NetApp Data Infrastructure Insights (formerly Cloud Insights)

NetApp Data Infrastructure Insights is an observability and monitoring service that gives visibility and analytics across public clouds and private data centers. It collects data from storage, compute, and Kubernetes environments through data collectors and agents, and it includes Workload Security, which analyzes user file activity to detect suspicious behavior such as ransomware.

Key Capabilities

• Data collection: Data collectors gather data from monitored systems. An acquisition unit hosts the collectors and is usually a virtual machine in the same data center or virtual private cloud as the monitored systems. One acquisition unit can serve several collectors. The documentation includes a data collector support matrix.
• Kubernetes monitoring: The Kubernetes Monitoring Operator has four components: cluster metrics, plus optional network performance and map, event logs, and change analysis. It supports EKS, AKS, GKE, OpenShift, RKE, and VMware Tanzu on Kubernetes 1.20 and later, and it does not support Arm64 nodes. The operator installs kube-state-metrics automatically, and Telegraf is the collection agent for Kubernetes integration data.
• Dashboards: The vendor lists standard and customizable dashboards, a Kubernetes cluster explorer and network map, and a Kubernetes workload health overview.
• Alerting: The vendor lists alerting and notifications, along with default monitors for ONTAP in the Basic edition and alerts APIs in the Standard and Premium editions.
• Multi-vendor monitoring: The overview lists log, change, and audit monitoring across vendors. Documentation I could see covers ONTAP and VMware in the Basic edition and Brocade switches.
• Workload Security (formerly Cloud Secure): Tracks file activity for each authenticated user and learns each user's normal and seasonal access patterns, so it can flag suspicious behavior without relying on ransomware signatures. It can take automated steps such as blocking a suspected user account and IP address, and it provides auditing and forensics that show the affected volumes and files, the source account, and the action taken. User information comes from Active Directory and LDAP collectors, and file activity comes from ONTAP and Cloud Volumes ONTAP. The release notes mention a second-generation ransomware detection algorithm and the use of "Access Denied" events from ONTAP.
• ONTAP ransomware integration: Workload Security receives events from ONTAP Autonomous Ransomware Protection (ARP) and correlates volume encryption events with user activity to identify the account responsible. The minimum ONTAP version for the integration is 9.11.1, and Workload Security cannot enable ARP itself.
• Editions: Basic, Standard, and Premium. Data collection is in all three, data ingestion starts at Standard, and the data warehouse is Premium only.
• Subscription: NetApp's blog says the product can be purchased as a subscription through NetApp Keystone, with NetApp providing and managing it.

Audience & Use Cases

• Audience: Storage and infrastructure administrators, and security teams that monitor file access. The sources I read name no roles, so this is inferred from the features.
• Use Case: Monitoring storage, compute, and Kubernetes environments across clouds and data centers from one service.
• Use Case: Monitoring Kubernetes clusters with the Kubernetes Monitoring Operator.
• Use Case: Detecting ransomware and suspicious user file activity on ONTAP and Cloud Volumes ONTAP.
• Use Case: Auditing and forensics after a security event.

Technical Specifications

• Collection: Data collectors on acquisition units, and the Telegraf agent for Kubernetes.
• Kubernetes: Version 1.20 and later, with no Arm64 nodes.
• ONTAP integration: ONTAP 9.11.1 or later for ARP integration.
• Editions: Basic, Standard, and Premium.

Name Change: Formerly NetApp Cloud Insights

NetApp Data Infrastructure Insights is the new name of NetApp Cloud Insights, and it replaces that product. NetApp announced the change in September 2024 at its INSIGHT conference and says the new name ties the product to its intelligent data infrastructure mission. NetApp's knowledge base calls it the new name for the previously known Cloud Insights, and Workload Security was formerly named Cloud Secure. Reviews on this listing refer to the old product by name. They describe the same product, which is why they remain here.