CONTAP-693120: Anti-ransomware attack status does not clear automatically on SAN volumes

Primary item: NetApp Knowledge Base via Google News — CONTAP-693120. This is a technical KB issue record, not a press release.

What NetApp announced

NetApp has published issue ID CONTAP-693120 with the title “Anti-ransomware attack status does not clear automatically on SAN volumes.” That wording establishes a narrow failure mode: the affected object is a SAN volume, and the stale state is the anti-ransomware attack status after the event should have been cleared.

The public lead does not name affected ONTAP releases, a fixed release, a workaround or a publication date separate from the 20 October 2026 news-desk record. No numerical scope is public. Until NetApp exposes those fields, CONTAP-693120 should be treated as a known issue to check against an authenticated support record—not as evidence that every SAN volume or every ONTAP release is affected.

Why SAN handling is different

NetApp’s ONTAP documentation says SAN abnormal activity is categorized from entropy spikes. Unlike NAS file-type warnings, SAN volumes do not provide a suspected-file list or file extensions for this workflow. That distinction matters: searching for a suspect extension on a LUN-backed workload is the wrong diagnostic model.

The documented CLI classification path identifies the event by its time window:

security anti-ransomware volume attack clear-suspect \
  -vserver <svm_name> -volume <vol_name> \
  -start-time <MM/DD/YYYY HH:MM:SS> \
  -end-time <MM/DD/YYYY HH:MM:SS> \
  -false-positive <true|false>

Choose true only after validating expected activity; choose false when classifying it as a potential ransomware attack. The command records the operator’s decision and clears the suspected event. It is not a substitute for investigating the workload or choosing a recovery point.

What changes for ONTAP customers

The product change is operationally concrete: do not assume that submitting the classification means the displayed attack status has already returned to normal. NetApp documents a way to inspect clear-suspect processing beginning with ONTAP 9.18.1:

security anti-ransomware volume show \
  -clear-suspect-status \
  -volume <vol_name> -vserver <svm_name>

For releases where that field is available, capture its result in the incident record and verify completion. For earlier releases, or whenever the status remains stuck, preserve the event times and command output and reference CONTAP-693120 in the NetApp support case. Do not repeatedly reclassify the event without support guidance: the public issue record does not say that repetition is a workaround.

SAN teams should also correlate the storage-side state with host access and path health. The site’s FC/FCP SAN guide explains the initiator-to-LUN path, while SAN multipathing covers why healthy alternate paths are a separate question from ARP/AI event state.

Recovery sequencing still matters

NetApp documents that for a full volume snapshot restore in ONTAP 9.16.1 and later, the suspected event must be cleared before the restore. The clear-suspect option is unavailable after that restore. Other recovery methods, including FlexClone and single-file SnapRestore, use different sequencing: recover first, then finalize categorization.

CONTAP-693120 does not publicly say that recovery itself fails. It says the attack status does not clear automatically. Keep those two states separate in the runbook: data recovery success, ARP/AI classification, and displayed clear status each need their own evidence.

Scope: Cloud Volumes ONTAP, StorageGRID and BlueXP

• Cloud Volumes ONTAP: the public title says SAN volumes but does not publish a platform matrix. Customers using iSCSI with Cloud Volumes ONTAP should check the authenticated affected-version record before assuming inclusion or exclusion.
• StorageGRID: no StorageGRID behavior or object-storage workflow is named. This is an ONTAP ARP/AI SAN-volume issue, not a StorageGRID ransomware-status announcement.
• BlueXP / NetApp Console: no console fix, API change or new control is announced. A management-plane display should not replace verification of the ONTAP volume state.

What to watch next

• An authenticated NetApp affected-version and fixed-version matrix for CONTAP-693120.
• A maintenance-release note that names the issue ID.
• Whether NetApp documents a supported remediation for releases without -clear-suspect-status.
• Any clarification on whether the stale condition is CLI-only, System Manager-only or common to the underlying volume state.

Until those details are public, the defensible response is to retain the event timeline, classify the SAN entropy event using the documented time-range workflow, verify completion where ONTAP exposes it, and escalate a persistent status with the CONTAP ID.

Sources: NetApp Knowledge Base / CONTAP-693120 via Google News; NetApp ONTAP documentation — respond to abnormal ARP/AI activity; NetApp ONTAP documentation — recover data after a ransomware attack.