Schedule a Threat Scan

26 March 2026

You can schedule a threat detection scan from the Security Center on one or multiple objects on the Cohesity clusters managed on Helios.

To start a scheduled threat detection scan:

Navigate to Threat Detection > Threat Scans.
On the Threat Scans page, click Create Threat Scan.
In the Backup Location section, select Self Managed Clusters.

Use the search to find and select the object(s) you want to scan for threat detection. Also, you can use the following filters to narrow down your search and click Next: Settings:

You can use * character to list all the object(s) on the Cohesity clusters managed on Helios.
Regardless of the number of objects selected, you can choose a maximum of 1000 objects for a threat scan.
Snapshots created by protection groups with the Protect Once policy are not available for selection when creating a threat scan.

Filters	Purpose
Object Type	The type of object, such as: Acropolis Generic NAS HyperV Isilon NetApp Physical VMware View Cohesity View(s) that use S3 or SWIFT protocols are not supported. Only file-based backups are supported for Physical Servers. For NetApp, backups taken using SnapDiff are not supported.
Organization	Select one or more organizations to filter and display only the objects belonging to the organizations. The Organization filter does not apply to Cohesity Views.
OS Type	The Operating System supported by Object type.
System	The Cohesity cluster.
Source	The object.

In the Threat Feed section, you can run a threat scan using one of the following methods:
1. YARA Rules:
  
  Perform one of the following or both:
  - Choose Default Threat Library to perform the threat scan using the pre-packed IOCs.
  - Choose Custom YARA Rules to perform the threat scan using your own YARA rules.
    
    Click Select YARA Rules and select the YARA rule you want to use for the threat scan, and click Save. To add more YARA rules, click Add YARA Rule.
  - Choose Integrations to use threat feeds from third-party vendor integrations.
    
    From the drop-down list, select the third-party vendor integration you plan to use, such as CrowdStrike Falcon Intelligence.
    
    Before using the third-party vendor intelligence threat feeds, ensure you have integrated the third-party vendor intelligence with Cohesity. Click +Add Integration to integrate the third-party vendor intelligence with Cohesity. For more information, see Integrations.
    
    Click Next: Settings.
Sophos Malware Scanner:
In the Threat Feed section, select Sophos and click Next: Settings.

In the Settings section, perform the following:

Under the Scan Schedule options, schedule the threat scan by selecting one of the following options from the drop-down list:
- Once - This option allows you to perform a threat scan immediately.
- Weekly - This option allows you to schedule the threat scan to run weekly by selecting specific days for the scan to repeat.
- Monthly - This option allows you to schedule the threat scan to run monthly by selecting a specific day of the week to repeat the scan. For instance, you can choose to run the threat scan on the second Sunday of each month.
Under Scan Method, by default an Incremental Scan option is selected. Incremental Scan is performed for scanning only the recent changes instead of the whole snapshot or select Full Scan to perform a complete scan of the entire snapshot.
Under Snapshot Window, select Most recent Snapshot to select the latest snapshot of the object.

In Advanced Settings, perform the following:

Next to Threat Scan Name, click the edit button to edit the default threat scan name.
Next to Start Time, click the edit button to edit the default start time for the scheduled scans.
By default, the Scan Location is selected as Primary Snapshot on Local.
- Changing the Scan Location to Use Cluster Scanning Order option is not supported for scheduled scans.
- For scheduled scans, threat match limits, file size options and scan location are not supported.

Click Create Scan.

Cancel a Threat Scan

If you decide to stop a running threat detection scan, You can manually cancel the running threat detection scan on the object backup.

To cancel a threat detection scan:

Navigate to Threat Detection > Threat Scans.
On the Threat Scans page, click on the running threat scan.
Select the action menu on the <Scan-Run> page and click Cancel.

Datasecurity Documentation