Enable Full Export and Correlation of Affected Files and Alerts in DMS Anti-Ransomware UI

Currently, when an anomaly or ransomware detection event occurs within the DMS Security Anti-Ransomware interface, the “Affected Files” page does not provide a supported mechanism to export or download the complete list of affected files. At this moment, the only available workaround relies on unsupported scripts provided by Cohesity. However, these scripts are not consistently returning the complete dataset. Having access to the complete list of affected files is extremely important for security investigations and operational validation. This list can help customers determine whether the anomaly was caused by a legitimate system activity or by a potential ransomware attack. In addition to the export capability, customers also need better alert correlation capabilities directly within the interface. Today, it is difficult to determine whether multiple alerts are related to the same source or activity pattern like same host, same file system path, etc

So, the requested enhancement is add an supported export/download and correlation capability directly within the cluster UI.

The enhancement should allow customers to:

•⁠  ⁠Download the full list of affected files
•⁠  ⁠Export results in a standard format such as .csv, .txt or similar
•⁠  ⁠Preserve relevant metadata (path, timestamp, anomaly details, etc.)
•⁠  ⁠Correlate alerts based on common attributes such as:
 - Same host/server
 - Same directory or filesystem path
 - Same protected object
 - Same time window
 - Similar anomaly behavior patterns