Commvault Cloud supports cyber recovery across enterprise workloads and environments—VMs, databases, file and object stores, cloud data environments, SaaS apps, and identity providers—so recovery planning isn’t split across tools. Cyber resilience also includes the ability to help scan your protected data, identify anomalies, compromises, or infected data, and isolate it so you don’t reinfect your clean environment on recovery.

Commvault Threat Scan helps identify clean data across backups using Cleanpoint Identification. Threat Scan uses signature-based detection, AI-enabled encryption detection, and the ability to hunt for specific threats using YARA rules and custom file hashes. For compromised data, Synthetic Recovery assembles a curated, composite, clean recovery point from the most recent clean file versions.

Commvault Cleanroom provides an on-demand, isolated recovery environment for testing, cyber forensics, and recovery staging so that SecOps teams can work on both analysis of a cyberattack and staging data and systems for recovery once an attack has been cleaned up. Commvault Cleanroom runbooks, automations, and pre-built configurations help validate recovered workloads before returning to production.

Commvault Threat Scan scans protected data and VMs and can automatically quarantine affected or anomalous items. Files that have been quarantined are prevented from being restored during a recovery so that you don’t reinfect your newly-rebuilt or clean environment. It supports threat hunting using threat intelligence feeds, plus custom YARA rules and specific file hashes.

Identity Resilience supports granular recovery and—for Active Directory–full forest recovery of your identity systems, plus auditing to identify attacker changes or privilege escalation to help teams reverse changes during cyber recovery. Following cyberattacks, restoring identity providers and identity systems is often the first order of business so that all other systems have authentication in place.

Commvault integrates with SOAR platforms—Microsoft Sentinel, Palo Alto Networks XSOAR, and Falcon Fusion—to help automate incident response processes and orchestrate recovery actions after cyber-attacks. Commvault can give and take signals to enable investigations and help improve the effectiveness of cyber recoveries.