This article provides information about release details on Ransomware Recovery, Security Posture and Observability, and Data Loss Prevention.

Introducing Security Command Center

A centralized dashboard that highlights the overall posture of the Druva environment in terms of:

The Security Command Center console is the starting point from where you can view the security risk details for your Cloud Platform and data sources and monitor its overall security health.

It also provides actionable guidance on corrective actions that can be taken to mitigate identified risks, such as those related to cloud platform security, data compliance, data protection, and data access. By regularly monitoring the security and risk posture using the Security Command Center console, you can proactively identify and address potential security risks, helping to ensure the security and compliance of your organization's data.

For more information, see Security Command Center.

Customer action required: None

This release has minor bug fixes.

This release has minor bug fixes.

This release has minor bug fixes.

Quarantine infected Microsoft 365 and Google Workspace resources

You can now isolate the infected resources that belong to Microsoft 365 (OneDrive and SharePoint Online) and Google Workspace (Google Drive and Shared Drives) to prevent the infection from spreading.

The Quarantine Bay feature in the Ransomware Recovery module enables you to quarantine infected snapshots on the impacted Microsoft 365 (OneDrive and SharePoint Online) and Google Workspace (OneDrive and SharePoint Online) resources and helps safeguard your organization from further infection by barring users or administrators from downloading or restoring the infected data to other data sources.

For more information, see,

Customer action required: None

This release has minor bug fixes.

This release has minor bug fixes.

Data Lock support for snapshots

With Data Lock support, you can now protect your data from accidental or malicious deletions. You cannot delete the snapshots from Ransomware Recovery >Quarantine Bay if Data Lock is enabled for resources (Endpoints, File Servers, NAS, and VMware) within the backup policy.

For more information, see

Customer action required: None.

This release has minor bug fixes.

Unusual Data Activity (UDA) events integration with Splunk

With this release, we have integrated Unusual Data Activity (UDA) events with Splunk, which allows you to view UDA events. For more information, see the Druva Add-on for Splunk.

This release has minor bug fixes.

This release has minor bug fixes.

Refreshed Data Loss Prevention (DLP) page

We have refreshed the Data Loss Prevention (DLP) page to provide an enhanced and intuitive user experience.

Here is a preview of the Data Loss Prevention (DLP) page.

Key highlights

Customer action required: None

For more information, see Data Loss Prevention Overview page.

Protect mission-critical backups from accidental or malicious deletion with Rollback Actions

You can now configure the Rollback Actions capability to enhance your organization’s data security posture and safeguard backup data from accidental or malicious deletion.

With Rollback Actions, you can rollback deleted entities within a configurable rollback window. The deleted entities are available for rollback for the specified days before the entity and its backups are permanently deleted. This provides the administrator the ability to revert malicious or unintended deletes without any loss of data and enables the restoration of productivity rapidly. If you have consciously triggered the deletes, the backup copies will be permanently deleted after the rollback window expires and there will be no impact on what you were trying to do.

Action Required: Existing Ransomware Recovery customers will get this offering as part of their existing license. Customers who don’t have Ransomware Recovery license can opt to purchase the Backup Security Posture and Observabilitylicense exclusively. To obtain the license, contact Support.

📝 Note
​Currently, this feature is available only for Druva Public Cloud customers.

►Here is a quick video to get you started

For more information, see Rollback Actions.

Leverage the Backup Security Posture and Observability license to enhance the security posture and observability of your backup environment

We have added a completely new license, Backup Security Posture and Observability, which includes capabilities such as Rollback Actions, Security events and SIEM integrations (FireEye Helix and Splunk)

Also, the Security Events and Rollback Actions capabilities can now be accessed from the Security Posture category under the Cyber Resilience service.
​Action required: Existing Ransomware Recovery customers will get this offering as part of their existing license. Customers who don’t have a Ransomware Recovery license can opt to purchase the Backup Security Posture and Observability license exclusively.

Changed access path for Security Events services

You can now access the Security Events and Unusual Data Activity (UDA) services from the new Cyber Resilience > Security Posture services section.

Customer action required: None. With the Ransomware Recovery license, Security Events service is available by default.

For more information, see Security Events.

Quarantine infected VMware resources

You can now isolate the infected virtual machines to prevent the infection from spreading.
The Quarantine Bay feature in the Ransomware Recovery module enables you to quarantine infected snapshots on the impacted virtual machines and helps safeguard your organization from further infection by barring users or administrators from downloading or restoring the infected data to other data sources.

For more information, see,

►Here is a glimpse of the update

This release has minor bug fixes.

This release has minor bug fixes.

This release has minor bug fixes.

A new Ransomware Recovery Overview page

You can now get a complete picture of the overall status of each resource in a single pane of glass. Use the Overview page to view the important details such as the number of Quarantined Resources, Curated Snapshots, Malicious File Scan Jobs, Unusual Data Activity Alerts, and so on. With this view, you can quickly identify the actionable to ensure business continuity.

►Here is a glimpse of the update

Customer action required: None.

For more information, see the Overview page.

Prevent accidental deletion of Endpoints and Servers data

You will now be prompted to provide a reason when you delete a snapshot or file hash value. This capability will help prevent accidental deletions, and the reason will be captured in the Audit Trail for auditing purposes.

►Here is a glimpse of the update

Customer action required: None.

For more information, see,

Option to create Curated Snapshot from Quarantine Bay

You no longer need to go to Curated Snapshot UI to create a Curated Snapshot for Endpoints and Servers. Now you can create a Curated Snapshot while quarantining the resource itself. For your ease, we have now added this option to the Quarantine Bay UI as well.

With this enhancement, you have to navigate to Quarantine Bay UI, select the Resource Name, and click More_options > Create Curated Snapshot.

Monitor Curated Snapshots for endpoints and servers

We have now added Download Report functionality that helps you monitor and review the details of malicious files discovered while scanning the files to create Curated Snapshot for endpoints and servers.

Administrators can now generate and download the report in CSV format and get an overview of primary details such as the File Name, File Type, list of skipped files from Curated Snapshot along with its reason, and so on.

For more information, see,

Introducing Curated Snapshots for endpoints and servers

We are excited to bring in the Curated Snapshots feature to you that allows you to create a customized snapshot that is the latest, cleanest, and safest scanned file version available for restore. You can restore files for endpoints and servers from the Curated Snapshot without any security or malware risks.

This enhancement eliminates the need to perform multiple granular restores from various snapshots and thus accelerates recovery time and minimizes data loss in the event of cyber security attacks.

For more information, see Curated Snapshots.

At Druva, the security of your organization's data is our topmost priority. With the increasing risk of ransomware attacks, data breaches, and unauthorized access, now it's not only important to safeguard your data but also to have a response plan in place in case you face a cyber threat.

❗ Important

The availability of this feature may be limited based on the license type, region, and other criteria. To access this feature, contact your Druva Account Manager or Druva Support.

To help you protect the data minimize the risks of data loss, we have developed the Accelerated Ransomware Recovery module that aids you to do the following:

Realize Storage Insights - Subscribe to saved filters

Realize administrators can now subscribe to saved filters and be informed about the non-critical data growth in their organization on a regular basis. Filters can also be subscribed by non-Realize administrators or other staff in the organization.

For subscribe instructions, see About Realize Storage Insights.

Recommendations

Search Recommendations using Backup Set or Server Name

Administrators can now search and view particular Recommendations using the Backup Set or Server name.

Sort Recommendations

By default, Recommendations are listed in order with the backup set having the largest amount of non-critical data at the top and the least at the bottom. Now, administrators have the option to sort the recommendations based on the following parameters-

For more information, see About Recommendations.

Druva Realize is now enabled for ProductCloud Administrators

In addition to Druva Cloud Administrators, now Phoenix Cloud administrators can access Realize Storage Insights and Recommendations services.

Realize Storage Insights -More options to export Realize Storage Insights view

In addition to PDF, Realize administrators can now export Realize Storage Insights view using the following options -

Recommendations -Exclude non-critical file types from Phoenix Content Rule using Recommendations

Administrators can now update the Phoenix Content Rule associated with a backup set directly from a Recommendation and exclude the non-critical file types from backup.

Administrators have option to exclude the non-critical files either from a particular backup set or all the backup sets to which a Phoenix Content Rule is associated.

Use the Exclude Non Critical Data feature in a Recommendation to exclude the file types.

After update, non-critical file types are excluded from backup starting the next backup cycle.

For more information, see About Recommendations.

File Analytics - Option to export File Analytics view as a PDF file

Administrators can now export their File Analytics view to a PDF file. This feature helps administrators print their view or share it with other administrators for collaboration purpose.

See Realize Storage Insights.

Recommendations

Based on customer interaction with Recommendations, we have updated to make it more intuitive and clear layout to display non-critical data information and enable you to actions. See Recommendations.

Introducing Audit Trails - Log and monitor activities performed by administrators

Audit Trails captures the activities performed by the administrators in the Realize Managemen