elastioSearchRequest a demo

Search platform and solution pages, partners, blog posts, events, webinars, FAQs, and ransomware families.

Solutions / Cyber vaults

Recovery intelligence for your cyber vault.

Know which copy to restore, how old it is, and what to do next. Elastio brings Pursuit and Hunt analysis to your cloud and on-premises vaults.

Plan your vault project See the workflow
01 / Architecture

Keep your vault. Add analysis.

Your backup platform stores and restores copies. Elastio analyzes them within your vault’s access controls.

Choose where analysis runs.

Use either Hunt placement or both

Source environment

Cloud and on-premises

Source dataWorkloads, files, objects
Recovery copiesSnapshots and backups
Hunt before vaultingAnalyze source data

Live data, replicas, or backups.

Controlled copyApproved transfer path

Isolated vault account

Immutable · Restricted access · Dark by default

Vaulted recovery dataProtected, retained copies
PursuitInvestigate system copies
HuntAnalyze vaulted data
Findings and evidenceCopy · Analysis · Results

Analysis stays within the approved isolated boundary.

Vault access uses approved paths. AWS restore tests may run in a separate isolated account. Coverage depends on the source and setup.
AWS Backup Restore Testing

Add Hunt to restore tests.

Hunt analyzes restored data and returns findings to AWS Backup. Supports EC2, EBS, S3, EFS, FSx for NetApp ONTAP, and VMware recovery points.

Requires Elastio Private Cloud on AWS and the CloudFormation integration stack.

Setup guide
02 / Coverage

Cover cloud and on-premises data.

Cloud environments

Protect data across AWS, Azure, and Google Cloud.

  • AWS: EC2/EBS, S3, EFS, FSx for ONTAP, AWS Backup, and AWS Backup Restore Testing
  • Azure: virtual machines, managed disks, snapshots, Blob Storage, and Azure Files
  • Google Cloud: Compute Engine VMs and images, Persistent Disk volumes and snapshots, and Cloud Storage
  • Pursuit: Windows system copies from AWS, Azure, and Google Cloud
On-premises environments

Include the systems in your data center.

  • Storage: NetApp ONTAP and Qumulo
  • Recovery copies: supported snapshots, replicas, and backups made accessible for analysis
  • Pursuit: Windows system copies from VMware
Backup platforms across cloud and on-premises

Connect your backup platforms.

  • Cloud
  • On-premises
  • Hybrid

Backup platforms

  • AWS Backup
  • Azure Backup
  • Google Cloud Backup and DR
  • Cohesity
  • Commvault
  • NetBackup
  • Rubrik
  • Veeam

Supported recovery points and accessible copies

Supported source access

Elastio analysis

PursuitSystem investigation
HuntData analysis
Findings and recovery guidance

Connected tools

  • Security tools
  • Backup platforms
Supported workloads and copy formats vary by platform and by product.
View supported backup source details
AWS Backup
Recovery points, replicated recovery points, logically air-gapped vaults, and supported AWS Backup Restore Testing workflows.
Azure Backup
Supported Azure Data Protection recovery points. Azure managed disks and disk snapshots are additional supported analysis sources.
Google Cloud Backup and DR
Backup and DR backups of Compute Engine VMs and disks. Persistent Disk volumes and snapshots are additional supported analysis sources.
Enterprise backup platforms
Cohesity, Commvault, NetBackup, Rubrik, and Veeam through supported backup connectors and recovery-point access.
Backup platform support Supported cloud and local sources

Pursuit findings describe the system when the copy was captured.

Review detailed coverage
03 / Recovery intelligence

A backup completes. Analysis begins.

Pursuit and Hunt typically run when each backup completes, following your backup schedule.

  • Most commonBackup completes
  • Event triggerSnapshot is created
  • Time triggerScheduled policy runs

Your policies start the workflow

  1. 01 / Copy

    Identify the recovery copy.

    A backup event, snapshot, or schedule selects the supported copy.

  2. 02 / Pursuit

    Investigate evidence of compromise.

    Investigate supported system copies for attacker activity and persistence.

  3. 03 / Hunt

    Find ransomware and malware.

    Analyze supported data for ransomware encryption and malware.

  4. 04 / Findings

    Notify the security team.

    Send findings and supporting evidence to your security tools.

  5. 05 / Recovery intelligence

    Identify the last known clean copy.

    Elastio identifies the last known clean copy (LKC), shows its age, provides recovery steps, and notifies your backup tool.

Stage order shown. Execution follows your policies and supported integrations; analysis uses copies of your data.
04 / Project plan

Design, test, then roll out.

Pursuit investigates hundreds to thousands of systems at once. Hunt analyzes petabytes of data. Size the deployment with your own workloads.

  1. Step 1

    Agree the design.

    • Select workloads and supported copies.
    • Choose source or vault analysis locations.
    • Set permissions, network access, and encryption-key access.
    • Assign setup and approval owners.
  2. Step 2

    Test the workflow.

    • Connect backup events to Pursuit and Hunt.
    • Test findings delivery and backup-tool notifications.
    • Review recovery guidance and available restore-test results.
    • Measure run times, resource use, and costs.
  3. Step 3

    Roll out and operate.

    • Expand across accounts, sites, and workloads.
    • Set analysis policies and assign findings to owners.
    • Review coverage gaps and unresolved issues.
    • Update the plan as workloads change.

Agree costs before rollout.

Include Elastio licensing, compute, storage, restore and transfer charges, setup, and ongoing support.

From analysis to enforcement

Make the transfer decision explicit.

Hunt analyzes accessible copies. A configured workflow can use its results to hold a transfer or request review before vault ingress. Your vault and backup controls enforce that decision and perform restores.

Assess the specific copy, completed checks, analysis time, and applicable Pursuit findings. An immutable copy can still contain attacker persistence or damaged data.

Start your project

Bring your vault design.

We’ll help turn your workloads, backup schedule, and recovery needs into a tested rollout plan.

Review your vault project