Finding sensitive data across sprawling environments is much easier said than done. File shares, NAS devices, cloud storage, and collaboration platforms can hold millions (or even billions) of files, making data discovery a challenge for even the most mature security teams. But high-speed scanning flips the script. Built to inspect massive data repositories quickly, organizations can maintain continuous visibility into their sensitive data without turning every scan into a days-long project.
But speed is only as valuable as it is resilient. One data node failure could take down your entire discovery program. Not anymore.
High Speed Discovery (HSD) is built to be fast. A single cluster can inspect data at terabytes per hour, distributing work across dozens of worker nodes coordinated by a single data node. That architecture is powerful. It’s also structurally exposed.
This is because the data node holds everything: the work queue, the configuration synced from Enforce, and the Incremental Index that tells the cluster what it has already seen. If that server fails and cannot recover, the cluster goes dark. Worker nodes are orphaned. The only path back used to be reinstalling each worker node, one by one, pointing it at a new data node, a time-consuming process. Every hour of that recovery is an hour your discovery program is rendered blind.
Starting with Symantec DLP 25.1 and extended in Symantec DLP 26.1, Symantec introduced native Disaster Recovery support through the Network Discover Cluster Admin Tool—a command-line utility that gives administrators direct, scriptable control over cluster recovery and other cluster management tasks. The headline result: Recovery from a total data node loss now means installing one new data node and running a handful of commands—not reinstalling every worker node in the cluster.
High Speed Discovery's Incremental mode builds an index of every file scanned—what was found and when. This is what makes subsequent scans focus only on changed content instead of re-inspecting the entire repository.
Before HDR support, that index lived solely on the data node. A hardware failure erased it, forcing every subsequent scan to restart from scratch. The incremental-index-backup command (Symantec DLP 25.1) captures the index as a timestamped zip file; incremental-index-restore brings it back to a new data node so the next scan resumes as incremental. Not a cold restart.
Automatic Remediation Tracking (ART) accumulates its intelligence over successive scan cycles, comparing current findings against prior incidents to determine whether a violation is still active, a file was modified, or a policy change resolved the issue.
Losing that history to a data node failure doesn't just inconvenience your team. It actively breaks ART. Previously resolved incidents can re-open; files already evaluated appear fresh to the engine. The art-backup command (Symantec DLP 26.1) protects this history, and art-restore brings it back coherent and continuous to the new data node.
The backup-all and restore-all commands Symantec DLP 26.1 give administrators a single operation that covers both: one zip file, one restore command, and a complete cluster state is recovered. No sequencing, no risk of restoring one without the other.
The full recovery sequence is documented in the Symantec DLP Help Center. But in practice, it can be summarized to three phases:
Disaster recovery shouldn’t create new problems while it’s solving existing ones. That’s why the Cluster Admin Tool is deliberately designed for safe production use. This tool:
☑️ Respects active scans. Backup and restore skip targets that are actively scanning, rather than interfering. Results are reported per-target in the backup manifest.
☑️ Protects in-progress operations. If a backup or restore is running for a target and a scan is triggered for that same target, the scan simply queues and waits. A Walk activity log entry explains exactly what’s happening.
☑️ Survives its own crashes. If the tool or the Detector process restarts mid-operation, the operation continues to completion on the data node. The tool reports the results the next time it’s launched.
☑️ Gives you visibility. The get-pending-command command reports the status of any in-progress operation — no black boxes during recovery.
We know how much time goes into building and maintaining a resilient discovery program. That’s why disaster recovery isn’t just about getting a cluster back online. It’s about protecting the work your team has already accomplished.
If you’re using Incremental Scan, disaster recovery support protects every investment your program has made in scan efficiency. Instead of starting from scratch after a data node failure, you can pick up right where your last backup left off. The same is true for ART. Support is not optional, but a prerequisite for reliable ART operation. Without it, a single outage resets the incident history that ART's classifications depend on.
These benefits also extend beyond day-to-day operations. Compliance teams won’t have to worry that a data node failure will derail scheduled scan cycles, with recovery measured in command executions rather than business days.
For operations teams, planned maintenance windows no longer need to be scheduled around active scan cycles. They can take the data node offline, restore when back, and resume scanning—all without touching a single scan target configuration.
Disaster Recovery support is available now in Symantec DLP 25.1 with Incremental Index backup and restore, and expanded in Symantec DLP 26.1 to include ART backup and restore with backup-all and restore-all commands. Best of all, the Cluster Admin Tool ships as a standalone package, making it easier than ever to add these capabilities without modifying your existing installation.
For a complete breakdown of command syntax, parameters, prerequisites, and a step-by-step configuration, see the Network Discover Cluster Admin Tool documentation.
Not yet running High Speed Discovery? Reach out to your in-region expert for a 1:1 demo.
Bishnu Chaturvedi
Sr. Principal Software Engineer, Information Security
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。