When SWS detects an alert for attack, both snapshot creation and user blocking are executed but the notification email doesn't include information regarding the user block
Applies to
- Data Infrastructure Insights (DII) a.k.a. Cloud Insights (CI)
- Storage Workload Security (SWS)
Issue
- The following actions are taken when SWS detects an attack from a user
- Take Snapshot
- Block User File Access
- In above situation, notification from SWS only includes Take Snapshot as a taken action.