Manual Anti-Ransomware Restoration; Anti-Ransomware Restoration - Check Point HARMONY R81 Administration Manual

n Folder - To exclude all files in a folder, enter the Folder Name or browse to it.
Optional: Select Include all sub folders to exclude all files contained in all
l
sub folders.
n Process - To exclude an executable. You can also include Certificate information.
In Process name, enter the name of the executable.
l
Optional: Enter more information in the fields shown Signer is the company
l
that signs the certificate. The more information you enter, the more specified
the exclusion will be.
n Certificate - To exclude processes based on the company that signs the certificate,
for example, Google.
In Certificate Data, enter a name of company that signs certificates, or
l
browse to add a certificate file.
4. Click OK.
5. The exclusion is added to the Exclusions list.

Manual Anti-Ransomware Restoration

If you select Automatic restore and remediate in the Anti-Ransomware Backup Settings
Action, Anti-Ransomware automatically starts Remediation after a Ransomware attack.
If you do NOT select Automatic restore and remediate, end-users must start restoration
manually on the client computer after a Ransomware attack.
Best practice is to guide users through the process and instruct them what to select when there
is more than one option.

Anti-Ransomware Restoration

In the Harmony Endpoint Forensics Analysis Report (see
see details of which files restored and deleted during the restoration.
n See which files were restored in the Business Impact section.
n See which files were deleted in the Remediation section.
To run Anti-Ransomware restoration from a Windows client computer:
1. Right-click the Endpoint Security icon in the taskbar notification area and select Display
Overview.
The Endpoint Security Main Page opens.
2. Click Forensics and Anti-Ransomware .
3. In the Analyzed cases table, click Restore Files in the row of the relevant incident.
Anti-Ransomware Backup Settings
"Forensics" on page 325
R81 Harmony Endpoint Server Administration Guide | 319
), you can