Home > Storage > PowerMax and VMAX > Data Protection > Dell PowerMax Cybersecurity > PowerMax 2500 and 8500
PowerMax 2500 and 8500 arrays use device level monitoring to detect unusual IO patterns. These pattern deviations could be an indication of a ransomware attack.
The following IO patterns are being monitored:
AI anomaly detection learns a normal FLIP and WAR rate for each device. If there is a significant deviation outside the normal, an event will be posted in the symevent log. These events in the symevent log are searchable using the symevent Solutions Enabler command.
The following figure shows an example of the output of the symevent command.