The Anomaly Detection Dashboard allows you to monitor your backup data for the selected month and alerts you to any anomalies. Anomalies are identified when there is a significant change in data size and/or item count between consecutive snapshots.
Where to find the dashboard
Open the dashboard page and select Anomaly Detection from the drop-down menu in the upper-left corner.
What you will find on the dashboard
Snapshot size shows the size of the last snapshot made for the selected month.
Changes vs previous snapshot compares the last snapshot made in the selected period with the previous one.
- Snapshot size change
Displays the change in snapshot size compared to the previous snapshot - Changed item count
Indicates the number of items added, removed, or deleted compared to the previous snapshot
Snapshot changes pie chart
The pie chart visualizes size changes (the amount of data added, modified, and removed) for the selected month.
Size and item changes line graph
The line graph tracks snapshot size changes and item count changes (number of items added, deleted, or modified) over the selected month.
Detected anomalies are marked on the graph with their percentage change.
Anomaly overview table
The table provides details about each anomaly detected during the selected month.
Data Detected
Shows the date the anomaly was detected. Note that the time can differ from the time the snapshot was made.
Size Change
Shows the change in snapshot size compared to the previous snapshot
Anomaly
Shows the percentage change in snapshot size compared to the previous snapshot
Item Count
Lists the number of items added, removed, or deleted compared to the previous snapshot
From the table, you can also directly access the snapshot compare feature to check what changes occurred in the snapshot with the anomaly compared to its previous snapshot.
Scenarios where anomalies might be detected
Changes in backup configuration
- Additional data enabled
Adding significant data to the backup might cause a snapshot to be flagged - Data removed
Excluding a significant amount of data from the backup might cause a snapshot to be flagged
Mass file movement
Moving a large number of files within the tenant may create anomalies for both added and removed files, detected as separate anomalies with the same timestamp.
Restoring from an older snapshot
Restoring from a snapshot with a significant data difference compared to the current backup might result in an anomaly. Depending on the nature of the difference and the type of restore, the anomaly may be categorized as added, removed, or modified.
File overwriting
Overwriting files in the same location with unchanged IDs might cause a snapshot to be flagged. This may happen if your data is encrypted as part of a ransomware attack.
What to do in case an anomaly is detected
If our system detects an anomaly, we recommend you use our data compare tool to check what changes occurred and assess their significance.
To compare snapshots:
- In the Anomaly Overview section, locate the anomaly you want to investigate.
- Point to the row with the anomaly and click the arrow icon.
You will be viewing a comparison between the snapshot with the anomaly and its previous snapshot - Browse through the snapshot to identify which files were added, deleted, or modified.
If the anomaly is critical, consider restoring the most relevant backup copy.