CONTAP-756825: Repeated Ransomware Alerts for Legitimate PGP Files with Timestamped Extensions
Issue
ONTAP Autonomous Ransomware Protection (ARP) can repeatedly report suspected ransomware activity for legitimate encrypted files created by OpenPGP-compliant applications. The affected files use timestamped extensions such as
Marking an alert as a false positive does not prevent another alert when the application creates files with a new timestamp in the extension. This results in repeated alerts and manual intervention for legitimate file activity.
{}pgp_<timestamp>{}.Marking an alert as a false positive does not prevent another alert when the application creates files with a new timestamp in the extension. This results in repeated alerts and manual intervention for legitimate file activity.