Method and apparatus for snapshot management

A system comprising:

• a memory;
• and
• a processor that is operatively coupled to the memory, the processor being configured to perform the operations of:
• starting an asynchronous replication manager, the asynchronous replication manager being configured to replicate data from a primary storage system to a secondary storage system at predetermined time intervals, wherein replicating the data includes collecting a data bucket for each of the predetermined time intervals and transmitting replication data associated with each data bucket from the primary storage system to the secondary storage system;
• detecting that an intrusion detector has detected an intrusion in the primary storage system;
• in response to the intrusion being detected, causing the asynchronous replication manager to stop transmission, to the secondary storage system, of replication data associated with any data buckets that are collected by the asynchronous replication manager while allowing the asynchronous replication manager to continue collecting new data buckets;
• generating an alert that indicates that the intrusion detector has detected the intrusion;
• receiving a response that is indicative of whether the intrusion is confirmed;
• when the response indicates that the intrusion is not confirmed, resuming the asynchronous replication manager, wherein resuming the asynchronous replication manager includes causing the asynchronous replication manager to resume the transmission of replication data that is associated with any data buckets that are collected by the asynchronous replication manager;
• and
• when the response indicates that the intrusion is confirmed, causing the asynchronous replication manager to stop collecting data buckets.

A non-transitory computer-readable medium storing one or more processor-executable instructions which, when executed by at least one processor of a primary storage system, causes the at least one processor to perform the operations of:

• starting an asynchronous replication manager, the asynchronous replication manager being configured to replicate data from the primary storage system to a secondary storage system at predetermined time intervals, wherein replicating the data includes collecting a data bucket for each of the predetermined time intervals and transmitting replication data associated with each data bucket from the primary storage system to the secondary storage system;
• detecting that an intrusion detector has detected an intrusion in the primary storage system;
• in response to the intrusion being detected, causing the asynchronous replication manager to stop transmission, to the secondary storage system, of replication data associated with any data buckets that are collected by the asynchronous replication manager while allowing the asynchronous replication manager to continue collecting new data buckets;
• generating an alert that indicates that the intrusion detector has detected the intrusion;
• receiving a response that is indicative of whether the intrusion is confirmed;
• when the response indicates that the intrusion is not confirmed, resuming the asynchronous replication manager, wherein resuming the asynchronous replication manager includes causing the asynchronous replication manager to resume the transmission of replication data that is associated with any data buckets that are collected by the asynchronous replication manager;
• and
• when the response indicates that the intrusion is confirmed, causing the asynchronous replication manager to stop collecting data buckets.