NAS Incident Triage

Inspiration

In small offices the whole company archive often lives on one NAS, and nobody can afford a SIEM or a file-audit suite. Two questions come up again and again: "these files won't open and have a strange extension, is it ransomware?" and "a colleague left yesterday with his PC still logged in, did anyone copy the archive?". Today the only answer is hours of manual digging. With an AI NAS, it should be one sentence to Uliya.

What it does

NAS Incident Triage is an on-demand Skill that answers those questions for a chosen time window and returns an evidence-backed verdict (High, Medium, Low or No evidence):

1. Change-rate scan - counts files modified per shared folder and compares them with a baseline window of the same length, flagging spikes and new mass extensions.
2. Content-signature check - reads only the first bytes of a sample of changed files and checks them against a table of 10 common formats (PDF, Office, JPEG, PNG, ZIP, 7z, MP4...). A .pdf that no longer starts with %PDF is almost certainly encrypted, even when the ransomware keeps the original file name.
3. Ransom-note reading - extracts family name, contacts, amount and deadline from candidate notes, without following links.
4. Bulk-read check (experimental) - looks for hundreds of long-untouched files accessed within a short span, the footprint of someone copying the archive.
5. Camera context (optional) - places the activity peak next to surveillance events, shown as context only, never as attribution.
6. Containment with approval - tag affected files, move ransom notes and renamed files to a quarantine folder, find and restore originals from the recycle bin. Every write is confirmed by the user and by the platform approval.
7. Incident report saved on the NAS.

How we built it

It is a pure orchestration Skill built with the official UGOS Skill Creation Tool. Every NAS action is delegated to a registered expert (file-agent, document-agent, security-monitor-agent, knowledge-agent) using only capabilities from the published catalog, with self-contained instructions that receive only real upstream results. Detection thresholds, the signature table, verdict rules, the report template and a user guide live in Markdown references. The package passes the official static checker with zero errors and zero warnings.

Challenges

Skills run on demand and cannot read access logs, so the Skill cannot be a real-time monitor or say which account touched a file. We designed around that: content signatures replace extension guessing, a baseline window replaces fixed alarms, and the bulk-read check is clearly marked as experimental because access times depend on how the volume records them.

What we learned

On a NAS, the strongest ransomware signal is not the file name but the file content. And safety rules (read-only first, approval for every write, no deletion, no contact with attackers) make an AI security tool something an administrator can actually trust.

What's next

Tune thresholds on the real iDX6011 Pro environment, verify access-time behaviour on UGOS, and add more file signatures.

Built With

• claude
• markdown
• ugos
• ugreen-ai-nas
• uliya