Name: Stop Ransomware from Shutting Down Patient Care: Protecting PACS and Unstructured Clinical Data
Uploaded: 2026-04-28T18:09:06.467Z
Duration: 48 min 52 s
Description: Stop Ransomware from Shutting Down Patient Care: Protecting PACS and Unstructured Clinical Data

Transcript for "Stop Ransomware from Shutting Down Patient Care: Protecting PACS and Unstructured Clinical Data": Let's give it a couple minutes, Alpika. Yep. Let's let's get everyone settled and we can get started. Hope you are having a good morning, good start of the day day at least. How's your morning, please? My morning's been good. So. far so good. That's. awesome. It's, it's starting to warm up. So signs signs of summer. That's good. So I live in California, but it's the reverse. It's sign signs of winter. Well, I don't know what's going on. Do you wanna give it another minute, or do you think we should get started? We can get started. In the meantime, everyone, do you wanna let us know, in the chat, like, where you guys are from and things like that? Just say hi. We are a friendly bunch here, and, we appreciate everyone for joining us today. So you'll hear from myself as well as Alpika. I'll give her an opportunity to introduce herself in a second, but we really appreciate, you know, the opportunity to discuss not only unstructured data with Rubik, but more specifically, you know, protecting your PACS platform. The agenda for today specifically is we're gonna talk about the health care escalating threat. Right? How that affects all of your unstructured data and specifically the PACS system. What that means from an impact perspective, not only on care providers, but also payers, the unstructured data challenge. Right? Everyone in here most likely is dealing with unstructured data, whether it lives on prem or in the cloud, but not only managing that, but protecting it is, you know, something that we're hearing a lot from our customers, you know, looking for guidance and, you know, what Rubrik offers. I'll talk a little bit about Rubrik and what our solution is for specifically PACS protection. And then at the end, we have Alpika gonna give us a live demo of Rubrik's NAS cloud direct product, which is the product for unstructured data that we'll be, you know, touching on briefly. My name is Blaze Healy. I am a PLS account executive, and what that really means is I'm in charge of our unstructured data solutions at Rubrik for our health care customers. I cover the East Coast specifically, and then I have a peer, also on the West. And so, Alpika, I'll give you an opportunity to introduce yourself to, you know, all those that are attending. Awesome. Thank you so much, please. So very good morning, good afternoon, guys, wherever you're joining us from. And, you know, happy to see you all again. And if you are joining us for the first time, very happy to meet you for the first time. We are here to talk more about, unstructured data, the solution from Rubrik. Just as a background, I'm a senior technical marketing manager here at Rubrik. Been here four and a half years. I cover everything that is technical in nature, for products, unstructured data, AI, our SaaS, and also Kubernetes. So, you know, if you have questions beyond unstructured data also, you know, happy to answer as well. But, you know, just wanted to say hi to you all, and we can get started. Thank you, Vlise. Over to you. Yeah. Thank you. I mean, just to kinda set the table and kind of understand where health care is at as a whole. Right? I think, you know, these headlines in the news are obviously, you know, what we're all trying to avoid. You know, unstructured data, specifically, what we're gonna talk about today is, you know, one specific workload. We understand that, you know, you and your teams have a lot of different, you know, aspects of IT to worry about and ensure that all of your data is protected. But, unfortunately, I think the FBI, you know, most recently validated that, you know, health care and public health is the most sought after industry for cyber criminals. And so here at Rubrik, right, we have a dedicated health care team specific, because we understand, you know, not only the challenges, but this industry specific, you know, dataset that you guys are working with like PACS requires specific solutions, to ensure not only data survivability, but also, you know, recoverability in a timely manner to continue patient care. Specifically, right, if you talk about that impact, we see about a third of patient care overall is impacted during a cyber scenario. Right? So I always think about this in two different ways. Right? You have the patients that are currently in the hospital and then the patients that need to eventually get to the hospital. Right? Whether that's through an ambulance or any type of emergency services. So on average, right, we've seen that medical errors are are going to go up about a third during a cyber scenario. Meaning, your nurses, doctors, you know, anyone within your departments don't have access to the medical history of the patients to provide reliable care. On top of that, during cyber scenarios, a common theme we see is because the systems are down, right, your hospital or institution is now actually diverting any new patients to neighboring hospitals, you know, which is good and is the responsible thing to do. But if we think about it at a macro level, right, now there's two times the patients going to a neighboring institution where they're not necessarily staffed or prepared for that type of influx. So we see the time to see a patient goes up dramatically, again, you know, affecting overall care. Specifically from a recovery scenario, right, it on average, we see two to three weeks. This is a lot you know, there's some variance in here depending on the type or the style of attack. With unstructured data and the growth that we see within these workloads, I would generally see, you know, close to a month. And we'll get into that more specifically when we get into the pack session of, you know, our call today. The financial impact is is big. Right? Tens to hundreds of millions of dollars. One thing we've noticed specifically, you know, in health care is not only the short term impact, but also, you know, the six to eight to the twelve months down the line is where we see, you know, the full view of what that breach or cyber event, you know, really had on the books of a health care institution. And so all these factors, right, have direct lines into not only the delivery of patient care, but also brand and financial, you know, penalties and regulatory issues that we all have to, you know, abide by in the health care space. And this has really generated a a conversation that, you know, we hear at Rubrik as well as most likely at the board or the c level of your organizations are talking about the idea of a minimal viable hospital. And that's this is really just which specific applications need to be up and running for, you know, your provide your health care institution to provide reliable care. Right? We talked about it on the last example about the medical errors going up. So it's not about recovering every single piece of data possible, but which specific applications have a direct correlation, you know, to patient care. And PACS specifically, what we're gonna talk about today, you know, has a direct line into providing reliable care. Right? Understanding the medical history, having the preop images, to provide, you know, the information to doctors and nurses to then, you know, follow through with surgeries and, different practices that they have planned for that day. And so we talked about the workload specifically, and I have PACS highlighted here. I just wanted to kinda get a holistic view of the importance of unstructured data on health care as a whole. PACS is always a made major driver. If you have a digital pathology arm of your business, if you're using Epic WebLog, for example, or telehealth, patient portals, research studies, clinical trials, all of these different applications or use cases that your health care is offering to patients or internal employees are going to rely on some level of unstructured data. And so the importance of securing and protecting these, again, really ties into maintaining the best standards and practices that your institution sets out to put forth. So when we dive into PACS specifically, I talked about it a little bit in the the beginning, but I always I call them the ologies. Right? So any type of cardiology, radiology department, they need to be able to access their images to not only perform events like surgeries or pre op, tests for specific individuals, but then also new patients understanding, you know, their medical history and other previous ailments that may have happened to help doctors and nurses successfully diagnose new patients is extremely important and critical to ensure that they have access to these images. Again, we talked about the downtime of packs and having to divert new, use cases to the hospital. But, again, why we're here today and on this call is all of these challenges are unfortunately going to fall on IT and security teams to determine, you know, in a cyber scenario, what is clean, what is restorable without the risk of reinfection. Can we control the blast radius of the attack? And then again, get operations back up and running smoothly. And so we talked about the timeline, on the last, screen about two to three weeks. Again, that's going to vary on the type of attack, Specifically within packs and if you think about your own unstructured system, whether it's a NAS or an object store in the data center or in the cloud. Right? Understand how much data, you know, these systems are are holding today. With within health care specifically, there are longer retentions. Right? We need to retain data for the life of the patient, maybe mid seven, '20 five, I've seen forever. And so as that data continues to grow, how do we ensure that in a cyber scenario, we understand which data was infected, when the bad actors entered our environment, and how can we ensure the data is clean and recoverable without reinfecting our environment on a recovery. Because, again, a lot of the timeline and the recovery is done because of all get finding answers to those questions. A lot of teams will bring in third party security tools or their cyber insurance broker to then run all those tests. And, again, without the answers to those questions, you have to scan your entire unstructured environment, which is usually a hundreds of terabytes, if not multiple petabytes. And so before we get into the rubric side and how we approach this, I wanted to talk about, you know, the the two most common protections that we see with unstructured data today specifically. If you think about if there's any of folks out there that have been in IT for a long time, I previously sold Nazarese. And so, you know, most likely, you started out with some type of NDMP based backup system. Maybe you were writing to tape or a different array. Unfortunately, right, NDMP was I think it was released in the nineteen nineties. So it's over 30 years old. And if we think about unstructured data and how that data growth has surpassed that technology, a lot of the customers that we speak with, NDMP isn't built for the speed and scale of today's modern unstructured data. And so they start missing backup windows. And once you start missing backup windows, there's no point in having a backup technology if you can't complete the backups. And so then if we fast forward to the modern day NAS and unstructured workloads, a lot of our customers are relying on snap and replication. And snap and replication is a is a good solution for disaster recovery. And so what I mean by that is snap and replication is made for when you have site a in your production, you have a mirrored snap and replication copy on-site b. And so snap and replication actually was, again, originated for fire, flood, data center outage. So you know that you have a second copy on in your secondary site to then run your business, you know, run your day to day operations on. The challenges with snap and replication, and I'll talk specifically on the next slide about that, is there's gaps when it comes to cybersecurity. And I'm always gonna go back to those questions that you need to answer in a cyber scenario of what data was affected during the attack, what data needs to be recovered first, can we prioritize recent or, you know, newer data versus old and legacy data, And then can we recover to a platform? Array based replication is not going to provide you answers to any of these, and that's why the need for a true backup and having that in place is what Rubrik is basically saying as best practices to move forward and ensure that your data is survivable and recoverable. And so if we talk about it specifically here, right, we we touched on the NDMP bit, piece as far as not having the speed and scale, you know, to meet the modern growth of unstructured data. Snap and replication from a cyber scenario, you know, there there are gaps. And, again, if you think about it, regardless of who your NAS vendor is or where your NAS lives, this could be on premise or in the cloud, snap and replication is going to faithfully take a snapshot, which is a point in time picture of your data and replicate it to the second copy. One story I always tell about, you know, a customer that was faithfully snap and replicating was, unfortunately, there was malware placed on the production side. And so I'll use NetApp as an example. Bad actors were able to gain access to their NetApp. They planted malware onto their system, and then the box was doing exactly what we told it to do. It was snap and replicating that problem to the secondary site. So now we have malware on both sites. And when the bad actors triggered that encryption event, there's encrypted files on both Nazarenes, and we don't know when that bad actor entered the environment, which data was infected, and which data is clean to recover. The way Rubrik approaches it is when the data is kept on the same code with a ray to a ray based replication, that is a single attack surface for bad actors to enter and ex and attack, you know, NAS arrays. And now with Rubrik's approach, I would be remiss if I didn't talk about the Rubrik platform as a whole. If there are you if there are anyone out there that is not a Rubrik customer, this is what Rubrik Security Cloud is. And so Rubrik Security Cloud is our unified SaaS control plane. Think of that as just a fancy word for our UI. On the left hand side, you'll see all the different workloads that Rubik has solutions for. Today, we're focusing on the unstructured data piece for PACS, but Rubik does offer SaaS, cloud, on prem, as well as identity services. All of that is going to be driven and operated out of Rubik Security Cloud. So not only do we have data classification as well as governance capabilities that you'll be able to view within RSC, we also have data threat analytics as well as cyber recovery capabilities to remediate threats. And so when Alpika goes in and shows the demo, that's what you're gonna be looking at from Rubrik Security Cloud. On the right hand side, you also might see some of the existing vendors that you have in place today. We do have integrations into all of these vendors, so you have the ability to not only add the intelligence of Rubik's Security Cloud into your existing security tools, but we can also have those systems work together to, you know, again, have a more collaborative approach to cybersecurity. And so this is Rubik's solution specifically for PACS. You know, I know it took me a long time to get here, but I really wanted to set the table with kind of the threat landscape and what we're seeing, versus what Rubrik believes, you know, is the best solution out there. So this is NAS CloudDirect. So NAS CloudDirect specifically is just gonna operate as a stateless VM that you see here. There is no infrastructure besides this stateless VM that is needed to protect petabytes and petabytes of unstructured data. So this stateless VM has three jobs. It's going to scan your production packs environment. It's going to index that data and then move that data to the cloud target of your choice. All of this, again, is you can create your SLAs and your retention policies out of Rubrik Security Cloud. But when you write that data, you notice that there's three different options. NASCloud Direct is a vendor agnostic tool. So if you need to write data and keep it inside the four walls of the data center, you can write to an NFS or object storage. You could write to a cloud provider of your choice, whether that be Microsoft, AWS, or GCP, or, also, you could write it to Rubrik Cloud Vault. Rubrik Cloud Vault is Rubrik's managed cloud tenant, which is gonna add that extra air gapped isolated always on immutable layer for a cloud target. From a performance standpoint, I talked about MDMP briefly in the beginning. NAS CloudDirect, this VM is scalable. Each VM has the ability to move six gigabits a second, meaning we can pull data from your source at six gigs and move it to the target at six gigs. If you wanna go any faster, you have the ability to deploy multiple VMs, and then it becomes a math equation. And so our solution excels at speed and scale because it's been engineered to manage and track all of these metadata to do a first full incremental forever backup. And so we talked about the deployment being just a stateless VM. We talked about the performance and how we are able to move data in parallel, streams, and then most importantly would be the security piece. Right? We talked about those scenarios with snap and replication. Right? Those questions that need to get answered during a cyber event. Right? Which data was infected? When did bad actors get into the environment? And then how can I ensure that it's a clean copy of data? And so Rubrik has features that I touched on on the last side that, talk about data threat analytics. And so specifically with NCD, we have three different capabilities as data is moving through the VM. The first one is gonna be generally anomaly detection. Think about this as machine learning. So mass encryptions, mass deletions will alert your team, you know, of those events. We take it a step further with threat monitoring where Rubrik actually uses Mandiant powered by Google's threat feed as well as Rubrik Xero Labs to run the data through those known IOCs or indicators of compromise. So as your data is being backed up, if that malware has been ever inspected and in our feed, we are going to alert you immediately that that malware has been detected and that you should remediate the problem with the last known clean backup. And then lastly would be the threat hunting piece, which is going to answer the question that security always asks is, okay. We know that this data is infected. We have petabytes and petabytes of other data. How do we ensure the bad actors didn't also get into those environments? And so with a threat hunt, you actually have the ability to go in and put and run a threat against all of your backups in, within Rubrik to hunt for that known file hash. That can be done in sixty seconds. Rubrik has the ability to go through 80,000 snapshots in under a minute to then tell your team what exactly is clean versus what is infected. And so that's how we really consolidate down the blast radius of an attack and give your team the answers of this needs to be recovered versus this data is clean. And all of those different features are what really separates Rubrik and allows your team to recover with confidence quickly. And lastly, just some other features within Rubrik. Within PACS environment specifically, you know, one of the biggest challenges I see with customers is, you know, the retention of that data. Right? Cardiology and radiology is going to require to, you know, keep those images for a really long time. Most, you know, health care providers that I run into have seven years at the lowest, if not more. So with DataDiscover, because we are auto discovering the source NAS that or that the PACS system is living on, we actually have the ability to tell you when that file was last accessed. And so one of the huge advantages of this is these workloads are sitting on your expensive NAS array. And so if this data hasn't been accessed in ten years or twenty years, you now have the reporting to go tell those data owners, hey. Can we archive this off to a more cost effective tier of storage? And Alpeka is gonna show you exactly how we would do that, but, again, it's another built in tool within Nas CloudDirect, that our customers with PAC specifically find huge value in. The stateless VM specifically is a data mover at heart. And so we have seen customers use this as a migration tool, whether that's from on prem, unstructured data to the cloud, whether you're going NFS to s three to a cloud file service or an object storage, or you're going vendor to vendor inside of the data center. We have used this as a migration tool as well because of our capabilities to move data so quickly and maintain the permissions, and accolades within the file sets. There's some SATs on, built down here, just kind of call outs as far as our ability to track billions and billions of files. Right? Whether it's small files, large files, it does not matter. Again, you know, this solution specifically was engineered and tailored for large scale unstructured environments. There's a lot of different capabilities and features that, you know, we can talk with at at at end. But I think a lot of the best ways, you know, to show this product would be through a demo. And that's exactly what I want Alpika to show you guys where I will stop sharing my screen as she will walk you through what this looks like and really what you can do and all the capabilities I've been talking about. Awesome. Thank you so much for that great overview. Like, I can show you things in action now. I just want to highlight one question that just came up in the chat. Pretty interesting. And, also, you can use the q and a tab as well for, for, questions as well. So the question is, NetApp has, detection of ransomware. How does that compare to your system? So what do you mean detection of ransomware? So, so, basically, it's a direct comparison to anomaly detection, and. they are using, so NetApp is has a AI based threat detection system. So just they just want to understand what's the difference. Yeah. So I I mean, are you referring to I'm not sure. I'm look trying to find the question. It might be are you referring to, like, a Blue XP type of solution? I just saw that. It's called oh, it's it's. I see it. From Thomas. yeah. Yeah. So I mean yeah. So, I mean, Thomas, I think the biggest thing with with NetApp, right, and, like, with Rubrik is is the vendor agnostic piece. Like, the anomaly detection is definitely one thing. Like, most organizations are gonna have some level of anomaly detection, and I think that's what you're referring to with the detection of ransomware, where you see mass encryptions, mass deletions. That's kinda just the first step of the puzzle, where Rubrik goes and uses, like, the Mandiant threat feed powered by Google as well as Rubrik Xero Labs, that's where, you know, we are actively checking that data against our IOCs, within that feed. And then the power also behind the threat hunt to ensure that nothing was missed and having the ability to scan all those backups, quickly is something that, you know, again, if anything were to be missed as the data is being ingested, and I'm not saying it would be, that's kind of the triple check some piece of our, you know, threat analytics portion. And then there's also the vendor agnostic piece. Right? With NetApp, you're gonna be relying on the vendor to vendor replication. So in recovery scenarios, you're most likely only going to be able to recover to another NetApp filer or, you know, ONTAP in the cloud or, you know, a storage grid type of solution. With Rubrik, it's truly vendor agnostic, so you have the flexibility to, you know, re restore wherever, you know, basically the protocol prohibits. I think there's more follow-up on you scan the backup and but not on the flight. That is true, and that's on purpose. The reason being, a, if threat detection is actually happening, on your, primary storage, and if the threat actors do have access to the, in terms of the admin's credentials, if they do have access to the primary storage, and they see that there are alerts coming up about that, oh, threats are being detected and there's ransomware, they can actually preempt the attack and shut down your entire data center. So, that. is what I. see I see two I see two questions here. So one from Adam. Does can Rubik actively scan for malicious houses and backups? Yeah. So that's the threat monitoring piece. So as we're as the data is being written through this stateless VM, that's where we're using the Rubik's Xero labs and Mandiant threat feed to scan those, to scan those hashes for known indicators of compromise. And. so that's being done actively as the incremental backups are being taken. And then so where the threat hunting piece comes in is if you detect a hash, right, you take that hash and then would input that to then scan and hunt the older backups, against those threats. So to answer Thomas's questions, yes. We scan the backups on the fly as well, you know, through the VM layer. Okay. That is, thank you for all the discussion. I'll just get into the demo, just so that we end on time, and I'm able to cover everything. So to get started, essentially, this is our Rubrik Security Cloud Interface. It's an you know, it's a centralized platform for cloud SaaS and your data center application. When it comes to unstructured data, your packs data, you know, it can live on prem. It can live in epic, as well as some sort of cloud bucket, as well. So, you can centrally manage all of that data through the same infrastructure. To get started, we head to NAS CloudDirect workload. And first off, we do do need to onboard your, NAS CloudDirect, systems. Now when it comes to unstructured cloud data, I'll get to that in just a little bit. But here we are talking more about your NFS, your Azure files, s three, or SMB stuff. So, we do have API integrations to a lot of vendors. If you don't see your vendor listed here, don't be alarmed. You can always onboard them using the generic, generic APIs. So the NFS, we have an integration for, NFS, s three, or SMB. Once I'm just going to pick Isilon for now just to show. Enter, your host name, your username, password, and you're good to go. So in the background, what RSC will do is it'll create a service account, so that, you know, it can do the backup and recovery operation. We do not store the username and password like the root username and password anywhere. It's just used temporarily and then deleted from memory. So once you onboard, you will see your system listed here just like this. And, automatically, all the namespaces and the shares will be, discovered and the inventory will be available here. Now you can choose to protect all of them, or you can choose to protect just one of them. To start protecting, what we do, is define SLA domains. So that's when you define how often you want to backup and how long you want to keep the backup from and where, you want to store the backup. I Grace did mention that we do support, target, to be on prem, your, on prem. It could be on prem filers or it could be on prem object store or it could be, cloud storage as well. So all major cloud vendors are supported, different tiers of cloud when different tiers of storage is also supported. What we enable, basically, what you can do is that, you can enable retention lock. Now what does it do? It can prevent, your attackers if they get access to your Rubrik Security Cloud instance. They can come in and start prematurely deleting or expiring the snapshots. So you can prevent that, from happening. And, if you want to make changes, two people from your organization that have been previously identified need to call in support, and support can make the changes. But if you have retention lock on, no one can just come and start expiring your snapshot. So I'm going to, leave that as it is right now. So this is where you define how often you want to take your snapshot. So I'm just going to define, some values for now. Okay. So I have different frequency as well as different, retention period defined for retaining your snapshots. Once that's done, you get into selecting your side. I'm just going to select the default. Okay. This is where it get things get interesting. Right? Like, now what you see here is that I have, three different backup frequency. What you what I can actually do is for every frequency, I can actually select a different target location. So, for example, my regular backups, like, the most frequent one can go to my Azure target. And then, the twelve weeks and the one month can go to the same, or it can, it can go to another one. So we give you the flexibility to have multiple copies of the backup across maybe different cloud or different on prem filers just to make sure that if one goes down, the other is always available. So, once you do that, you give it a name, and you're good to go. Then we head back to our inventory, to our system. Essentially, just select one or multiple shares. Click on manage protection, assign the SLA, and that's it. Then Rubrik can actually manage your entire data life cycle. So the first backup, and it'll manage when the backup needs to expire, things like that. The entire life cycle of the data is automated via Rubrik. So once you do indeed, do the backup, the next question is all always recovery. How do you recover? We have multiple options. A, we have global search capability. So, I just clicked the glass, look I glass look icon, get to folders of files, select the cluster, and then I can just search for, the file name or the folder name. Based on whether you want to recover a file or a folder, you can select and then do the recovery from here. The other option is always, from here. So I can select I can search for the share name. Okay. Write this one. And what you will see here is a calendar view. So this shows if there are backups, what kind of backup is available for this particular share. I might take the latest one. And here, also, I can click on recover. I can do the entire directory or files and folder. So you can, select and search from here as well. Once, you select your file or the entire directory, Rupri can get started on the recovery process. So let's switch gears and actually head to the threats aspect. So first, we will, access our data threat analytics. This is a security application that is available via RSC. So, just click the app tree and select, data threat analytics. What you will see is a very nice dashboard giving you the summary if there are any anomalies. So if there is an encryption, massive deletion events, things like that, if there are any active threats. So why that is, like, if you when Rubik is doing active scanning, actively scanning your backups and if it sees, any zero day, threats, it can, tell you about that as well. So for before that, let's head to anomalies, which is, this is where we compare the current backup with your previous backup, to see if there are any entropy events or any, massive file deletion events. Now, it's not like if you delete a file, Rubrik will flag it. That's that's not what happens. You know, we scan your backup. We have an idea what your infrastructure looks like. By the, I mean, the ML algorithms. So it learns your environment, and, it's looking for deviation from the regular changes. And that that's when it starts to flag. So what you see here is that, for this, unstructured object, there is an anomaly detected, which is a lock bit, and, also, a lot of files have been deleted, added, and they seem suspicious in nature. You can click on the object and, actually, it gives you a summary of, what, when the event started, if there are any ransomware notes, what kind of activity. So we are looking at ransomware, encryption because the extension is Logbit. The whole thing is not seen here, but I'll just get to the details so you can actually browse to the folder where these things are going on. So so, also, we found the icar.com, which is a very suspicious ransomware activity as well. We tell you all about this and, even if what files are suspicious, deleted, things like that. So you can see there's a log bit extension to the files. So it also tells you when the threat was detected so you can identify the blast radius and recover from a clean copy. The threats aspect. Now this is all passively monitoring. Right? And, what we also do is that we look for zero day threats using the feed, which, Rubrik has threat feed, which Grace did mention. So we use a lot of, vendors to collect the most up to date current information. We curate the feed and then essentially scan your backups, for that threat. If there are threats detected, we will tell you which objects are affected. Like, for example, we'll just take the first one here. We also tell you which was the first observed snapshot and, give you the details around what the hash value is, what the description intel source, and things like that. So you can actually use this value, to conduct a threat hunt across your data center to see if other objects are also affected. Sorry. It's being a bit slow. Okay. Right here. So, to start a threat hunt, you just click here, select turbo threat hunt. We'll select the data source as NAS cloud direct, or you can select SaaS or all of them as well. Simply add the hash value of the IOC, and you can get started. Now you can you don't need to do this for every file hash value. You can actually add up to 100, such values and do a massive, threat hunt as well. You have the flexibility to select, you know, snapshot and things like that. So once you do that, Rubrik will automatically, look for threats. Okay. In the essence of time, I'm quickly going to go to data security posture. This is what is sensitive data monitoring. Rubrik has a lot of, prebuilt, policies and, analyzers to look for sensitive data. So something like if I look at a policy, which is a business, and there is one for HIPAA health care as well. And then, you know, we do define what kind of data types. So we, it looks for, Social Security number, employee ID, and you can have predefined and custom, analyzers as well. For HIPAA once, obviously, it's all about, patient ID, Social Security, and a whole bunch of other things. So once you assign this, policy to your data, it can identify where your sensitive data lives. I'm just going to click on a random one because I just wanted to get through this demo. It will tell you, where exactly the sensitive data is, who has access to it, what are the, categories and the data types, that is, being scanned for and that's being found across, across your dataset. Okay. I'm gonna quickly go to discover data discover. So what Rubik does is that, it actually sees what kind of data you have on your, on your host, and essentially classifies based on the temperature. Temperature as in how often it's being modified or how often it's being accessed. So what you can do is, if there is some data that's not been used in over a year, you can actually archive the data directly from Rubrik Security Cloud by archiving, like, you know, move it to a cheaper storage tier. And then your admin can delete this data from your primary storage trying to free up, the real estate so you can use it for other projects as well. So this way, you control all the data, where it lives, and, you know, if it's old data, just move it to a cheaper cold storage as well. Yeah. And, Thomas, I saw your question. I mean, with with packs, it's a tricky example. Right? How it's gonna affect the application. It is possible. Right? And then it just kinda depends on the retention and regulatory of the hospital. But yeah, alright. So I see you with the FujiPAX. Yeah. Exactly. I mean, it depends on the PACS provider, and it depends on kind of the details that they're able to provide. And so with that, like, you know, PACS is a tricky example, but there's definitely other unstructured cleanup that can be done. Previously, specifically, like, with GE PACS, we've had the ability with a customer that was very organized and understood kind of patients that had, you know, no longer, you know, are alive. Right? And so within that retention of their packs application, instead of keeping that going on the Isilon, they were able to move that data to more cost effective storage and keep the regulatory and retention for those workloads. Fuji packs, we do have experience with. It is something that we protect today actively. I don't know the ins and outs of the details that they provide, but we can definitely follow-up with you and kinda dive into that specifically. Sorry, Alpika. No problem. I wasn't sure if I'm not sure if my screen was visible when I was showcasing the, the, the data discover aspect. Okay. So just wanted to once again highlight this. Like, this is what data discover looks like. Rubik will classify all the data, and there's an archive archive button right here where you can move it to a a cheaper tier. No problem, and thank you for the interruption. I think we are at time. Oh, yeah. There's one thing I did want to highlight, which I miss showcasing otherwise. So, for your cloud unstructured data, the protection works slightly differently. So, basically, you come to inventory, You come to your cloud, banner, and then you select, say, Amazon sorry. AWS s three. Right? So what happens here is that you onboard, your AWS account. And then once that is done, Rubrik will automatically scan and inventory all your s three buckets. So, again, what I showed earlier about the SLA domains, the same thing applies for cloud as well. You can just simply create, an SLA and assign to the, to the buckets you want to protect as well. And we do have the support for ransomware detection, basically data threat analytics, sensitive data, all of that, it remains the same. So, on prem, cloud as well as object store, it works the same way. Okay. That's all I had. Yeah. Thanks, Alpika. I we appreciate everyone's time today. You know, one thing we'll call out is, you know, I saw I appreciate all the the questions in the chat. I will make sure, you know, my email as well as the rest of my team, right, supporting unstructured data and Rubrik, you know, gets out to everyone that was able to attend. Rubrik Forward, is specifically in person this year. So this is Rubrik's, you know, large event for all customers and prospects that are just looking to learn more. It is in Vegas. So if anyone's looking for a good excuse to, you know, get out to Vegas, it's always, you know, a good time filled with great events and then also a lot of knowledge sharing, existing customers, you know, sharing stories and kind of going through everything that's new, with Rubik being unstructured data and everything else within the portfolio. But I know this is all we had for time. We appreciate everyone, attending. And, again, please, you know, reach out if there's any questions, and, hopefully, you know, our teams will be in touch. Thank you so much. Thank you.