Name: Rubrik Workshop: Identity Recovery
Uploaded: 2026-04-29T11:46:09.832Z
Duration: 1 h 23 min 44 s
Description: Rubrik Workshop: Identity Recovery

Transcript for "Rubrik Workshop: Identity Recovery": Well, good morning. Gonna welcome everyone to this new, session of our, virtual story lane for identity recovery. This is Francesco Tika. I'm based in Amsterdam, and I work for Rubrik in the marketing team for EMEA. I'm joined today by our two experts from the Rubrik x team, who will be our hosts. So Anne Perry and Salvatore Bocollero. They'll be guiding us, through the session today, and, they are I mean, they will be guiding it through to the lab before the next, hour and a half. Salvatore and Ante today are as well in Amsterdam, so they will manage the session from our Amsterdam office. And, just off to you, Salvatore, for a quick, introduction. Thank you very much, Francesco. It's a great pleasure to actually be at, Rubrik headquarters, at least, the Amsterdam office today. I normally work out of Copenhagen, Denmark, and we don't have an office there. So that's just how it is. So I really enjoy being with colleagues and and and friends today. So, I'm part of the, Rubik x team. We focus on, identity recovery, identity resilience. We also focus on Adjenic AIs and data security posture management. Rubik X is, the team where we are kind of, incubating new products into the market space. Yeah. A few words from end as an introduction, and then we will get started with, with the camp. Thanks, Alba. So as Alba said, actually, pleasure for us to be in the same room together. So, like, Alba, I'm a member of of the Rubik X team. So, and I'm gonna be, assisting Salva today by keeping an eye on the the chat and questions. So, yeah, thanks everyone for joining, and, great to spend some time with you today. Wonderful. So welcome to Camp Rubrik. This is, this edition today is our identity recovery, edition. Camp Rubrik exists in many different flavors. We started this program in 2018. Back in the days, it was an on-site event, and the main topic for for that session was actually building, CDM or the the Rubik's secure vault on prem or at least, bootstrapping it, getting it started, configuring it, and, getting it running. Then came COVID along, and that changed everything. For once, we had to make the Cambro bricks, virtual. We also built more different, Cambro brick types. So today, we have many different types. So please go ahead and, is someone playing a piano? No. I think there is some issue with the sound, Salva. Okay. That's annoying. Okay. Thank you, Ormas. How how about now? Right now Okay. Let let us know if there are still audio issues. go ahead, Sawan. Yeah. Will do. Will do. So, today's camp Rubrik is, first, a, deep dive on identity recovery by Rubrik presented by me. So that will be some, some slides I'm running through. And after that, you will be given your link for today's, camp group break, experience where you will be clicking through, identity recoveries, both on AD Forest and Entra ID as well. We plan to wrap up this, CAM Rubrik in about, one hour and twenty six minutes from now. So if you have questions, comments, please, just shoot type the questions in the q and a or chat section. You can also unmute. Well, just let Francesco know. He can unmute you, and then you, you have a chance to speak directly if you wish to do so. Yeah. Absolute so there is a function where you can raise your hand, like, should have a tab, like, with a hand to raise on the left of your screen. Or if you wish to, come on stage, with us, you can do so. We can grant you access there. For the rest, please use the chat to the q and a function. Q and a function is easier for Salvator and Ant to monitor questions coming in, but feel free to keep it lively and to to ask your questions during the session. Yeah. It's it's always good to have interactions. Alright. Let's get started with identity recovery. So first of all, the agenda, we've done the introductions. I would say housekeeping. You are where you are. You do what you do. Get coffee. Get tea. If you have to step outside, do that. We will now run the technical deep dive of the identity recovery. Q and a is always open. Just shoot. And you will have a guided lab link where you will be able to access your own edition of the lab. And roughly, one hour thirty minutes from now, we'll be wrapping up. We may be wrap up, wrapping up before if there are no more interactions, no more questions from you guys. I guess, yeah, that's how it is. So, cyber resilience from Rubik, it all comes from the same place. The one, control plane that we are offering, which allows our customers to use all the functions and, and, things we can do with the Rubik Security Cloud. Today, we are focusing on identity recovery, and that is Active Directory and Forest Recovery. It's on to ID, and it's it's all built on Rubrik resilience. The Rubrik Security Cloud has been alive now for, I think, the past five years. It's really a hardened, security and control plane, locked down by, obviously, encryption at flight, at risk. Multifactor authentication is mandatory. We have strict role based access control, and, also, we have something called governance mode where we can ensure that we are not getting attacked by bad actors trying to, compromise our our backups. So all this goodness is in Rubik's Security Cloud. It's been here for a long time. When we decided to build a new product for backup and recovery back in 2014, we decided we had to do this a new way. So, we built it on immutability from day one and a zero trust model. We was the first we were the first, data protection vendor that implemented, that very strict security regime. I'm happy to see that our, colleagues out there in the in the backup recovery space are starting to talk about immutability as well. So you're welcome. If you look at the Rubik's Security Cloud, these are, this is showing most of the functionality and features we have today. It's all centered around a native data threat engine. On top of that, we have the classical data protection, meaning backing up and recovering. We have a data threat analytics functionality where we're able to detect and see anomalies, and we're able to do monitoring on known indicators of compromise. We're able to take a feed from Mandiant or other sources. So we are aware of more than 1,800,000 known indicators of compromise, and we're scanning all our customers' backups for those known binaries. We have a data security posture built in as well for customers that wish to use, this functionality for detecting sensitive data for observing data security posture, and also for having user intelligence. And then we have a cyber recovery module where we're able to orchestrate all of these workflows or at least many of these workflows, so they can be, easily recorded, they can be replayed, and you can have activity logging and reports, out of this. On the left side of this slide, you see what we are covering. Workload wise, we are covering the enterprise on prem, type with, virtualization, with SQL, with other databases, Windows, Linux, Hyper V, all the various stuff. We also support the cloud type operations, so we are able to protect Azure VMs, Azure databases, Azure block, as well as, Google VMs, Amazon, VMs, Amazon databases, and lots of other things. In the SaaS world, we support Microsoft three six five. Apologize. That's actually not listed as an icon, but we've been able to protect backing up, recovering three six five for many years. The latest addition, which was added roughly eighteen months ago, is Identity with both Active Directory, Forest, and OntraID, and now also Okta. So we need to update this slide. And then finally, unstructured data, whether it might be on the data center as, NetApp or Isilon appliances or whether it's in the cloud, as, Azure Blob or Amazon s three, we support that workload type as well. And then on the bottom layer here, you see the zero trust architecture already explained. All Rubrik customers are entitled to be, getting help from the ransomware response team. And trust me, these guys, they are busy 24 by seven every single day of the year assisting customers that have, been hit. This service is of no charge. Any Rubik customer are able to, get the help from this team. And we also have Rubik's Zero Labs with which is our intelligence team that are gathering a lot of information about cyber threats, about protection and recoveries. So we're really learning a great deal, and we're incorporating that learning into our products directly. On the right side, you see some of the cyber integrations we do with certain vendors, such as Palo Alto, CScaler, CrowdStrike, Microsoft Sentinel. Not mentioned here is Microsoft Purview. So we really are able to send a lot of flags and alerts to these parties, and, also, we're able to receive alerts and flags from, from them as well. So this is a very busy, overarching slide. It shows all of the functionality in the Rubik Security Cloud. Important to mention here that customers do not have to utilize all the capabilities in the Rubik's Security Cloud. They're very much available as an a la carte option. As an example, if you are only interested in identity protection, well, you can just consume only that and and nothing else. And later, at some point, you may want to explore backing up cloud objects or, on prem, data center objects. So you can truly mix and max mix and match the offerings from the Rubrik Security Cloud you want to consume in your own, base. Now most cyberattacks today, they start with identity based attacks. And the nature of identity providers today is that most companies, they are using Active Directory. Some of them are then also using OntoID, and most of that combination are in a hybrid setup. And then others are using Okta or Ping Identity. But, the vast majority of cyberattacks today against infrastructures, they come from, AD logins, And that means attacks on data on domain controllers. The way these are orchestrated in a fabric interconnected through many, many years of service and backwards compatibility, there are a number of, loopholes that can be exploited if they have not been properly shut down. And the list is, almost endless here. It's it's very long, at least, Starting with SMB versions, SMB one, SMB two, SMB three, many of these types of protocols are still kept accessible for legacy support, but, you should realize that you're not doing yourself a favor by keeping these ancient holes, attackable because they will be, most likely exploited by, by cyberattacks. If and when one of these active directory controllers, domain controllers, are getting infected, the way they are meshed together means that they will use they will usually all be, affected as well. So a breach on one will most likely mean a breach on all of them, which means your entire identity provider can no longer be trusted. You would have to recover it back to a good known state. You would have to identify clean and then recover. And that's the main purpose of today's gen rubric here. So one falls, they all fall. That's usually what we see. These are the kind of learnings we're getting from the, from the, zero trust team we have here. Talking about how companies are usually protecting their identities, meaning how they are able to recover. So you have the AD and I'm admins. Usually, we see a point based solution to protect this architecture. And for this, you need, of course, the point based solution, whatever that means. That's usually running in a VM or a physical server, and some times, it it may be a a SaaS application. Of course, you need a backup admin and I'm admin to manage that as well. Usually, we see that these solutions are then backing up and dumping, this backup to an SMP share. So now we need a storage, persona in the mix, and we need a an SMP share. Sometimes, we also see that these are being sent to the cloud, which is obviously a good thing. We want to have backups in in multiple locations. Then for the rest of the real estate, whether it's on prem or in the cloud, we usually see other backup vendors, maybe just one, maybe multiple. So we need a backup admin to maintain that and schedule those backups as well as the point based solution. And what we see is that then the backup vendor will run by that SMP share, make a copy of that dump of that active directory backup. So now we are talking a multistaged phase approach here, which is going to limit the frequency of how often you can protect your, your AD. And, also, there is some implications whether your AD backup is complete and successful before you can back up those files with your backup vendor. So there are some timing if, issues involved as well. It all goes, against our primary interest, which is to have as many consistent point in time copies as possible so we have a choice so we can identify the best clean point in time and recover back. Also, this means that if you are recovering your Active Directory, you would first have to recover the backup files from that Active Directory assuming that your SMB share was compromised as well And assuming your backup vendor was not compromised, which, frankly, we see that quite often. And then also assuming that your disk storage where your backup vendor is is sending the backup data to is also not compromised. So I already jumped ahead in this slide. If you have a compromise in your AD, it might as well lead to a complete failure of this entire, structure, this entire chain. Not also, well, also worth mentioning, your point based solution protecting your AD. If it runs in a physical server, if it runs in a virtual server, it might have been, hit as well. So you would also need to recover that before you can even start recovering your AD. So a long chain of things that can go wrong, a lot of administration points, and you can replace all this complexity simply by using Rubik identity recovery, where we're able to protect the AD and the forest consistently using the the known Rubik resilience that we've been building on for quite a number of years now. Everybody knows, this slide. The threat landscape is simply growing. Identity is under attack, and the statistics are, speaking a very loud and and clear message here. Also, worth mentioning is identity services, they are both our our weak spot because if they are getting hit, well, then no user will be able to access any resources as the identity provider is providing access, governing access from users to applications. So for that reason alone, we need to protect it. But, also, because it's the vulnerable part, this is the first identity creep that will happen in the identity provider. That's another good reason to be able to protect and recover this. And if you have a breach, you will end up having nothing reachable either because your resources was encrypted or you were just limited access to them. In both cases, we need to recover clean. I already mentioned all the challenges with your current ex approaches here. You can have your backups exposed. The recovery is complex, time consuming. It's multi multiple steps, multiple phases. You have to get them all right. And I'm not even talking about, forest recovery yet. You have multiple tools, multiple personas, multiple, security, weak spots, and, of course, with multiple tools, higher overhead and higher license, fees that you have to pay. And then you probably also have a limited recoverability. Even if you can recover an AD, that doesn't mean you can recover your forest, and it certainly doesn't mean you can recover onto ID. And if you are in a hybrid setup, you certainly won't be able to do all of these things unless you have tools for all of this. So we want to avoid these challenges. We want something that's simple so we can recover fast even in a time of crisis. So that leads to this slide here. Why do we need identity recovery? We need to be assured we can recover at any time to any point in time. So we need options as well here, and we need to be able to do it fast. We need to recover without reinfecting. This is a very classical dilemma. If you recover from your latest backup, there's a high likelihood that you'll reinfect your environment, and this whole charade starts over again. Not funny. We have to avoid that. So we have to go back in time, identify clean. And once we've done that, then we can recover something we know is clean, but then we're going to potentially be missing a lot of good changes in our identity provider. And, actually, when I mentioned that, I can also mention that we are working on a roll forward capability. So once we've identified clean, we can recover that specific point in time, and then we're able to roll forward good changes. More about that later, sometime after this summer. We need to be able to recover both AD and Antra, also in hybrid mode. And forest, well, that has to be consistent. Otherwise, you don't have a a workable environment. Speaking about forest recoveries, one, good advice to all of you listening in here is if you haven't practiced forest recovery, I really urge you to make sure you, get to do this. You should be testing and practicing forest recovery, likely every third month or at least every six six months so you are able to figure out how how fast can you do this, how difficult is it, and will it be consistent once you're complete. There is actually a Microsoft, best practices guide for Active Directory forest recovery. It's, seen here on this slide. And no, worth mentioning is we have at least 20 steps for each of the domains that you are recovering to have a forest recovery. This is very complicated. If you've done it manually, well, kudos to you, then you truly are a, a gifted person. But being able to do this under immense pressure in a time of crisis, it's a very stressful event, and it's very error prone and and time consuming. So our response to this complexity and also for the purpose of being able to test it is to now have a five step simple forest recovery, workflow. So now we are simplifying this. We're still following all the steps that Microsoft has depicted in their best practice, but now we're doing orchestrated. We're reducing the complexity to something that's very simple, and you'll be able to practice this today in today's hands on labs. Of course, we can also do granular restores of all the objects in your active directory or active directories. So you simply, select your point in time, you select your objects, and you recover them. In this process, you can also observe how the attributes may have changed, depending on which time point in time you're looking at. And with Anthra ID recovery as well, we now have a solution for hybrid setups where then you can first recover your AD Forest, then reestablish your synchronization, and then recover your missing, intra ID objects. As said, the orchestrated AD Forest recovery, we have removed the complexity, in a great deal. So now it's five simple steps. It's orchestrated. You can practice this anytime you like. You can recover into an isolated recovery environment. And quite frankly, if you have a major breach in your active directory, you will find that the only, viable solution is to recover clean, and you have to recover into a different location, most likely, or at least an isolated recovery environment. It doesn't have to be the different location, but it has to be isolated so you know you're starting from a fresh point in time. We can help you with this as well. We have AD object comparison. As I already mentioned, you can see the attributes and how they were changed from different, points in time in this, time finder, type functionality you get with with Rubrik. Actually, kind of a time machine. Hybrid recovery, yes, they are very much, available here. So you do AD Forest. You do AnthroID as well. Same tool, same look and feel, same way to operate, and same security measures. This is going to dramatically decrease your your solution's sprawl. And as you probably are starting to realize, simplicity is part of being, secure. If you have something that's complex and difficult, well, chances are you'll get it wrong. So you absolutely you absolutely want to be looking for something that's simpler yet, of course, secure. So with all this, now you have the Rubik benefits with identity recovery. So we are now in a state where we are immutable. We know that even the worst case of scenario will not lead to the loss of backup data. What used to be complex is now a lot simpler and something you can practice in time of peace so you know how to deal with them in time of war. You're reducing your scroll, your tooling, your license, and the personas that need to be involved. And, of course, with role based access control, you're very tightly limiting who has access to which parts of, the things you need to protect. And what used to be limited by either you couldn't do a forest recovery or you couldn't do Entra, you couldn't do both in a hybrid world, well, now you have it both. And, actually, we have incorporated Okta as well. So that's if if Okta is part of your identity provider, we can help you backing up recovering that too. Those were the words. Worth mentioning is I only talked about identity recovery for, yeah, the last eight months. We've had something called identity resilience. We don't have a kenprobic lab for that yet, but identity resilience is, in short, the way to see how identity provider configuration might lead to to loopholes. We are able to identify, problems with your identity configuration. We are also able to see alerts such as users being elevated, group policies being changed, members being added to administrative groups, delegations, and all these things. So now we are moving from being a strictly reactive tool to actually start being a proactive tool that can perhaps even stop these attacks or at least some of them. We are at least able to start having this ability into what's going on before the package of the encryption, the malware is being fully detonated. So more about that later. Also, with identity resilience, we have now to, together with CrowdStrike and Microsoft Defender, a great number of, flags we're able to see and remediate directly without having to do this nuclear restoration of the entire identity provider. So, hopefully, sometime, either, shortly before summer or after summer, we'll be able to have a Cambridge identity resilience. Now I will be pausing and leaving you time for q and a. Please shoot any question you might have. And, also, we'll be starting to be moving into the next stage of Cambrobrick, which is the, the, story lane click through demo. Question to you, and how does it look on the on the q and a? Do we have any No. We're all good. It's taken care of. So there's one, one question on, the orchestrate recovery being licensed. So yeah. So this is a license as part of our identity suite, which which includes the entry ID backup and recovery capability. Very well. Good. And I can see Francesco has posted already the link to the Rubik's story lane. Actually, let me click it, and you can see how it looks. Let's see. Hope it's sharing. So once you've clicked the link, you should be brought into the story lane. And there, you are seeing your steps that you're going through for identity recovery, from creating Rubik SLAs, which are policies, assigning the policies. There will be some in place recoveries, some alternate host recoveries, so you need to practice to be able to do both, object attribute comparisons, and then onto ID granular recovery, attribute comparison, and a full tenant recovery. Actually, we have cross tenant recovery supported as well with Rubik Security Cloud. That's not yet in this camp Rubik, so we hope to have it updated also in the near future. So you simply start with chapter one, and then you follow the guidelines on your screen. Again, let us know if you have any questions, comments, if you have issues reaching the link or anything else you want to be, getting assistance with. Just, don't hold back. Feel free to shoot whatever you have. So I'll be, quiet now and leaving you time, for going through these exercises in your own time. We will be checking in during the event, and we'll keep this event active as long as there are interactions. So, enjoy the the click through labs, and, let us know if you have anything you you want. Thank you. Thank you, Salvator, and I think there is still a question there. I'm moving them to the q and a part. I can see a question from Giovanni. Is it possible to sell the solution as part of an MSP service? Yes and no. We are getting full MSP support sometime after this summer. The issue with MSP is you want to be able to put various customers from the MSP perspective into their own, administrative, realm. Within Rubik Security Cloud, we call this organizations. However, identity recovery, I believe, is not available as, MSP organization type yet, but that will be coming shortly after this summer. That's a quest you replied that already. Chatting. So Yes. Just gonna put that there. I might as well take that question. So for forest recovery, if there are errors during recovery for replication between parent child, does the wizard parent and child, I'm sure it's meant. Does the wizard provide specific errors and fix that? Well, actually, yes. Post the forest recovery, first of all, we show all the stages of the forest recovery, and you'll be able to see once it's complete, we do an error checking of, DNS, of replication, of DHCP, and other things, and you should be able to see that in the, in the guided labs, the, the end state summary report. And, yes, if we do see errors within the replication, we will be flagging them. So you're able to see at least that there are some issues. I wouldn't say we specifically know how to handle that problem because it could be various types of of issues. But, certainly, we are providing you a visibility, so at least you can start looking into it. Also, for Forest Recovery, we are recovering, one domain controller per directory, but we can also be, deploying multiple domain controllers once that first one is, is recovered per active directory. So, we will be, going off camera here, but we are still, available and present. So just let us know if if you have any questions, And do enjoy the labs. Thank you. Hey, guys. Me again here just to be following up if everything is going like it should if you are in the click through demo and are progressing, also, go ahead and ask all the questions. We've had a lot of questions in, and, hopefully, they are all answered. If we missed any, let us know. If you have new questions, let us know. And, also, we may, end this event earlier. It, again, it depends on how much interaction there is. So, keep the questions posted. Otherwise, enjoy the the click through demo. I actually also forgot to mention that for those that would like to see the real product, that means not a clickable demo. Of course, this was built from our real product. If you want to see the the real, Rubrik in action, let us know, and we can provide hands on labs for you for active directory and for forest and and Entra ID. So this is certainly, an option we have. We decided to do this because it's it's faster to click through without waiting, and especially the forest recovery can take up to two hours, which would be immensely boring in a, live hands on lab to be sitting and waiting for paint to drive in two hours. But if you want to experience it, let us know when and we can provide it for you. Enjoy. Thank you, Salvatore, for the clarification. And as well, if you want to, as some people asked for it, if you are interested in revisiting the lab, so the take through lab, it will be still available for additionally at least twenty four hours. So please take your time to review any step. Thanks. Hey, guys. I just noticed, the last question we got in, from Alessandro. I answered it already. But I probably should have mentioned also if you are compromised, so that meant you there was an attack and you want to recover back, obviously, we we assist with the recovery functionality, the AD, the forest, Then we need to recover the, the synchronization, the Entra Connect or the, Azure AD Connect. After that, we need to allow the synchronization to fully run through. Then we will be recovering the on file ID, attributes to the objects, and we will be enabling all the relations between the users groups and conditional access policies and and what have you not. But, I missed one part here. If this was, the result of a a compromise and attack, then you would be wanting to be able to determine when you got infected. Meaning, when was the initial identity creep when the first bad actor log on, when did they start elevating permissions, and all these things that led to the actual malware, executing the payload. Rubrik is able certainly to help you identifying all of these events before the attack. So even though the attack went fast and you missed it and you got affected and you have to recover, it's certainly very critical to be able to isolate and determine that point in time you want to recover to so you're not reinfecting. So I should have added that as well, but I might as well, speak it out, which I just did. So thank you for that good question. So we're getting another question here. How about ransomware and malware infections or infestations, which can happen weeks or even months before. Is that data lost because of its, because it's infected? Very good question. Let me see what I can be providing to answer that question. Hang on. Be patient. You know what? Why don't I just open up my demo so I can I can show you? There. So now you see hopefully, I'm sharing the Rubik Security Cloud. So what we have here are multiple applications, if you will. One is data protection, backing up, recovering. Remember, we are still a a time machine for data and and and services, so we can recover from any point in time that was backed up and is under retention. So let's go to identity. Let's go to active directory. So here we have a single forest, single domain. Here we have a four domain forest. Oh, by the way, that reminds me of that question of the replication. Let's see the tracker. It was recovered. Viewing the tracker, this happened April 9. Took one hour fifteen minutes. The first domain, there you see all the steps we went through. Reboot into directory services recovery mode, restore active directory data, reboot into normal mode, disable initial replication, sees the FSMO roles, clean up domain controller, reset the Kerberos ticketing account password twice like Microsoft recommends. Reset trusts. Configuring as where's the writ raise and invalidate the writ pool, and health checks. Let's see. We have a warning down here for this domain, and there we see the health checks. It was actually a DNS health check. So we did recover, but we were unable to successfully verify the state of the DNS after recovery. Of course, some things will not always go 100% correctly, so it's very important to to be able to see, observe, and then you can when you test this, you are able to practice, and then you can fix the problem so it won't and by the way, there you see replication health check. So we do check. Now I'm constantly derailing myself. Let's go back to the data threat analytics. So if you have an attack, we will be able to detect it. We see two things. We we see threats. The threats are the indicators of compromise. So that's the known binaries that are malware. And remember I said we get the feed from Mandiant? So we have this 1,800,000 known IOCs. So for any backup any backup we've done since however long retention we have, we have checked every single backup against this database. So if there is a threat, we will find it. We will alert, and you will know when that threat was detected, and you will know then what is the good point in time. Right? So you have the good point in time. By the way, there you see the intel feed. We can add more feeds. So you if you have more indicator of compromised feeds, you you can use those. Going back here to the threats, once you have identified a known indicator of compromise, once you can see it was detected April 28, and we also, use Yara rules and file hashes. So before April 8, we are good. We we need to recover before that. And, of course, when we recover to before April 8, if we recover this host as well, the infected data will be out, obviously. And, of course, we will never allow to reinfect. We will put malicious objects in in quarantine. The other thing we do, which we've been doing since 2018, is anomaly detection. This is the ability since we are protecting files and servers and VMs and databases, we know the intricate changes between all those files because we are picking up the incrementals at any interval, whether that is hourly, daily, or continuous, or what do I know? When we see anomalies, that means we are seeing signs of encryption. So this is when the payload detonated. Actually, we are able to see then specifically, we can find the ransomware node. We'll see the encryption. We'll see the executables, and we can see all the hits here, and we will have a timeline again. So when we go into the file system and browse these changes, we'll see this was the file system. It's this share, and then we'll be categorizing these changes as suspicious, added, deleted. And reminder to us all, what is a ransomware attack? That is encryption of files. What is encryption of files? It is take a file you encrypted, and you delete the good one. And you do this for all files. So what's left are these suspicious files. Since we know of the changes throughout the environment, it's an easy task for us to say, well, I want to recover all the good data back. So I have the time. I have the timeline. I have the blast radius. We can use this actively to cut down the time it would take to do all the forensics that's holding us back from the initial well, to doing the actual recovery. So data threat analytics and anomaly detection, that's part of our components in the Rubik Security Cloud available for customers that want to use them. So it's it's actually part of our enterprise edition, license feature. Yep. Thanks for that question. And thank you all. I think, we should be considering ending the CAM Rubik for today. If there are no further questions, now is the time to shoot. I would like to thank you all for attending. Good to see you. Hope you got you had some good takeaways you could use and implement in your day to day operations and at least, getting more awareness and and understanding, what we are dealing with here outside of, obviously, just standard backup recovery, all that. Thank you. Have a great day. so much for it. Thank you, Anne. Thank you. everyone attending today's session, and, we'll have a new one soon. So feel free to, connect again to register to other labs, and, we'll have a a new calendar very soon for the upcoming months. Thank you again, and, enjoy the rest of your day. Cheers.