Threat Shield
A backup process exiting successfully does not guarantee the underlying data is intact. If a migration accidentally drops tables or records are truncated, standard backup routines will capture the empty state without alerting operators.
Threat Shield catches this when the backup is reported. It compares each snapshot's counts with the one before it, marks a snapshot with a sudden drop as anomalous rather than healthy, and tells you which snapshot before it is the known-good one to restore from.
What it compares
Threat Shield never opens a snapshot. It works on the counts the host reports with each backup, which say nothing about the contents:
- Tables and rows per table (Postgres, MySQL and MariaDB)
- Collections and documents (MongoDB)
- Installed extensions (Postgres)
- Files (file trees)
- Messages (mailboxes)
What triggers an anomaly
| Anomaly | Severity | Condition |
|---|---|---|
| row_volume_drop | Critical | A database's total rows drop by more than 20%, a file tree's files by 25% or more, or a mailbox's messages by 30% or more, against the snapshot before. |
| table_drop | Critical | A table or collection in the snapshot before is missing. |
| empty_snapshot | Critical | The snapshot has no tables, files or messages where the one before had some. |
| extension_mismatch | Warning | A Postgres extension in the snapshot before is missing, which can stop the schema from restoring. |
| stale_table | Warning | A table's row count changed and its newest updated_at, modified_at or created_at did not. Rows that arrive or go without a new timestamp are what a backup of a replica that stopped replicating, or of rows loaded from an old export, looks like. Check the surface's connection string points at the live database. The snapshot before is not kept longer for this one: a purge of old rows with nothing new written looks the same. |
Newest row and sample hash
Each PostgreSQL backup records, per table, the newest value of the first of
updated_at, modified_at and created_at the table has as a
timestamp, read under the backup's own snapshot, and a SHA-256 of its first 100 rows by
primary key. The console shows them in a snapshot's table list. A table with none of the three
columns has no newest row, and one without a primary key has no hash. On a table over 256 MB
the newest row is read only when an index leads with the column, so the backup does not read
the table twice. The hash is recorded and not alerted on, because any update to those rows
changes it.
Why the good snapshot is still there
A common threat scenario involves silent corruption or malicious truncation where damaged data is backed up until earlier healthy snapshots age out. SafeGrd protects against this via immutable WORM retention and proactive alerting. Because snapshots cannot be deleted or shortened during their retention period, earlier healthy snapshots remain intact. Automated pruning retains the last known-good snapshot whenever an anomaly is flagged, giving your team time to investigate and restore (Storage and retention). Threat Shield identifies anomalies immediately and identifies the exact snapshot to restore from.
Nothing is frozen or extended: a lock is set once, when the snapshot is written. If you want a known-good
snapshot kept longer, restore it and back it up again, or copy it out with safegrd export.
Alerts
An anomaly is sent as the anomaly event (Alerts):
- To your organization's webhook: Slack, Discord or generic JSON, with the surface, what dropped, and the known-good snapshot.
- By email to the organization's owners and admins, on paid plans, once an owner or admin turns email alerts on under Settings → Alerts.
- In the console, where the surface and the snapshot are marked anomalous.
Planned changes
Expected structural changes (such as intentionally pruning an audit log or dropping an obsolete table) may also trigger volume alerts. Review flagged alerts against recent schema updates or maintenance. Subsequent backups are evaluated against the new baseline, clearing anomaly notifications once the updated schema stabilizes.