Protecting data and being able to recover it quickly after a failure or cyberattack are fundamental to business continuity. For this IBM offers, among others, the Safeguarded Copy function in IBM FlashSystem storage and IBM Storage Defender Sentinel (formerly IBM Storage Sentinel), which according to IBM combines IBM Storage Defender Copy Data Management with software that scans backup snapshots for corruption. This article describes how these elements work together, based on IBM documentation.
Technology Overview
Two pieces of this puzzle are IBM Storage Defender Copy Data Management and the IBM FlashSystem family with its Safeguarded Copy function.
IBM Storage Defender Copy Data Management
According to IBM, Copy Data Management manages copies in place, on existing IT infrastructure and without adding hardware: it creates and provides snapshots, copies, clones and replicas where they are needed, without creating unnecessary copies. On IBM FlashSystem and SAN Volume Controller storage it takes application-aware, immutable Safeguarded Copy snapshots.
IBM also states that Copy Data Management automates application-aware snapshot and replication management, catalogs volumes, snapshots, virtual machines and files, offers self-service access for internal customers, and provides API-based automation. In the Sentinel offering, application-aware snapshots cover workloads such as Oracle and SAP HANA.
IBM FlashSystem
On IBM FlashSystem storage, the Safeguarded Copy function creates point-in-time copies of volumes that, according to IBM, cannot be changed or deleted through user errors, malicious actions or ransomware attacks, and isolates them from production data so that data can be recovered quickly after a cyberattack.
Safeguarded snapshots can be scheduled by the storage system itself — through an internal scheduler defined in the snapshot policy — or by an external application: IBM names IBM Copy Services Manager and Copy Data Management. This is part of a disaster recovery and business continuity strategy.
📚 Read the complete guide: Backup: The 3-2-1 rule and backup best practices
Integration of IBM Safeguarded Copy with IBM Storage Defender Sentinel
According to IBM, IBM Storage Defender Sentinel adds to Safeguarded Copy what immutability alone does not provide: knowing which copy is clean. Real-time protection does not stop every attack, so an immutable copy may contain data that was already corrupted before it was taken — Sentinel scans snapshots for such corruption. This way protection against ransomware also covers fast recovery from a clean copy.
IBM Safeguarded Copy
IBM Safeguarded Copy is a function of IBM FlashSystem storage that creates immutable point-in-time copies of volumes and isolates them from production data. Users with the Administrator role can configure them but cannot change or remove existing Safeguarded snapshots — that is reserved for the Security administrator role and superusers. Snapshots are taken by a scheduler defined in the snapshot policy.
IBM Storage Defender Sentinel
IBM Storage Defender Sentinel combines IBM Storage Defender Copy Data Management with anomaly scan software. According to IBM, the scanner checks immutable snapshots for corruption caused by malicious code — with a machine learning model that evaluates file statistics and with database integrity checks — and shows alerts on the analyze dashboard, from which the administrator can restore affected files from clean copies as part of data recovery.
How the Elements Work Together
According to IBM, Copy Data Management takes application-aware, immutable Safeguarded Copy snapshots, the scanning software catalogs them and scans them for corruption, and after an event Copy Data Management coordinates fast application recovery. Recovery does not start on its own: once ransomware is detected, IBM advises contacting your security team and IBM support first.
Data Protection and Recovery Workflow
The data protection and recovery process with IBM Safeguarded Copy and IBM Storage Defender Sentinel consists of several stages described in IBM documentation: the snapshot schedule, scanning the copies and recovery after an attack is detected — plus team actions that no tool replaces.
Safeguarded Copy Snapshot Schedule
The first step is the snapshot policy: according to IBM, Safeguarded snapshots are created by an internal scheduler defined in the snapshot policy or by an external application such as IBM Copy Services Manager, and the configuration should be tested regularly so that Safeguarded backups are ready in the event of a cyberattack. Frequency and retention of the copies should match the organization’s requirements and security policies.
Backup Planning with Scan Analysis
The next stage is enabling Sentinel scanning in IBM Storage Defender Copy Data Management backup jobs. According to IBM, the scanner uses a machine learning model trained on real-world malicious code and finds corruption once an attack — ransomware or another form of malware — has already penetrated other defenses. IBM also notes that for VMware backups, scanning requires selecting individual virtual machines rather than an entire datastore.
Fast Data Recovery
After a threat is detected, IBM advises immediate contact with your internal security team and IBM support, followed by a review of the alerts on the analyze dashboard, which points to possibly infected files. From the dashboard the administrator restores affected files from clean copies; sometimes the operating system and application must be recovered first, which is why IBM recommends keeping cold/offline standby servers.
Cooperation with nFlo
The final stage is cooperation with the nFlo team, which can offer additional support and guidance in the data recovery process. In cases of particularly complex cyberattacks, the nFlo technical team can help identify optimal recovery strategies and implement long-term solutions aimed at strengthening organizational cyber resilience.
A workflow built on IBM Safeguarded Copy and IBM Storage Defender Sentinel combines immutable copies with their scanning and automated recovery; according to IBM, it is an additional layer alongside real-time security, not a replacement for it.
IBM Storage Defender Sentinel Use Cases with Applications
According to IBM, IBM Storage Defender Sentinel scanning is supported for Oracle, SAP HANA, Microsoft SQL Server and InterSystems Caché and IRIS databases, VMware virtual machines, and Windows, Linux and AIX file systems; for each application IBM specifies separate version and operating system requirements. Two of them are described below.
SAP HANA
SAP HANA is on the list of applications supported by the Sentinel scanner; IBM specifies the supported database versions and operating systems (Red Hat Enterprise Linux, SUSE Linux Enterprise Server). The scanner checks the integrity of the internal database data, and according to IBM Sentinel provides automated recovery orchestration for SAP HANA too, which helps keep critical systems running.
Oracle
For Oracle databases IBM specifies support for standalone instances without ASM (Non-ASM Standalone) on listed versions of Red Hat Enterprise Linux and AIX. Safeguarded Copy snapshots protect the copies from change, and the Sentinel scanner checks the integrity of database pages and allocation tables in them before a copy is used for recovery.
Summary and Conclusions
With increasingly advanced ransomware attacks, what matters is not only data protection but also the ability to recover quickly from a copy you can trust. IBM Safeguarded Copy provides immutable copies, and IBM Storage Defender Sentinel checks them for corruption — for workloads such as Oracle, SAP HANA and the Epic system — and makes recovery automatable.
Key Conclusions:
Two layers of copy protection: Safeguarded Copy protects copies from change and deletion, and Sentinel checks their content — according to IBM, combining corruption detection with snapshot management and recovery orchestration.
Process automation: the snapshot schedule is run by the storage system or an external application, scanning runs in Copy Data Management backup jobs, and recovery is coordinated by Copy Data Management; once an attack is detected, however, IBM advises action by the security team and IBM support.
Fit to the environment: the administrator sets alert thresholds per host, manages YARA rules and the trusted files list, and chooses the supported applications to scan.
Importance of continuous development and education: In the context of the dynamically changing cyber threat environment, continuous tracking of the latest trends in data protection technologies and investing in employee education regarding security best practices is extremely important.
Final Conclusions:
IBM Safeguarded Copy and IBM Storage Defender Sentinel do not replace a recovery plan, but they shorten its hardest step: finding a copy you can trust. According to IBM, Sentinel adds a layer of protection alongside real-time security and makes recovery from a clean copy automatable.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Mass Storage System — A mass storage system is a technological infrastructure designed for storing,…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
- Storage Virtualization — Storage virtualization is a technology that enables consolidation and…
- NIST Cybersecurity Framework — NIST Cybersecurity Framework (NIST CSF) is a set of standards and best…
Learn More
Explore related articles in our knowledge base:
- How IBM Storage Defender Sentinel Works: Detection, Analysis, and Data Recovery Mechanisms
- What Is IBM Storage Defender Sentinel? Main Features, Benefits, and Applications in Ransomware Protection
- How IBM FlashSystem Works: Storage Management, Security, and Integration
- How IBM Fusion Works: Comprehensive Functionality Overview
- What Is IBM FlashSystem? Key Features, Benefits, and Applications in Data Management
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
- IBM Storage Defender Sentinel — IBM
- IBM Fusion — IBM
- IBM Apptio — IBM
Frequently asked questions
How do IBM Safeguarded Copy and IBM Storage Defender Sentinel work together?
IBM Safeguarded Copy creates point-in-time copies of volumes that, according to IBM, cannot be changed or deleted through user errors, malicious actions or ransomware attacks, and isolates them from production data. IBM Storage Defender Sentinel combines IBM Storage Defender Copy Data Management, which takes these snapshots, with software that scans them for corruption caused by malicious code, so that recovery from a clean copy can be automated.
What is the recovery workflow when Storage Defender Sentinel detects a ransomware attack?
IBM recommends immediate action: contact your internal security team and IBM support, review the alerts on the analyze dashboard to find possibly infected files, and restore affected files from clean backups before clearing the alerts. In some cases the server operating system and application must be recovered first; IBM Storage Defender Copy Data Management coordinates application recovery from a clean copy.
What types of threats does IBM Storage Defender Sentinel detect beyond ransomware?
According to IBM, beyond malicious code the scanning software checks the integrity of databases: corruption can come from an attacker, logical or physical data corruption, damage at the disk or volume level, or a flaw in creating a snapshot or backup of the database. IBM also lists scanning for malware, database corruption, YARA rule-based threats and custom threshold alerts.
Do these integrated IBM solutions provide regulatory compliance for data protection?
IBM does not declare compliance with DORA, NIS2 or banking regulations for them. What IBM documents is technical: Safeguarded Copy creates copies that cannot be changed or deleted through user errors, malicious actions or ransomware, and Sentinel scans those copies for corruption and supports automated recovery from a clean copy. An organization can use these capabilities as evidence in its own compliance programme.
