Catch suspicious file activity in real time
The DataXray Alerting module continuously monitors activity where your files live, against rules your team sets. When activity meets a rule's criteria, it opens an incident and alerts your security team so they can act.
Alerts your security team can act on
Security teams need to know about suspicious file activity while there's still time to act. The Alerting module opens an incident when activity matches a rule your team wrote, and puts the rule, the path, the account, and how much has happened since on one page, so an analyst can decide. That covers the burst of changes ransomware leaves behind, and staff misusing files they already have access to.
An alert that says 500 files were deleted leaves an analyst with questions. An incident that names the account, the share, the first event, and the count so far is one they can work from the page it opens on.
An incident stays Ongoing while the activity that opened it continues. Each matching event that follows joins the record, so an analyst watching a burst sees the count climb, and sees it stop, without a second alert for every file.
An incident keeps the rule that fired it, at the version in force at the time, the account behind each event, and the notes an investigator adds along the way. Weeks later, the reason it fired and what was done about it still read as they were written.
From file change to closed incident
Configured to how you work. Your rules, severities, categories, and email recipients are set up around the shares your team watches. If you need something the Alerting module doesn't do yet, we can build it with you.
Collect
A collector receives file and directory activity from each connected system.
Detect
Each event is checked against your rules. When a suspicious activity is detected, an incident is declared.
Notify
Your security team is notified of the incident in real time.
Investigate
Your analyst works the incident from the page it opened on, with the rule, the events so far, and the account behind each event in one place.
Resolve
They add notes as they go, close the incident, and reopen it if something else turns up.
File activity alerting, under your team's control
Every incident traces back to a rule your team wrote, so each alert can be explained to an auditor, and rules work from the day the Alerting module is installed.
Your incident criteria, as rulesWrite rules on the type of change, the folder, and the account, and give each one a severity level. A rule can fire on a single event, or on up to 1,000 events within an hour.
One burst, one incidentEvents that follow a detection join the incident already open, so clearing out a share produces one incident and one email. A timeout and an optional event limit decide when the incident stops collecting.
The account behind each changeEvery change shows the account that made it. Connect Active Directory and each account shows as a person's name.
A record that holds upEach incident keeps the version of the rule that detected it, the file activity behind it, who last changed its status, and notes that can be added to but never edited.
Overview and live viewThe Overview shows what's unresolved by severity, age, rule, category, and account. The live view refreshes every second and shows whether collection, processing, and alerting are each working, so a quiet screen means a quiet estate, not a stopped collector.
Built on federal incident guidanceEach rule carries one of CISA's five severity levels, from Emergency to Low. The module supports two outcomes in the Detect function of the NIST Cybersecurity Framework, monitoring activity and declaring incidents against defined criteria. It supports these outcomes but isn't a certification.
For teams staying on-premises
Security tools are moving to the cloud, and many on-premises file estates can't send file activity records to a vendor's cloud, whether because the network is air-gapped, data has to stay in the country, or security policy keeps audit data inside.
The Alerting module stores file activity on a server inside your network, and file activity records never go to a vendor. Its rules need no learning period. Each one checks activity as it arrives, from the day it's installed.
Frequently asked questions
What is file activity monitoring?
File activity monitoring records what happens to files on a file server, such as what was created, changed, renamed, moved, or deleted, by whom, and when. Security teams use it to spot activity that needs a closer look, such as a sudden burst of changes across many files or data leaving a restricted share, and to investigate what happened afterward.
What is the DataXray Alerting module?
It is the DataXray module that alerts on suspicious file activity, starting with NetApp ONTAP. It matches activity against rules your team writes, raises an incident for each detection, emails the people named on the rule, and gives your team a place to investigate and close each incident.
Who uses it?
Security analysts who triage incidents, incident responders, the detection engineers who write the rules, forensics and insider threat analysts who work out what happened, and the assessors who show auditors that file activity is monitored and acted on.
Do I need DataXray to use the Alerting module?
No. The Alerting module runs on its own next to the systems it monitors. It can also run alongside DataXray.
Which systems does it monitor?
NetApp ONTAP today, through FPolicy, with activity from NFSv3, NFSv4, and SMB clients. Support for more systems, including Microsoft SharePoint, is on the roadmap.
What file activity does it see?
On NetApp ONTAP, the module sees seven event types. Files can be created, modified, deleted, and renamed or moved, and directories can be created, deleted, and renamed or moved. It does not report file reads, opens, or permission changes. A copy that leaves the original in place appears as a new file where the copy lands.
How does the Alerting module know who made a change?
Each event records the Windows SID or UNIX user ID the client reported. Connect Active Directory and the module keeps a read-only mirror of its users, groups, and computers, synced every 15 minutes to every 24 hours, so each SID resolves to a name.
How does the Alerting module fit the NIST Cybersecurity Framework?
It supports two outcomes in the Detect function of NIST CSF 2.0. It monitors activity to find potentially adverse events (DE.CM-03), and it declares incidents when events meet defined incident criteria (DE.AE-08). Each rule carries one of CISA's five severity levels, from Emergency to Low. The module supports these outcomes. It isn't a certification.
Can it detect ransomware?
A count rule, such as 5 modifications in 30 seconds under a share, catches the burst of changes that mass encryption leaves behind, and raises an incident while it is under way.
Can it help with insider threats?
Yes. A rule can flag one account deleting, moving, or renaming many files in a restricted share within a short window. Each incident shows the account behind every event, so your team can see who did what. Rules based on each person's usual activity are on the roadmap.
Does it use machine learning?
Not today. Every incident comes from a rule your team wrote, so each alert can be explained. Machine learning, and AI help to speed up investigations, are on the roadmap.
Does it take any action automatically?
No. The module detects incidents and sends email, and your team decides what happens next. No incident closes on its own.
How are alerts delivered?
Each incident sends one email through your own mail relay when it is detected. The email names the rule, the severity, the event that matched, and when it happened. If you need alerts delivered somewhere else, talk to us. Sending incidents to Slack, your SIEM, or your ticketing queue is on the roadmap, so alerts land where your team already works.
Does it run in air-gapped networks?
Yes. The Alerting module runs in air-gapped networks, and file activity stays on your own server. FIPS support is on the roadmap.
How is it deployed?
The Alerting module installs on one Linux host with Docker Compose, or with rootless Podman on RHEL 8-compatible hosts. The installer includes the Alerting server, the NetApp ONTAP collector, a PostgreSQL database, and Keycloak for OpenID Connect sign-in.
Can it be configured to our needs?
Yes. Your rules, severities, categories, and recipients are set up around the shares your team watches. If you need something it doesn't do yet, talk to us.
Built on every file DataXray has already read
Modules extend the DataXray platform into the workflows customers ask for most. Each one runs on files DataXray has already read and classified, so no file is read twice. Every module is configured to fit how your team works.
- AI PlatformLet AI assistants use your files safely, within each user's permissions.
- CompassExplore what is in your data and build the taxonomy to govern it.
- CuratorManage retention, disposition, and records capture, with every decision logged in a tamper-evident audit trail.
- AutoFOIATake FOIA and Privacy Act requests from intake to a redacted, Bates-numbered release.
- eDiscoveryReview, redact, and produce documents for litigation, regulatory, and privacy requests without exporting them.
- AlertingCatch suspicious file activity with rules your team writes, and work every incident to a close.