DataDefense

At the data layer, which is the one layer most stacks do not cover. Endpoint detection watches the machines you manage. Network tooling watches traffic. Backup watches the copy. ProLion watches the file operations arriving at the file system itself — every read, write, rename and delete, from every client, managed or not.

That position is the reason it can act rather than only alert: the same interface that reports the operation can refuse the next one from that account.

Coverage and speed. EDR sees the endpoints it is installed on; it does not see the Linux build server, the contractor’s laptop, the appliance with an SMB mount, or the service account running from somewhere nobody documented. All of those reach the same shares, and the file system sees all of them.

The SIEM gets the event either way. The difference is that by the time the correlation rule fires, the account is already blocked.

Syslog and CEF into the SIEM, so the detection lands in the same queue as everything else. SOAR playbooks can trigger the blocking and quarantine actions through the API. ServiceNow and Jira Service Management get an incident with the account, the files it touched and what was already done about it. Mail, Teams and Slack for the people who do not live in the console.

Nothing requires a ProLion console to be open for the event to be seen.

The clock starts at the first encrypted file and stops when the account is blocked. DataDefense reads the file system’s own file-operation stream, so there is no scan to wait for and no endpoint telemetry to correlate first.

No. The appliance attaches to the file system itself and sees every read, write, rename and delete from there. Nothing is installed on clients or servers, which is also why it covers machines your endpoint tooling never reached.

It depends on the mode you choose. In synchronous mode the file system waits for a verdict before completing the operation, which is what makes blocking possible and what adds a small latency budget per operation. In asynchronous mode it does not wait, so there is no added latency, and detection is a moment behind rather than in line.

Which mode fits which share is a design decision we go through with your IT team before anything is enabled — usually synchronous on the shares that matter and asynchronous on the rest.

The behavior is configurable, because the right answer differs by site: either file operations continue without inspection, or the file system refuses them. Most organizations run availability on the appliance instead of accepting either extreme, and the platform supports that.

This is one of the first questions an IT team asks, and it belongs in the design session rather than in a footnote.

Yes. Detection, blocking and recovery all run locally on your hardware. There is no cloud lookup in the path and no telemetry requirement, which is what makes dark-site operation possible at all.

You get the list of exactly which files the account touched, and restore those files from the last clean snapshot — file by file, not a full-volume rollback that costs you everyone else’s morning.

NetApp ONTAP, Lenovo DM-Series, Dell PowerScale, PowerStore and Unity, and Windows File Server 2019, 2022 and 2025. Each through its own native interface — FPolicy, CEE, or the ProLion Security Service.

CryptoSpike is now part of ProLion DataDefense and is no longer sold as a standalone product.