📝NOTE: The availability of this feature may be limited based on the license type, region, and other criteria. To access this feature, contact support.

Threat Watch is your early warning system. It continuously scans your backup data to find Indicators of Compromise (IoCs)—digital fingerprints left by hackers, such as specific malicious file extensions or unique file IDs (hashes).

The following video provides an overview of the Threat Watch feature.

Backups often reside outside the scope of primary security tools, creating a vulnerability where dormant or hidden threats can persist. This can lead to serious issues, such as 0-Day attacks or ransomware with extended dwell periods, as these threats remain undetected within the backup environment.

If you accidentally restore a backup that contains these hidden threats, you could re-infect your entire system. Threat Watch prevents this by identifying and isolating infected snapshots before you ever try to use them.

Threat Watch is currently available for the following environments:

To access this feature, from the Druva Cloud Platform Console, go to the Global Navigation menu > Cyber Resiliency > Posture & Observability > Threat Watch. Click Threat Watch. You will be redirected to the Threat Watch dashboard page.

You must have a Premium Security SKU license and have a Druva Cloud Administrator role to access this feature.

Step 1: Backup - New data is backed up successfully and the snapshot/restore point is indexed (Threat Scan eligibility for snapshot/restore point).

Step 2: Automated Scan using all the IOCs (Files Hashes and File Extensions) from the IOC Library. Automated Scans are of two types:

Step 3: Alerts - Threat Watch - Match Found alert type alert is generated on detection of IOC matches during the scan.

If subscribed to the emails for alerts, a high-priority email notification is sent instantaneously with the subject: Threat Watch: Match Found if there is an IOC Match found in a snapshot.

Step 4: Auto-Quarantine Settings option, if enabled, automatic isolation or quarantine of infected snapshots/restore points to prevent restore of infected data.

Druva uses two primary methods to scan your data:

Security is time-sensitive. Upon a confirmed IOC match within any resource’s snapshot/restore point, the system generates an immediate Threat Watch - Match Found alert.

💡Tip: Click on the alert (bell) icon on the top main console bar to view alerts.

If you have subscribed to the emails for alerts, a high-priority email notification is sent instantaneously with the subject: Threat Watch: Match Found if there is an IOC Match found in a snapshot.

These alerts can be integrated into your external SIEM/SOAR workflows via API. For more information, see

The Threat Watch dashboard gives you a high-level summary of your security health. It includes Scan Summary tab and Impacted Resources tab.

Provides a summary of threat scan results for all resources.

1. Last Scan Summary (The Big Picture)

2. Threat Results for a period of 30 days (The Warnings)

3. Impacted IOC Sets - It provides an IOC Centric View of ransomware activity. Users are presented with a timeline graph that illustrates the infection trend and the count of files detected as matching the Indicators of Compromise (IOCs).

Provides a summary and detailed view of threat results for each impacted resource.

Impacted Resources Summary view

Use the Filter icon, to search and filter the list based on Resource Type and IOC Set criteria.

Impacted Resources Detailed view

Click on the resource name to view the following details for that specific resource:

As Druva scans, it labels your "snapshots" (saved versions of your data) with colored icons:

You can use the Download Report option to download Threat Watch snapshot level detailed reports for offline investigation and auditing purposes.

The data is downloaded in a compressed file format when you click the Download Report option. Following is an example of the file naming convention of the downloaded file:

The Report includes the following information:

Track and monitor all the Threat Watch activities from Audit Trails.

It uses an IOC Library which is a constantly updated list of known malware signatures gathered from global security sources powered by Google Mandiant, CISA & ReconX Labs) + Bring Your Own IOCs!

Yes. By enabling Auto-Quarantine Settings, Druva will automatically lock down any snapshot where a threat- IOC Match is found.

You can click on any Resource Name in the dashboard to see exactly which files were flagged and the date they first appeared.

Yes. In addition to Druva’s global threat library, you can upload your own custom Indicators of Compromise (IOCs). This allows you to run personalized scans against your backups to identify specific threats unique to your environment.