Cybersecurity

This module provides an overview of the cybersecurity feature in Dell AIOps. We will see how cybersecurity identifies security risks by comparing configurations to a set of security-related evaluation criteria, notifying users of any deviations from the configured plan. We'll also see how it identifies applicable Dell Security Advisories and how it can identify potential cybersecurity ransomware incidents in near real time.

Dell AIOps Cybersecurity provides ongoing risk assessment for connected and support systems through its four pillars: Misconfigurations, Security Advisories, Ransomware Incidents, and System Risk. - **Misconfigurations** detects deviations from security guidelines based on NIST 800-53 R5 control families. It uses customizable evaluation plans to surface issues with remeditation guidance. This feature requires opt-in for support products. - **Security Advisories** surfaces relevant Dell Security Advisories (DSAs) for connected systems automatically. Each advisory includes impact ratings, CVE details, and links to resolution articles. - **Ransomware Incidents** uses machine learning and 5-minute telemetry intervals to monitor data behavior and detect anomalies. Incidents progress through New, Investigate, and Closed stages for structured response. - **System Risk** delivers an aggregated risk-level view per system, combining scores from misconfigurations, security advisories, and ransomware incidents. All of this information is presented as a multi-system view but there is also the option to drill down and see system-specific information. Lastly, all cybersecurity content is role-gated and visible only to users with a **Cybersecurity** role assigned.

Misconfigurations

In this section we will be starting off with the Misconfigurations pillar. \ Select **Cybersecurity > Misconfigurations** from the left-hand navigation menu.

Click **"SETTINGS"** next to the **Misconfigurations** page title.

The Misconfigurations Settings view allows a Cybersecurity Admin to manage template evaluation plans that contain risk tests which are required by an organization policy, and then assign a template evaluation plan to relevant systems. When a new system is added to Cybersecurity in Dell AIOps, a default evaluation plan that contains common high and medium risk tests is automatically attached to the system. If required, you can always customize the evaluation plan of a system according to the organization policy.

The **Systems** tab shows system information, including templates and evaluation plans. Click "**Templates".**

1\. Evaluation Plan: An evaluation plan can be configured either by using a predefined Template or manually by clicking Edit and defining the plan settings directly. 2\. Evaluation Plan management and bulk actions Evaluation plans can be managed across multiple systems, including the ability to perform bulk actions, such as: - Enabling or disabling the evaluation plan for a group of systems - Assigning a template to multiple systems at once

The **Templates** tab shows all defined templates. Select **"Add Template"** to create a new test template.

Create a **Template Name** and select a **Product** to create a template for. Name - **PowerEdge Server Template** Product - **PowerEdge Server** Then select **"Next"** in the bottom right corner.

Each test is grouped by its Security Control Family as defined by NIST 800-53 R5. Toggling a test on includes it in the evaluation plan, meaning Dell AIOps will actively monitor for deviations against that test. Toggling a test off excludes it from the evaluation, and any existing issues associated with that test will no longer be reported. Select or deselect tests as needed for your environment. Click **"Finish"** to create the template.

This is useful for tailoring the evaluation to your organization's specific security requirements. For example, if a particular security control is not applicable to your environment or is managed by a separate tool, you can disable those tests to reduce noise and focus on the issues that matter.

Next, let's see an aggregated view of all cybersecurity issues in the environment. Select **Cybersecurity > Misconfigurations** from the left-hand navigation menu.

The **Active** tab on the Cybersecurity Issues page is now displayed. This page lists all active issues across all systems sorted by severity. Expanding any of the issues provides the issue details we have seen on the other pages.

Expand the **External key manager is not used** issue from the **dd-lab-04** PowerProtect DD system as shown below.

You may need to select the arrow icon to the right of the **Severity** title in order to sort the misconfigurations from decreasing to increasing severity order in order to more easily find the issue that we are referring to here.

Each active item provides a detailed review including description, remediation etc..

Dell Security Advisories

This next lesson looks at how Dell AIOps can identify applicable Dell Security Advisories for the systems in your environment.

Click **"Security Advisories"**

We can see a list of all relevant Dell Security Advisories for our environment. Dell AIOps built-in intelligence evaluates outgoing Dell Security Advisories to learn which combinations of systems, software and firmware versions are affected, and then displays only those advisories that are applicable to the user's environment. This eliminates the need for users to review email security notifications and determine if they are applicable to any of the systems in their environment. Select the **Advisory ID** on **DSA-2021-134** to see additional information.

Tip! Selecting the **View Article** hyperlink directs us to an associated knowledge base article or website with resolution details. This is not supported in the demo as it requires external network access.

The resulting window shows the details of the DSA with additional information including a comprehensive list of applicable CVEs (Common Vulnerabilities and Exposures) as well as the affected systems. Click **"More..."**

This will show us the full list of CVEs associated to this Security Advisory.

Cybersecurity Ransomware Incidents

In this section we will look at cybersecurity ransomware incidents. In the event of a ransomware incident where an attacker attempts to encrypt the data, the amount of reducible data drops as the encrypted data is irreducible. By modeling the expected reducible storage range of storage groups and storage resources, Dell AIOps can identify anomalies in the amount of reducible storage and alert us of potential incidents. This capability is now supported on multiple platforms. PowerMax has reached general availability (GA), and PowerStore support is currently in Beta.

Tip! PowerMax ransomware incident monitoring is only supported for the following systems: - PowerMax 2500 and PowerMax 8500 systems running PowerMaxOS 10.0.1.3 or later, managed by Unisphere V10.0.1.3 or later. - PowerMax V3 models with PowerMaxOS 5978.711.711 or later, managed by Unisphere V9.2.4.1 or later. - PowerStore systems version 4.0.0 or later that meet one of the prerequisites below: - Volumes must be created after upgrading to PowerStoreOS version 4.0 or later. - Or, existing volumes must have at least 90% of their address space (logical used capacity) written after the system is upgraded to version 4.0 or later. These volumes should also be eligible for reducible data and have Data Reduction Ratio (DRR) metrics available in PowerStore.

The ransomware monitoring configuration experience is consistent across all supported platforms. PowerStore users follow the same workflow to select and configure storage resources for monitoring. The interface presents the available storage resources, their current monitoring status, mode (Learning or Detecting), and incident sensitivity level -- identical to what we just walked through for PowerMax.

Click **Ransomware Incidents.**

Let's first see how we enable Cybersecurity ransomware incident monitoring. Click **Settings**.

We now have a list of all supported PowerMax systems in our environment. Here we see that the Finance PowerMax is available. We also see that 8 of 12 storage groups are already enabled. Click **Configure.**

We can now choose which storage groups we want to monitor. The table tells us which ones are already enabled, what mode they are in, and the storage resource sensitivity level. The mode displays either Learning or Detecting for enabled storage groups. When it is initially enabled, Dell AIOps needs to learn the expected behavior of the reducible data. This occurs for 2 weeks and once the expected behavior is modeled, the storage group switches to Detecting mode where it can now identify anomalies and alert us of ransomware incidents. The storage resource sensitivity level sets the sensitivity of the monitoring and allows us to tune the detection method to adjust it to the environment and help reduce false positives. There are 3 valid sensitivity level values: - High: Detects minor anomaly deviations. High sensitivity may increase the likelihood of false positives in ransomware detection. - Medium: Detects moderate anomaly deviations. Medium sensitivity may generate more false positives than Low in ransomware detection. - Low (default): Detects significant anomaly deviations. Low sensitivity helps minimize false positives, though occasional alerts may still occur. Select **Finance_SG_14**.

We can now set the Sensitivity Level. Click **Sensitivity Level** to see the 3 possible levels.

If we wanted to enable monitoring for this storage group, we would click **Enable** under the **Learning Mode** group and the selected storage groups become enabled.

If you clicked Enable, you'll see that we cannot enable monitoring while in simulator mode. Click **OK** to dismiss this warning.

Now that we know how to enable ransomware incident monitoring, let's see what we do when an incident is detected. Click **CLOSE**.

Let's return to the Ransomware Incidents page by clicking the "**<-**" icon.

We see that there are 3 tabs for incidents: New, Investigate, and Closed. When an incident is first detected, it shows up in the New tab. At this point, we would want to acknowledge that we are aware of the reported incident and put it in the Investigate state. If we determine the incident was valid and actions were taken to resolve it, we would Close it with an Incident Resolved status. If the incident was a false positive, we would close it with a False Incident status. Click the incident ID **1011.**

Incident Severity represents the severity level of an anomalous incident, based on the combined Significance levels across all Storage Resources involved. An anomaly is suspicious malicious encryption or compression that has been detected. The Severity level helps you prioritize incident investigations by highlighting the most critical anomalies first. This enables faster and more informed decision‑making when responding to potential ransomware threats. Valid Incident Severity values are: - High: Strong indication of malicious encryption or compression activity that requires immediate attention. - Medium: Noticeable suspicious behavior that should be reviewed soon to prevent escalation. - Low: Low-confidence indicators that require ongoing monitoring and oversight to determine if the indicator develops into a real threat.

We have opened the details of the incident. The top of the page tells us the status, incident severity, when the incident was created and updated, and system information. There is also a link to open any notes that have been entered for this incident. The bottom of the page lists the storage groups involved along with number of logs (anomalies), created and updated dates. As the number of storage groups experiencing a reduction in reducible data increases, it becomes more likely that we are experiencing a valid ransomware attack, and it is not just a one-off change in a single host or application. Select **Finance_SG13**.

Select **Finance_SG_23**.

Click **VIEW STORAGE RESOURCE METRICS**.

We can now see charts for the reducible data, the historical seasonality, and any anomalies for the selected storage groups. Click the **Anomalies** tab.

The anomalies tab lists out each anomaly meaning each data collection that fell outside of the historic seasonality. Each anomaly or log is listed with the timestamp and the significance level. Return to the incident details page by clicking **Incident 1011**.

Clicking **ACKNOWLEDGE & INVESTIGATE** would move the incident to the investigate state. At this point, the incident is "frozen" and no new anomalies will be associated to it. Newly detected anomalies will create a new incident.

Click **Cancel** as we cannot change the status of an incident while in simulator mode.

Let's return the the Ransomware Incidents page by clicking the "**<-**" symbol.

Click **INVESTIGATE** to see the list of incidents that have been acknowledged.

Clicking on the **Note** field allows us to track and record any relevant information or actions related to this incident.

Click **CLOSE**.

Once we have investigated the incident and either addressed the situation or determined that it was a false incident, we can close it. Select Incident **1008** and then click **CLOSE**.

We see that we have 2 options: - Close - Incident Resolved: A valid incident that we addressed. Dell AIOps will not account for the anomaly data when determining the historical seasonality as it did not occur during normal operations. - Close - False Incident: A false incident meaning the reducible data is accurate and no ransomware incident occurred. Dell AIOps will continue to use this data when determining the historical seasonality. We can click on **Close - False Incident**.

We get a warning to confirm that we want to close the incident. Click **Cancel**.

Let's take a look at the **Closed** incidents. Click **CLOSED**.

We now see the list of closed incidents. Note that we can still view and add notes to the closed incidents and we can also put a closed incident back into the Investigate mode.

Cybersecurity System Risk Overview

Now that we have seen how Dell AIOps evaluates configuration risks through the Evaluation Plan, let's take a step back and look at how the overall cybersecurity risk assessment works.

Select **Cybersecurity -> System Risk** to open the System Risk menu.

The **Cybersecurity System Risk** view provides Cybersecurity information for all monitored systems. The **Risk Level** is one of the following: - Normal - Low - Medium - High - Unknown These levels are based off a combination of issues for that device's **Misconfigurations, Security Advisories,** and **Ransomware** that were discovered during evaluation tests.\*\*

Cybersecurity Configuration Risks

This section introduces the Cybersecurity feature of Dell AIOps. We'll start from the Cybersecurity Risks tile on the Home Page, look at the multi-system view for Cybersecurity, and then drill into an individual system to see the system details page. We will also see how to configure which security rules we include in the evaluation plan.

Select **Home** from the left-hand navigation menu and scroll to the **Cybersecurity Risks** tile. This tile provides a single risk factor for the environment. In this example it is High. We can see that we have 108 systems enabled for cybersecurity. We also see there is an active cybersecurity ransomware incident. It is highlighted in the red banner because of the potential seriousness of this situation.

Click **"GO TO CYBERSECURITY"**

Tip! A user must have the appropriate Cybersecurity related role to access Cybersecurity features.

We arrive at the **Cybersecurity System Risk** page. This is the multi-system view for Cybersecurity showing all of the enabled systems in a single page. Each system has an individual Risk Level, a chart showing the percentage of selected (enabled) tests in the Evaluation Plan, and the number of active issues in each severity level. The risk level is determined by the number and severity of each issue. For example, a system with a high severity issue is assigned a risk level of high. But a system without a high severity issue can still be assigned a high risk level if there are more than 5 active issues with at least 1 of them being a medium severity issue. Click **"WIN-SYS02PE173"**

We've been directed to the **Cybersecurity** tab for the system details page for this PowerEdge server. We can see the top of the page provides similar information to the system tile on the Cybersecurity System Risk page: the system risk level, summary of the active issues, and the percentage of enabled tests in the evaluation plan.

The bottom of the page has two tabs: **Misconfigurations** and **Evaluation Plan**. The **Misconfigurations** tab is shown by default and lists all active issues along with the creation time.

Select the **">"** sign next to the Secure Boot is disabled issue to show additional details.

Selecting an issue provides additional information including a detailed description and remediation.

In addition to the manual remediation steps described above, Dell AIOps supports remote remediation for select PowerEdge misconfigurations. This allows users to resolve certain security issues directly from the Dell AIOps interface without needing to manually access the system's iDRAC or operating system. Users must be assigned both the Cybersecurity Admin and Resource Operator roles to be able to resolve Cybersecurity issues for PowerEdge.

Select the **checkbox** to the left of the issue.

With the checkbox selected, select the **"Resolve"** button.

The **Resolve Cybersecurity Misconfigurations** popup window is opened. Details about the action that you will be performing are shown. Click "**Resolve"** in the bottom right corner of the popup window to initiate the remote remediation.

Once initiated, Dell AIOps will execute the remediation on the target PowerEdge system. The status of the remediation can be tracked from this page. Upon successful completion, the associated misconfiguration issue will be resolved automatically.

Tip! Remote remediation is currently available for select PowerEdge misconfigurations. Not all issues support remote remediation -- for those that do not, follow the manual remediation steps provided in the issue details. The availability of the Remediate option in the UI indicates whether remote remediation is supported for a given issue.

Click **"EVALUATION PLAN"**

The **Evaluation Plan** lists out all of the possible evaluation tests grouped by Security Control Family which are defined by NIST 800-53 R5. The Status column shows if any of the tests in the group have an active deviation. Expand the **Access Control** group.

Expanding a group shows each of possible tests in that group. When a deviation does exist, details of the issue and remediation can be obtained by selecting the **Details** icon on the right.

Click the **Details** icon.

We can see the issue description and remediation in the Details page.

Tip! Changes to the evaluation plan take effect on the next evaluation cycle. Disabling a test will resolve any active issues associated with that test. Re-enabling a test will trigger a new evaluation, and any deviations will be reported as new issues.

Congratulations! You have reached the end of this particular lesson. Click **Close** in the top left corner of this script to return to the demo guide.