Ransomware Protection: Response Policies

Ransomware Protection is the response-policy component of StateWarden's Vigil security subsystem. It detects mass-encryption behavior on protected devices and executes a configurable response autonomously on the agent - without waiting for a server round-trip.

Detection is based on entropy analysis of the data stream: while a backup runs, the agent computes the Shannon entropy of changed data blocks. A ransomware pass produces a large volume of changed data with near-random (high-entropy) content, which is statistically distinguishable from normal file modifications.

This guide covers configuring the realm-wide default response policy and per-device overrides.

1. How Detection Works

The detector operates on the changed blocks identified during a backup run (no separate scan, no additional disk load). Data is analyzed in 10 MB blocks, and three thresholds control when the detector fires:

• Minimum changed data (MB): The volume of changed data a single backup run must contain before the detector may fire at all. This guards against small, legitimate changes. Default: 500 MB.
• Average entropy (0–8): The mean Shannon entropy of the changed data. Encrypted or compressed data approaches 8; normal documents typically measure 4–6. Default: 7.8.
• High-entropy chunk ratio (0–1): The share of changed chunks that must look encrypted. Default: 0.90 (90%).

The detector fires when the changed-data minimum is exceeded and the entropy conditions (average entropy or high-entropy ratio) are met. The defaults correspond to the values the agent uses out of the box; tune them only if you observe false alarms on entropy-heavy workloads (e.g., large archives of already-compressed media).

2. Configuring the Realm Policy

The realm policy defines the default behavior for every device in the realm.

1. In the Dashboard sidebar, open Ransomware Protection (realm section, route /active-defense).

2. Under Response Action, select one of the four radio cards:

   Action	Behavior on detection
   Quarantine Backup (recommended)	Raises the alert, lets the backup finish, and flags it as POSSIBLY INFECTED in the Restore Data view.
   Alert Only	Raises the alert and aborts the running backup. The partial backup is recorded as failed; it is not flagged.
   Network Lockdown	Raises the alert, then blocks the device's network traffic. Only the StateWarden management channel (agent to Control Plane/Data Plane) stays open, so the device can be unlocked remotely.
   Power Off	Raises the alert (delivering the final report first), then powers the machine off. The machine stays off until someone powers it back on physically or via out-of-band management.

   Selecting Network Lockdown or Power Off opens a confirmation dialog with an explicit acknowledgment checkbox before the policy can be saved.

3. Under Detection Thresholds, adjust the three values described in Section 1 if required.

4. Under Detection Methods, choose where the detector is active:

   • During Backup - enabled by default; analysis rides the backup stream.
   • Proactive Scan - continuous filesystem watching between backups. This method ships as a disabled placeholder and is currently inert; it arrives with a future update (Watchdog).

5. Click Save Changes. Saving a policy change requires an MFA step-up confirmation. To revert, use Reset to Defaults.

Saved values are pushed to every online agent within seconds and cached on-device (inside the encrypted agent configuration), so protection also works while a device is offline. A realm policy change fans out to all standard devices in the realm.

Active Defense Is Never Off

There is no global "disable" switch. If no custom policy has been saved, the realm is protected by the built-in default: Quarantine Backup with the default thresholds. The status strip at the top of the page indicates whether built-in defaults or a saved custom policy are active, and when the policy was last changed.

3. Per-Device Overrides

Individual devices can diverge from the realm default.

1. Open the device detail view and select the Ransomware Protection tab.
2. Every field carries an INHERITED or CUSTOM badge. Editing a field marks it CUSTOM; deleting the badge (or using Reset All to Realm Defaults) returns the device to inheritance.
3. Save with Save Changes (MFA step-up applies as with the realm policy).

Constraints:

• Virtual machines: overrides on VMs are inert. A VM is managed by its hypervisor's agent, so the parent host's effective policy applies.
• Hypervisor hosts: on hypervisor hosts (Proxmox), Network Lockdown and Power Off never execute - the agent only logs a warning - so a host-level action can never cut off every guest VM.
• Agent version: response policies require agent 1.5.0 or newer (the tab shows an update notice otherwise). Network Lockdown and Power Off require agent 1.6.0 or newer; on older agents these two actions degrade to Alert Only.

4. Reversing a Network Lockdown

Network Lockdown is reversible from the Dashboard. Because the lockdown keeps the StateWarden channel open, the unlock command is deliverable even while the device is isolated.

1. In the device list, locate the device showing the NETWORK LOCKDOWN badge.
2. Click Restore Network and confirm the dialog.

The device restores full network access within seconds. Only unlock after the device has been cleaned or isolated by other means. Power Off, by contrast, is intentionally final from software's perspective: the machine requires a physical or out-of-band (IPMI/iLO) power-on.

5. After a Detection

• Flagged backups: backups created during a detected incident are flagged POSSIBLY INFECTED in the Restore Data view. Treat these snapshots as evidence, not as restore candidates, until the incident is investigated.
• Notifications: realm administrators are notified by email with the device, entropy statistics, and the action taken.
• Audit trail: the detection and every policy change are recorded and visible on the Events & Logs page (/events).

6. Related: Vulnerability and Malware Scanning

Ransomware Protection is separate from Vigil's vulnerability/malware scanning, which is configured per device: open the device detail view → Security tab. There you can trigger a Scan Now, enable the background scheduler (Hourly, Every 6 Hours, Every 12 Hours, Daily, Weekly), and toggle the software inventory (CVE matching against NVD/OSV).

Alert triage, false-positive suppression, and suppression rules are handled in the Vulnerability Triage view (/triage). See the dedicated article Vigil False Positives and Suppression Management for that workflow.

StateWarden: Resilience Engineered.