An illustrative method includes a data protection system determining a metric associated with operations performed with respect to a storage system during a measurement interval, determining that the metric deviates by more than a threshold amount from a historical baseline metric associated with the storage system, and directing, based on the determining that the metric deviates by more than the threshold amount from the historical baseline metric, the storage system to generate a recovery dataset for data maintained by the storage system.