NetBackup can detect system anomalies during critical operations as follows:

• NetBackup clients that are offline under suspicious circumstances.

  The 'Client offline' anomaly adds the ability to detect offline clients because of a compromised file system on a NetBackup host. Once the anomaly is detected, NetBackup generates a critical alert for the affected client.

• Any unusual manual NetBackup image expirations or expiration date modifications.

  The 'Image expiration' anomaly detects any unusual attempts that privileged users make to expire backup images. Once the anomaly is detected, NetBackup generates a critical alert and identifies the user.

• Ransomware file extension system anomaly

• Rule-based system anomaly

  See Configure rules-based anomaly detection.

• Risk engine-based system anomaly

  See Configure risk engine-based anomaly detection.