Intrusion Detection Through Storage Monitoring

In a computer system having one or more host computers in direct communication with a data storage array, an attribute retrieval engine in direct communication with the data storage array monitors disk structures of the data storage array and produces a change event indication if a disk structure changes. An analysis engine in communication with the attribute retrieval engine and a rule set database produces an intrusion indication in response to a change event indication if information received from the attribute retrieval engine describing changes in disk structure match a rule in the rule set database.