Commvault

---
name: commvault
description: "Expert agent for Commvault Cloud and Metallic. Covers CommServe orchestration, MediaAgent data movement, Cloud Rewind full-stack recovery, Metallic BaaS, Cleanroom Recovery, HyperScale X, and ransomware resilience across VM, physical, SaaS, database, and Kubernetes workloads. WHEN: \"Commvault\", \"CommServe\", \"MediaAgent\", \"Metallic\", \"Cloud Rewind\", \"Cleanroom Recovery\", \"HyperScale X\", \"Unity Platform\", \"Commvault Cloud\"."
license: MIT
---

# Commvault Cloud

This skill covers Commvault Cloud (formerly Commvault Complete) and Metallic.io. It has deep expertise in Commvault's architecture, broad workload coverage, and advanced recovery capabilities including Cloud Rewind and Cleanroom Recovery.

## How to Approach Tasks

1. **Classify the request type:**
   - **Architecture / infrastructure** -- Load `references/architecture.md`
   - **Security / ransomware** -- Apply Cleanroom Recovery, WORM, threat scan knowledge
   - **Policy / plan management** -- Apply protection plan and CommCell configuration
   - **Recovery** -- Apply Cloud Rewind, Cleanroom, or standard restore workflows
   - **SaaS protection** -- Apply M365, Salesforce, Google Workspace guidance
   - **Kubernetes / cloud-native** -- Apply K8s and cloud-native protection guidance

2. **Identify deployment model:**
   - **Self-managed** (CommServe + MediaAgent on-premises)
   - **Metallic.io** (SaaS delivery)
   - **Commvault Cloud** (hybrid: SaaS control plane + on-premises data movement)

3. **Load context** -- Read `references/architecture.md` for component details.

## Architecture Overview

See `references/architecture.md` for full detail. Core components:

- **CommServe**: Central management server (job scheduling, policy engine, catalog/database)
- **MediaAgent**: Data movement component (reads source, deduplicates, writes to storage)
- **Commvault agents**: Installed on protected workloads (Windows, Linux, databases)
- **Cloud Library**: Object storage targets (S3, Azure Blob, GCS)
- **Metallic**: SaaS BaaS -- cloud-delivered CommServe + MediaAgent infrastructure
- **Unity Platform**: Unified management UI for self-managed + Metallic

## Workload Coverage

Commvault's primary differentiator is breadth of workload coverage:

| Category | Supported Workloads |
|---|---|
| Virtual | VMware vSphere, Hyper-V, Nutanix AHV, Red Hat Virtualization |
| Physical | Windows Server, Linux (all major distros), Unix (AIX, Solaris) |
| Cloud VMs | AWS EC2, Azure VMs, GCP Compute |
| Cloud-native | Kubernetes (EKS, AKS, GKE, OpenShift), cloud-native volumes |
| SaaS | Microsoft 365 (Exchange, SharePoint, OneDrive, Teams), Salesforce, Google Workspace |
| Databases | SQL Server, Oracle, MySQL, PostgreSQL, DB2, SAP HANA, MongoDB |
| File services | Windows File Server, NAS (NetApp, Dell EMC, Pure), SharePoint |
| Object storage | S3 cross-account/region backup, Azure Blob backup |
| Mainframe | IBM z/OS (with specialized agents) |

## Protection Plans

Commvault uses protection plans (analogous to Rubrik SLA domains or Cohesity protection policies).

### Plan Components

- **Backup frequency**: RPO target (every X hours/days)
- **Retention**: Days/weeks/months/years per tier
- **Storage target**: Which library (local disk, cloud, tape)
- **Encryption**: At-rest encryption settings
- **Deduplication**: MediaAgent-level dedup
- **Schedule**: Time window, bandwidth throttling

### Applying Plans

Plans can be applied to:
- Individual workloads (specific VM, database instance)
- vSphere container (datacenter, cluster, folder -- new VMs auto-protected)
- Tag-based (apply to VMs with specific VMware tag)
- Kubernetes namespace or application

**Auto-discovery:**
- Commvault auto-discovers VMs, databases, and cloud assets
- Unprotected assets visible in Unity Platform dashboard
- Alert on unprotected critical assets

## Immutable Backups

### WORM Storage Integration

Commvault supports WORM immutability through:

1. **S3 Object Lock** (S3, Wasabi, MinIO, etc.):
   - Create bucket with Object Lock (Compliance mode recommended)
   - Add as Cloud Library in CommServe
   - Enable WORM retention in protection plan

2. **Azure Immutable Blob:**
   - Azure container with time-based retention policy (locked)
   - Add as Azure Blob Library in CommServe

3. **WORM tape media:**
   - LTO WORM media in tape library
   - Hardware-enforced write-once

4. **HyperScale X with WORM:**
   - On-premises scale-out storage with WORM at the storage layer

**Configuration path:**
`Storage > Libraries > [Cloud Library] > Properties > WORM Settings > Enable WORM > Set retention period`

### Air Gap via Separate Cloud Account

For logical air gap:
- Create backup copy job targeting object storage in a separate AWS account or Azure subscription
- Credentials for the isolated account stored in CommServe; not accessible from production
- S3 Object Lock on the isolated account bucket (compliance mode)

## Cleanroom Recovery

Cleanroom Recovery automates recovery to an isolated environment for testing and ransomware forensics.

### How Cleanroom Recovery Works

1. Commvault provisions an isolated cloud environment (AWS or Azure) for recovery
2. Selected workloads are recovered to the isolated environment
3. No network connectivity between cleanroom and production
4. Security scanning can run in the cleanroom before reconnecting to production

**Key use cases:**
- **Ransomware recovery testing**: Verify recovery procedure without impacting production
- **Post-ransomware forensics**: Examine recovered systems in isolation for malware indicators
- **Compliance testing**: Prove recovery capability to auditors
- **Pre-production recovery**: Recover and validate before bringing back online

### Cleanroom Configuration

`Recovery > Cleanroom Recovery > Create Cleanroom`

Settings:
- Cloud provider (AWS or Azure)
- Target region
- VPC/VNet configuration (Commvault provisions isolated environment)
- Recovery plan: Which VMs, databases, in what order
- Recovery options: Patching scripts, AD configuration

### Cleanroom Recovery Plan

Define step-by-step recovery:
1. Recover domain controllers
2. Wait for DC services to start (health check)
3. Recover application servers (in dependency order)
4. Run post-recovery scripts (patch, configure, validate)
5. Run application-level tests
6. Generate report

**Automation:** Commvault executes the plan, logs each step, and produces a recovery report for audit.

## Cloud Rewind

Cloud Rewind is Commvault's capability for recovering full cloud stack -- not just VMs, but also the surrounding infrastructure (networking, IAM, DNS, load balancers).

### What Cloud Rewind Recovers

For AWS environments:
- EC2 instances (with original instance configuration)
- VPC configuration (subnets, route tables, security groups, NACLs)
- IAM roles and policies (used by applications)
- Route 53 DNS records
- Elastic Load Balancers
- RDS database instances
- S3 bucket configurations

For Azure:
- Azure VMs
- Virtual Network configuration (VNets, NSGs, route tables)
- Azure DNS records
- Application Gateway / Load Balancer
- Azure SQL configuration
- Azure AD application registrations (service principals)

### Why Cloud Rewind Matters for Ransomware

Traditional backup recovers data. Cloud Rewind recovers the entire application deployment:

- Ransomware may modify IAM roles or security group rules to maintain persistence
- Standard VM restore to compromised VPC puts recovered VMs in a still-compromised network
- Cloud Rewind rebuilds the VPC from a known-good configuration snapshot
- Recovered environment is clean from infrastructure level up

### Cloud Rewind Configuration

`Recovery > Cloud Rewind > Configure`
1. Connect Commvault to AWS/Azure account (read permissions for discovery)
2. Set discovery schedule (Commvault inventories cloud config at defined intervals)
3. Define retention for infrastructure configuration snapshots
4. Create recovery plan (which accounts, which regions, recovery order)

**Infrastructure configuration snapshot:**
- Commvault periodically captures the configuration state of cloud resources
- Stored in CommServe database + cloud storage
- Not the same as data backup; this is configuration/state capture

## Metallic (BaaS)

Metallic.io is Commvault's Backup as a Service offering.

### Architecture

- CommServe: Hosted by Commvault (SaaS)
- MediaAgent: Either Commvault-hosted (cloud) or customer-deployed on-premises/in-cloud
- Data: Stored in Commvault-managed cloud storage or customer's own storage account

**Deployment models:**
- **Fully cloud**: CommServe (SaaS) + Metallic-hosted MediaAgent + Metallic cloud storage. Simplest; no infrastructure.
- **Hybrid**: CommServe (SaaS) + Customer-deployed MediaAgent on-premises. Data stays on-premises or goes to customer's cloud storage.
- **BYOS (Bring Your Own Storage)**: CommServe (SaaS) + Customer MA + Customer S3/Azure as storage target.

### Metallic Workload Coverage

- Microsoft 365 (Exchange Online, SharePoint Online, OneDrive, Teams)
- Salesforce
- Google Workspace
- Dynamics 365
- Azure VMs
- AWS EC2
- VMware (via on-premises MediaAgent)
- SQL Server (cloud and on-premises)
- Kubernetes

### SaaS Protection Detail (M365)

**Microsoft 365 protection:**
- Exchange Online: Mailbox-level backup (including archive mailboxes, shared mailboxes)
- SharePoint: Site collection, document libraries, list items
- OneDrive: User drives, file versioning
- Teams: Chat messages, channel conversations, files, recordings

**Retention considerations:**
- M365 native retention (Purview/Compliance center) is NOT backup -- it's litigation hold and compliance
- Metallic provides genuine backup with point-in-time restore (not just retention holds)
- Recover individual emails, specific files, or entire mailboxes

## Unity Platform

Unity Platform is the unified management UI for Commvault Cloud.

**Features:**
- Single pane: Self-managed CommServe + Metallic tenants in one UI
- Protection coverage: Which workloads are protected vs. unprotected
- Threat assessment: Ransomware risk score per environment
- Recovery testing: Schedule and report on cleanroom tests
- Compliance: Regulation-specific compliance views (GDPR, HIPAA, PCI, etc.)

**Threat Assessment Dashboard:**
- Commvault analyzes backup job history and infrastructure configuration
- Flags: Backups without immutability, old restore point (exceeds RPO), unprotected critical VMs, disabled jobs
- Risk score: Aggregate risk based on above factors
- Recommendations: Specific remediations prioritized by impact

## HyperScale X

HyperScale X is Commvault's converged scale-out appliance (compute + storage + CommServe/MediaAgent).

**Use case:** Organizations wanting an on-premises turnkey backup appliance rather than deploying CommServe + MediaAgent + storage separately.

**Architecture:**
- Nodes: 2-4 nodes minimum; scale by adding nodes
- Storage: Shared-nothing architecture across nodes
- CommServe: Runs on HyperScale X cluster
- Built-in deduplication at scale-out storage layer

**Differentiation from other appliances:**
- Software is full Commvault (not a stripped-down version)
- Can manage external CommServe deployments from HyperScale X
- Scale-out: Add nodes to increase capacity and performance

## Key Operational Guidance

### Ransomware Detection

Commvault does not have built-in ML-based anomaly detection like Rubrik or Cohesity. Options:

1. **SIEM integration**: Forward CommServe and MediaAgent logs to SIEM; detect backup job failures, disabled jobs, unusual deletion activity
2. **Metallic Threat Assessment**: Provides risk scoring and configuration-based recommendations
3. **Integration with EDR**: Commvault can trigger backup jobs from external security events (via API)
4. **Proactive scanning**: Integrate with AV/malware scanning for specific restore operations (similar to Veeam Secure Restore but requires third-party integration)

### Backup Job Failure Alerting

Critical for ransomware detection (attackers disable/break backups):

`Alert > Alert Rules > Add Rule`
- Alert: Backup job failed or missed schedule
- Notify: Email, SNMP trap, Webhook (SIEM, PagerDuty)
- Escalation: Alert if no backup in > [RPO threshold] hours

### Deduplication Database Backup

Commvault stores deduplication database (DDB) on the MediaAgent. The DDB is required for restoring deduplicated data.

**Critical:** Back up the DDB as part of DR plan:
`Storage > Libraries > [Library] > MediaAgent > DDB Backup`

If the DDB is lost and cannot be recovered, all deduplicated backup data on that library is unrestorable.

## Reference Files

- `references/architecture.md` -- CommServe internals, MediaAgent data movement, Commvault agent types, Cloud Library configuration, metallic.io SaaS architecture, Unity Platform, HyperScale X, Cloud Rewind cloud infrastructure capture, Cleanroom Recovery provisioning, deduplication architecture, and retention policies.