't mind, can you please add the guided lab as well? It's in the chat as well, as the docs tab. So you will... You can, start playing around with it as well. So, the idea here is that we want to showcase the maximum functionalities for cloud as well as, NAS CloudDirect. So we have... The first one is for unstructured data for NAS CloudDirect. Now this one, actually talks about onboarding, SLA policy, SLA assignment, all the data recovery options, anomaly detection, threat monitoring. It's a big one, and threat hunting, the data discovery and classification as well. So everything that Mike and I touched upon, is covered as part, as a a part of the lab. And, again, like, it works the same way for, the cloud piece as well. Yeah. So we've added the protection, of Amazon s three with RFC. Again, this will, give you the introduction to the lab onboarding assignment very much, like, fast efficiency recovery and things like that. So you can actually go through the labs and see for yourself, how similar, like, the onboarding, the SLAs, and the recovery option looks like. It doesn't matter what your recover... What unstructured data you're protecting or recovering. It's the same. And, yeah, you can use the right and left arrow keys, in Storeland to move through, the demo. You don't have to keep clicking. That's one tip. Anything else, Mike? No. I just wanna say, like, there was a question about whether or not we have labs that people could run through. So I I did address. it and said, yes. We have these labs. But just, like, shout out to, like, if you're very interested and you wanna actually see a live environment, definitely get in touch with, like, your local sales team. They can get you in what's called a camp rubric, 100% free. You can go in there. We give you live environments, live cloud accounts, live data, and walk you through basically, you know, a number of different scenarios. So I would I would certainly reach out to your sales team if if you're interested in something like that. Absolutely. Yeah. And it's one of... Whenever we've run camp rubrics, what we hear is, like, it's always full, so take advantage of it. And I do want to highlight that you can get this super cool amber mug. It actually keeps your coffee warm. You can get this mug if you take a meeting with Rubrik. So our team will reach out to you, and you can have super warm coffee whenever you need. So do take a call with us, and you can get more information, from our team as well. With that, I will leave leave you with a couple of, technical white papers and resource pages. And, of course, we always want your feedback, so, do give us feedback. If you like to see more or less of this content, you... Any topics that's of interest, anything, we can change to make it more interesting, anything you want, like, give us your feedback. We both are here doing this a lot of times in a month, across different workloads. So we always want to hear, what else can we do to make this better. Other than that, you know, we are at the top of the hour. the, the link's not working for the lab, Elpica, so we're gonna have to address that. Oh, the lab... Oh, It me... says it's no longer live, Okay. Sorry. Give me a second. Okay. I am make sure. we get that taken care of. Yeah. I am adding, I think. it's? doing that. Just super big thanks to everyone for showing up and super big thanks for all these questions. Like, this is, this is great. It makes these much. more enjoyable. Yeah. Can you all please try now? Hannah, if you can please update the link, that will be great. I'm sorry for sharing the wrong link, Hannah, and to everyone if you... It should work now. Thank you. Yeah. And, thank you so much for taking the time and asking us great questions and, listening to us. Yeah. We'll be around for another minute if you have more questions. It looks like the updated link is in the chat. It is in the chat. Yeah. Alright. I'm gonna pin it. Awesome. Thank you all. Have a good day, and see you next time for another event. Thanks, Mike. Bye.