Overview
The greatest challenge in recovering from a cyber attack isn't just restoring data—it’s avoiding re-infection. Cyber Recovery for AWS (EC2/EBS) and Azure VMs bridges the gap between backup and security, giving you the tools to identify "clean" recovery points before they ever interact with your production environment.
Why Cyber Recovery?
Earlier, administrators had to guess which backup snapshot or recovery point was safe. Integrating Cyber Recovery directly into the restoration workflow eliminates guesswork. By identifying non-impacted snapshots, you can eliminate the risk of re-infection and reduce your Mean Time to Recovery (MTTR).
The Workflow
When you initiate a restore for an AWS or Azure workload, the process now follows a security-first intelligence path:
Locate the Cyber Recovery Tab: Navigate to your resource’s Recovery Points tab to access the new Cyber Recovery sub-tab. View high-level health data populated for each snapshot. It offers an instant assessment, showing which recovery points are compromised and which remain secure for restore.
Pre-Recovery Threat Hunt: Trigger a Threat Hunt to find the Last Known Good Backup. Threat Hunt performs scans to find specific patterns across multiple snapshots or recovery points to find the exact moment before the infection occurred. You can Isolate and Quarantine affected snapshots here.
Integrated Restore Scan: Run a final IOC Scan or Antivirus scan directly in the Druva Cloud to verify the restore point is 100% clean.
Feature Summary
Feature | Description | Benefit |
Cyber Recovery Tab | A new centralized view within the AWS/Azure restore workflow. | Instant visibility into backup health. |
Pre-Recovery Threat Hunt | Deep-dive analysis of snapshots or recovery points. | Pinpoints the "Last Known Good" backup. |
Integrated Restore Scan | On-demand IOC and AV scanning of restore points. | Prevents environmental re-infection. |
Licensing requirements:
Security Posture & Observability / Accelerated Ransomware Recovery: Access to Cyber Recovery tab.
Premium License: Full access, including Threat Hunting details.
For detailed instructions, see: