Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. IT Analytics Help
  3. Section IV. End user
  4. Alert configuration
  5. Add/Edit an Alert Policy
  6. Scope Example: Data Protection: Monitor Backup Jobs

Scope Example: Data Protection: Monitor Backup Jobs

Table: Data Protection: Monitor Backup Jobs

Rule

Job Finalized

Scenario

Monitor all backup jobs for your Tech Pubs department whose Primary Server name contains NBU, and have an Exit Status Code of 123, 456, 789. However, you only care about the Exit Status Code if it happens 3 out of 5 times. This is a run-time policy.

For the Job Finalized Alert Rule, Exit Status is a mandatory entry.

  1. Navigate to Alert>Alert Configuration>Alert Policy Administration.

  2. Click Add.

  3. Choose the Alert Rule: Job Finalized. Double-click or click Continue to advanced to the next screen.

  4. Name the Policy and set the Symptom Frequency to X out of Y.

    See Name the Policy and Define Time Intervals.

  5. Enter 3 of 5 to indicate you only want to trigger an alert if the symptom occurs 3 times out of 5.

  6. Choose or create the notification for a Warning and Critical Alert. Alert Notifications must be defined before the Alert Policy is created to select them for alerts. You can also click Add Alert Notification and define it when you configure the Alert Policy.

    See Adding an Alert Notification Delivery Method.

Setup the Primary Server Scope
  1. Under the Scope heading, click the Edit icon.

  2. Click the Primary Server tab.

  3. Choose the Operator contains and enter NBU in the field. Advanced Filter operators are available.

    See Advanced filter operators.

  4. Click Search to display all discovered Primary Servers that contain NBU in the name field.

  5. Click Add Query. This adds your filter selection as the first row in the Selected Scope. You could also drag and drop, or double click an individual Primary Server to add it to the Selected Scope. For this example, we are adding all the values found in the Search.

  6. Select Department under Attributes. Choose the Operator contains and enter Tech Docs in the field.

Note:

Because the filter value is broad (NBU instead of an individual Primary Server) when new Primary Servers are added to your Tech Docs department and given the same NBU naming convention, they are automatically added to this Alert Policy scope.

Setup the Exit Code Scope
  1. Click the Exit Status tab. For the Job Finalized Alert Rule, Exit Status is mandatory.

  2. Choose the Operator equals and enter 123, 456,789 in the field. Advanced Filter operators are available.

    See Advanced filter operators.

  3. Click Add Query. This adds your filter selection as the next row in the Alert Policy Selected Scope.

    If your query is multiple lines, you can use the Filter Logic field to customize the filter expression order and the operators. Logic defined in this field will override any setting established on the top of the dialog. Use the numbers on the left of the filter expressions to construct your Filter Logic.

    Edit the logic using the filter numbers and by adding parentheses or changing the operators. For example, you can change "1 AND 2 OR 3" to "1 AND (2 OR 3)".

  4. Click Show Resolved Scope. This lists everything in your datacenter that meets the criteria defined in your Selected Scope.

  5. Enable the Alert Policy by clicking the Active checkbox beside the Alert Policy Name field.

  6. Click Save. The Alert Policy is displayed on the Alert Policy Administration page.

Feedback

Was this page helpful?
Previous

Scope Example: Data Protection: Monitor for High Job Failure Rate

Next

Set the Threshold for an Alert Rule

Feedback

Was this page helpful?