RubrikPolaris

The Rubrik Security Cloud integration will fetch the Rubrik Anomaly Event and is rich with commands to perform the on-demand scans, backups, recoveries and many more features to manage and protect the organizational data.

Data Enrichment & Threat Intelligence · Rubrik Security Cloud

Details

IDRubrikPolaris
ProviderRubrik
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/rubrik-polaris-sdk-py3:1.0.0.10133006
Supported ModulesAgentix XSIAM

README

The Rubrik Security Cloud integration will fetch the Rubrik Anomaly Event and is rich with commands to perform the on-demand scans, backups, recoveries and many more features to manage and protect the organizational data.
This integration was integrated and tested with version 1.0.0 of Rubrik Security Cloud

Configure Rubrik Security Cloud in Cortex

Parameter Description Required
Service Account JSON   False
Rubrik Account (e.g. ${rubrikAccount}.my.rubrik.com)   False
Email   False
Password   False
Fetch incidents   False
Incident type   False
RSC Fetch Types Select RSC types to fetch as incidents.

Note: Supports the listed options only. If not provided, it will fetch all listed options.		 False
Event types to fetch as incidents Event types to fetch as incidents.
Note: Supports the listed options only. If not provided, it will fetch events for all listed options. Applies only when RSC fetch type is set to “Event”.		 False
Event severities to fetch as incidents Event severities to fetch as incidents.
Note: Supports the listed options only. If not provided, it will fetch events for critical severity level. Applies only when RSC fetch type is set to “Event”.		 False
Threat Monitoring Match Types Select Threat Monitoring Match Types to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “Threat Monitoring object”.		 False
Threat Monitoring Object Types Select Threat Monitoring Object Types to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “Threat Monitoring object”.		 False
First fetch time The time interval for the first fetch (retroactive). Examples of supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates. False
Fetch Limit (Maximum of 1000) Maximum number of incidents to fetch every time. The maximum value is 1000.

Note: If multiple fetch types (Events, Threat Monitoring objects, DSPM Violations, IR Violations, Sensitive Data Objects) are selected, the limit is distributed optimally among them to fetch all types.		 False
Event Critical Severity Level Mapping When an event of Critical severity is detected and fetched, this setting indicates what severity will get assigned within XSOAR. False
Event Warning Severity Level Mapping When an event of Warning severity is detected and fetched, this setting indicates what severity will get assigned within XSOAR. False
Threat Monitoring Object Severity Level Mapping When a threat monitoring object is fetched, this setting indicates what severity will get assigned within XSOAR. False
DSPM Violation Statuses Select DSPM violation statuses to fetch as incidents. Default is OPEN and IN_PROGRESS.

Note: Applies only when RSC fetch type is set to “DSPM Violation”.		 False
DSPM Violation Sensitivity Levels Select DSPM violation sensitivity levels to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “DSPM Violation”.		 False
DSPM Violation Severity Levels Select DSPM violation severity levels to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “DSPM Violation”.		 False
DSPM Violation Categories Select DSPM violation categories to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “DSPM Violation”.		 False
DSPM Violation Object Types Select DSPM violation object types to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “DSPM Violation”. Values not included in the options can be found in the documentation.		 False
IR Violation Policy Types Select IR violation policy types to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “IR Violation”.		 False
IR Violation Statuses Select IR violation statuses to fetch as incidents. Default is OPEN and IN_PROGRESS.

Note: Applies only when RSC fetch type is set to “IR Violation”.		 False
IR Violation Severity Levels Select IR violation severity levels to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “IR Violation”.		 False
IR Violation Categories Select IR violation categories to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “IR Violation”.		 False
IR Violation Identity Providers Select IR violation identity providers to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “IR Violation”.		 False
IR Violation Identity Tags Select IR violation identity tags to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “IR Violation”.		 False
Sensitive Data Object Sensitivity Levels Select Sensitive Data Object sensitivity levels to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “Sensitive Data Object”.		 False
Sensitive Data Object Types Select Sensitive Data Object types to fetch as incidents. Default is all.

Note: Applies only when RSC fetch type is set to “Sensitive Data Object”. Values not included in the options can be found in the documentation.		 False
Source Reliability Reliability of the source providing the intelligence data. False
Use system proxy settings Whether to use XSOAR’s system proxy settings to connect to the API. False
Trust any certificate (not secure) Whether to allow connections without verifying SSL certificates validity. False

Known Limitations

  • The fetch-incidents only ingests the events with “Critical” severity.
  • During the fetch cycle of threat monitoring objects, changing the filter parameters (Threat Monitoring Match Types or Threat Monitoring Object Types) may result in delayed ingestion of threat monitoring objects.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

rubrik-radar-analysis-status

Check the Radar Event for updates.

Base Command

rubrik-radar-analysis-status

Input

Argument Name Description Required
activitySeriesId The ID of the Polaris Event Series. When used in combination with "Rubrik Radar Anomaly" incidents, this value will automatically be looked up using the incident context. Otherwise it is a required value.

Note: Users can retrieve the list of the activity series IDs by executing the "rubrik-event-list" command.		 Required
clusterId The ID of the CDM cluster. When used in combination with "Rubrik Radar Anomaly" incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value.

Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.		 Required

Context Output

Path Type Description
Rubrik.Radar.EventComplete Boolean Flag that indicates whether Radar has finished analysing the object.
Rubrik.Radar.Message Unknown The text, ID, and timestamp of each message in the Activity Series.
Rubrik.Radar.ActivitySeriesId String The ID of the Rubrik Polaris Activity Series.
Rubrik.Radar.ClusterId String The ID of the cluster.

Command Example

!rubrik-radar-analysis-status activitySeriesId="" clusterId="cc19573c-db6c-418a-9d48-067a256543ba"

Human Readable Output

Radar Analysis Status

Activity Series ID Cluster ID Message Event Complete
ec9c48ce-5faf-474a-927c-33667355aecd cc19573c-db6c-418a-9d48-067a256543ba Completed backup of the transaction log for SQL Server database ‘AdventureWorks2012’ from ‘sx1-sql12-1\MSSQLSERVER’. True

rubrik-sonar-sensitive-hits

Find data classification hits on an object.

Base Command

rubrik-sonar-sensitive-hits

Input

Argument Name Description Required
objectName The name of the Rubrik object to check for sensitive hits. When used in combination with “Rubrik Radar Anomaly” incidents, this value will automatically be looked up using the incident context. Otherwise it is a required value.

Note: Users can get the list of the object names by executing the “rubrik-polaris-object-list” or “rubrik-polaris-object-search” command.		 Optional
searchTimePeriod The number of days in the past to look for sensitive hits. If no value is provided, then today’s data will be returned and, if there is no data for today then the argument will default to 7 days.
Default is 7.		 Optional

Context Output

Path Type Description
Rubrik.Sonar.totalHits String The total number of data classification hits found on the provided object.
Rubrik.Sonar.id String ID of the sensitive hits object.
Rubrik.Sonar.policy_hits Unknown Information of the policy analyzer group of the sensitive hits object.
Rubrik.Sonar.filesWithHits Number The total number of files with hits of the object.
Rubrik.Sonar.openAccessFiles Number The total number of open access files of the object.
Rubrik.Sonar.openAccessFilesWithHits Number The total number of open access files with hits of the object.
Rubrik.Sonar.openAccessFolders Number The total number of open access folders of the object.
Rubrik.Sonar.staleFiles Number The total number of stale files of the object.
Rubrik.Sonar.staleFilesWithHits Number The total number of stale files with hits of the object.
Rubrik.Sonar.openAccessStaleFiles Number The total number of open access stale files of the object.
Rubrik.Radar.Message Unknown The text, ID, and timestamp of each message in the Activity Series.
Rubrik.Radar.ActivitySeriesId String The ID of the Rubrik Polaris Activity Series.

Command Example

!rubrik-sonar-sensitive-hits objectName="sx1-radar15"

Human Readable Output

Sensitive Hits

ID Total Hits
afc0f6f0-148a-54c5-9927-c24c7cde1608 49684

rubrik-cdm-cluster-location

Find the CDM GeoLocation of a CDM Cluster.

Base Command

rubrik-cdm-cluster-location

Input

Argument Name Description Required
clusterId The ID of the CDM cluster. When used in combination with “Rubrik Radar Anomaly” incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value.

Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.		 Required

Context Output

Path Type Description
Rubrik.CDM.Cluster.Location String The GeoLocation of the Rubrik CDM Cluster.
Rubrik.CDM.ClusterId String The ID of the cluster.

Command Example

!rubrik-cdm-cluster-location clusterId="cc19573c-db6c-418a-9d48-067a256543ba"

Human Readable Output

CDM Cluster Location

Location
San Francisco, CA, USA

rubrik-cdm-cluster-connection-state

Find the CDM Connection State of a CDM Cluster.

Base Command

rubrik-cdm-cluster-connection-state

Input

Argument Name Description Required
clusterId The ID of the CDM cluster. When used in combination with “Rubrik Radar Anomaly” incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value.

Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.		 Required

Context Output

Path Type Description
Rubrik.CDM.Cluster.ConnectionState String The Connection State of the Rubrik CDM Cluster.
Rubrik.CDM.ClusterId String The ID of the cluster.

Command Example

!rubrik-cdm-cluster-connection-state clusterId="cc19573c-db6c-418a-9d48-067a256543ba"

Human Readable Output

CDM Cluster Connection State

Connection State
Connected

rubrik-polaris-object-search

Search for Rubrik discovered objects of any type, return zero or more matches.

Base Command

rubrik-polaris-object-search

Input

Argument Name Description Required
limit Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. Optional
object_name The name of the object to search for. Required
sort_by Specify the field to use for sorting the response.

Note: Supported values are “ID” and “NAME” only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID.		 Optional
sort_order Specify the order to sort the data in.

Possible values are: “ASC”, “DESC”. Default is ASC.		 Optional
next_page_token The next page cursor to retrieve the next set of results. Optional

Context Output

Path Type Description
RubrikPolaris.GlobalSearchObject.id String The ID of the object.
RubrikPolaris.GlobalSearchObject.name String The name of the object.
RubrikPolaris.GlobalSearchObject.objectType String The type of the object.
RubrikPolaris.GlobalSearchObject.physicalPath.fid String The FID of the physical path of the object.
RubrikPolaris.GlobalSearchObject.physicalPath.name String The name of the physical path where the object relies.
RubrikPolaris.GlobalSearchObject.physicalPath.objectType String The object type of the physical path where the object relies.
RubrikPolaris.GlobalSearchObject.azureRegion String The azure region of the object.
RubrikPolaris.GlobalSearchObject.awsRegion String The aws region of the object.
RubrikPolaris.GlobalSearchObject.emailAddress String The email address of the object.
RubrikPolaris.GlobalSearchObject.isRelic Boolean Whether the object is relic (historical) or not.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.id String The effective SLA domain ID of the object.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.name String The effective SLA domain name of the object.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.description String The effective SLA domain description of the object.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.fid String The FID of the object’s effective SLA domain.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.cluster.id String The cluster ID of the object’s effective SLA domain.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.cluster.name String The cluster name of the object’s effective SLA domain.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.count String The count of physical child connection of the object.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.id String The ID of physical child connection of the object.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.name String The name of the physical child connection of the object.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.replicatedObjects.cluster.id String The cluster ID of the replicated objects of physical child connection of the object.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.replicatedObjects.cluster.name String The cluster name of the replicated objects of physical child connection of the object.
RubrikPolaris.GlobalSearchObject.cluster.id String The cluster ID related to the object.
RubrikPolaris.GlobalSearchObject.cluster.name String The name of the cluster related to the object.
RubrikPolaris.GlobalSearchObject.primaryClusterLocation.id String The primary cluster location ID of the object.
RubrikPolaris.GlobalSearchObject.gcpZone String The gcp zone of the object.
RubrikPolaris.GlobalSearchObject.gcpRegion String The gcp region of the object.
RubrikPolaris.GlobalSearchObject.gcpNativeProject.name String The gcp native project name of the object.
RubrikPolaris.PageToken.GlobalSearchObject.next_page_token String Next page token.
RubrikPolaris.PageToken.GlobalSearchObject.name String Name of the command.
RubrikPolaris.PageToken.GlobalSearchObject.has_next_page Boolean Whether the result has the next page or not.

Command Example

!rubrik-polaris-object-search object_name="admin" limit=2

Human Readable Output

Global Objects

Object ID Object Name Type SLA Domain
0f667954-9052-42c8-ac20-2149da4d0ec4 Hoang-Admin Nguyen O365Mailbox UNPROTECTED
3e5d0800-71f6-4e42-badc-ae8b98c8a808 Admin o365 O365Mailbox UNPROTECTED

Note: To retrieve the next set of results use, “next_page_token” = xyz

rubrik-sonar-policies-list

Retrieve the list of all the available Sonar policies.

Base Command

rubrik-sonar-policies-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
RubrikPolaris.SonarPolicy.id String Unique ID of the policy.
RubrikPolaris.SonarPolicy.name String Name of the policy.
RubrikPolaris.SonarPolicy.description String Descriptive name of the policy.
RubrikPolaris.SonarPolicy.creator.email String Email of the user who created the policy.
RubrikPolaris.SonarPolicy.totalObjects Number Number of total objects present in the policy.
RubrikPolaris.SonarPolicy.numAnalyzers Number Number of analyzers present in the policy.
RubrikPolaris.SonarPolicy.objectStatuses.id String ID of the object present in the policy.
RubrikPolaris.SonarPolicy.objectStatuses.latestSnapshotResult.snapshotFid String Snapshot ID of the object present in the policy.
RubrikPolaris.SonarPolicy.objectStatuses.policyStatuses.policyId String Policy ID.
RubrikPolaris.SonarPolicy.objectStatuses.policyStatuses.status String Policy status.

Command Example


#### Human Readable Output

### Sonar Policies

|ID|Name|Description|Analyzers|Objects|Creator Email|
|---|---|---|---|---|---|
| bdb8c043-ee89-43ef-a3e2-73e94b5b3900 | CCPA | California Consumer Privacy Act | 5 | 3 | dummy.email@rubrik.com |
| 53e447ed-9114-4fcd-b5a6-7ac759980fde | GLBA | U.S. Gramm-Leach-Bliley Act | 4 | 3 |  |

### rubrik-sonar-policy-analyzer-groups-list

***
List the analyzer group policies.

#### Base Command

`rubrik-sonar-policy-analyzer-groups-list`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarAnalyzerGroup.id | String | The analyzer group ID. |
| RubrikPolaris.SonarAnalyzerGroup.name | String | The name of the analyzer group. |
| RubrikPolaris.SonarAnalyzerGroup.groupType | String | The analyzer group type. |
| RubrikPolaris.SonarAnalyzerGroup.analyzers.id | String | The ID of the analyzers belong to the group. |
| RubrikPolaris.SonarAnalyzerGroup.analyzers.name | String | The name of the analyzers belong to the group. |
| RubrikPolaris.SonarAnalyzerGroup.analyzers.analyzerType | String | The type of the analyzers belong to the group. |

#### Command Example

```!rubrik-sonar-policy-analyzer-groups-list```

#### Human Readable Output

### Sonar Policy Analyzer Groups

|ID|Name|Group Type|Analyzers|
|---|---|---|---|
| 97c6a54a-acfc-5ab2-a24a-6a7f3a9a1553 | GLBA | GLBA | id: ed30dfa0-334f-55ff-a1b7-03b6bdd7849b, Name: Credit Card, Analyzer Type: CREDIT_CARD<br/><br/>id: 3e60a612-3e97-5f03-b3a1-cfb7a6a67e8f, Name: Test Bank Acct, Analyzer Type: US_BANK_ACCT<br/><br/>id: 03b3dc9e-81c1-561c-8235-17cf2fc1c729, Name: US ITIN, Analyzer Type: US_ITIN<br/><br/>id: d5ce3ae5-f530-562a-85b1-4a84264a350a, Name: US SSN, Analyzer Type: US_SSN |
| 543dd5e0-c72c-50e2-a3d9-1688343f472c | HIPAA | HIPAA | id: 9da675b3-944b-5da3-a2da-ed149d300075, Name: US/UK Passport, Analyzer Type: PASSPORT<br/><br/>id: 18665533-c28c-5a40-b747-4b6508fecdfa, Name: US NPI, Analyzer Type: US_HEALTHCARE_NPI<br/><br/>id: 03b3dc9e-81c1-561c-8235-17cf2fc1c729, Name: US ITIN, Analyzer Type: US_ITIN<br/><br/>id: d5ce3ae5-f530-562a-85b1-4a84264a350a, Name: US SSN, Analyzer Type: US_SSN<br/><br/>id: 6bcc8e4e-0ec9-5538-b91d-a506dac47ec6, Name: US DEA, Analyzer Type: DEA_NUMBER |
| 16bd3864-bad6-513b-b38d-a108e648cf4a |  | PCI_DSS |  |
| c8c8072a-9454-5e68-9a23-bbcb9824838e | U.S. Financials | US_FINANCE | id: bb9a929b-3f29-5d3f-a768-de74e8ee5a9c, Name: n/a, Analyzer Type: CUSIP_NUMBER |

### rubrik-polaris-vm-object-metadata-get

***
Retrieve details for a Vsphere object based on the provided object ID.

#### Base Command

`rubrik-polaris-vm-object-metadata-get`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| object_id | The ID of the object to get details.<br/><br/>Note: Users can get the list of the object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.VSphereVm.id | String | Unique ID of the object. |
| RubrikPolaris.VSphereVm.metadata.authorizedOperations | Unknown | List of operations performed by the object. |
| RubrikPolaris.VSphereVm.metadata.name | String | The name of the object. |
| RubrikPolaris.VSphereVm.metadata.isRelic | Boolean | Whether the object is relic or not. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.id | String | ID of the SLA domain. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.name | String | Name of the SLA domain. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.cluster.id | String | ID of the cluster of the SLA domain. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.cluster.name | String | Name of the cluster of the SLA domain. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.fid | String | SLA Source object FID. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.name | String | SLA source object name. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.objectType | String | SLA source object type. |
| RubrikPolaris.VSphereVm.metadata.protectionDate | String | Protection date of the object. |
| RubrikPolaris.VSphereVm.metadata.reportSnappable.id | String | The ID of the snappable for a particular report related to an object. Snappable supports backups or filesets of physical machines using the rubrik connector. |
| RubrikPolaris.VSphereVm.metadata.reportSnappable.logicalBytes | Number | Logical bytes of snappable report. |
| RubrikPolaris.VSphereVm.metadata.reportSnappable.physicalBytes | Number | The physical byte of the snappable for a particular report related to an object. |
| RubrikPolaris.VSphereVm.metadata.reportSnappable.archiveStorage | Number | The archived storage of the snappable for a particular report related to an object. |
| RubrikPolaris.VSphereVm.metadata.cluster.id | String | Unique ID of the cluster which is the datastore for the recovered virtual machine. |
| RubrikPolaris.VSphereVm.metadata.cluster.name | String | Cluster name of the VM to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.cluster.status | String | Cluster status of the VM to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.cluster.version | String | Cluster version of the VM to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.cluster.lastConnectionTime | String | Last time when the vm was connected to the cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.defaultAddress | String | Default address where the cluster is stored. |
| RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.id | String | Node ID of the node connection related to cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.status | String | Node status of the node connection related to cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.ipAddress | String | IP address of the node connection related to cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.state.connectedState | String | Connected state of the cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.state.clusterRemovalState | String | State of the cluster if it is registered for removal or not. |
| RubrikPolaris.VSphereVm.metadata.cluster.passesConnectivityCheck | Boolean | Whether the cluster passes connectivity check or not. |
| RubrikPolaris.VSphereVm.metadata.cluster.globalManagerConnectivityStatus.urls.url | String | URL of Global Manager Connectivity Status. |
| RubrikPolaris.VSphereVm.metadata.cluster.globalManagerConnectivityStatus.urls.isReachable | Boolean | Whether the url in global Manager Connectivity Status is reachable or not. |
| RubrikPolaris.VSphereVm.metadata.cluster.connectivityLastUpdated | String | Date time when the connectivity status of the cluster is lastly updated. |
| RubrikPolaris.VSphereVm.metadata.primaryClusterLocation.id | String | The location ID of the primary cluster to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.primaryClusterLocation.name | String | The location name of the primary cluster to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.arrayIntegrationEnabled | Boolean | Whether the array integration is enabled or not. |
| RubrikPolaris.VSphereVm.metadata.snapshotConsistencyMandate | String | Data consistency in recovery points is the snapshot consistency mandate. It is broadly classified into 3 categories: inconsistent, crash-consistent, app-consistent. |
| RubrikPolaris.VSphereVm.metadata.agentStatus.agentStatus | String | The status of an agent related to an object. In Rubrik agents are connectors also known as Rubrik Backup Service. |
| RubrikPolaris.VSphereVm.metadata.logicalPath.fid | String | The logical path ID of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.logicalPath.objectType | String | The logical object type of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.logicalPath.name | String | The logical name of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.physicalPath.fid | String | The physical path of where the VM resides. |
| RubrikPolaris.VSphereVm.metadata.physicalPath.objectType | String | The physical path object type of the VM. |
| RubrikPolaris.VSphereVm.metadata.physicalPath.name | String | The physical Name of the VM. |
| RubrikPolaris.VSphereVm.metadata.vsphereTagPath.fid | String | FID of Vsphere tag. |
| RubrikPolaris.VSphereVm.metadata.vsphereTagPath.objectType | String | Object type of Vsphere tag. |
| RubrikPolaris.VSphereVm.metadata.vphereTagPath.name | String | Name of Vsphere tag. |
| RubrikPolaris.VSphereVm.metadata.oldestSnapshot.id | String | The ID of the oldest snapshot. |
| RubrikPolaris.VSphereVm.metadata.oldestSnapshot.date | String | The date when the oldest snapshot was generated. |
| RubrikPolaris.VSphereVm.metadata.oldestSnapshot.isIndexed | Boolean | Whether the oldest snapshot is indexed or not. |
| RubrikPolaris.VSphereVm.metadata.totalSnapshots.count | Number | Total snapshot counts. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.id | String | The ID of the object which is replicated in the VM. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.primaryClusterLocation.id | String | The primary cluster location ID where the replicated object resides. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.primaryClusterLocation.name | String | The primary cluster location name where the replicated object resides. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.cluster.name | String | The cluster name where the replicated object resides. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.cluster.id | String | The cluster ID where the replicated object resides. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.id | String | ID of the newest archived snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.date | String | The date when the newest archived snapshot was generated. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.isIndexed | Boolean | Whether the newest archived snapshot is indexed or not. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.archivalLocations.id | String | ID of the archival location of the newest archived snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.archivalLocations.name | String | Name of the archival location of the newest archival snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.id | String | The ID of the newest replicated snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.date | String | The date when the newest replicated snapshot was generated. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.isIndexed | Boolean | Whether the newest replicated snapshot is indexed or not. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.replicationLocations.id | String | The ID of the replication locations of the newest replicated snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.replicationLocations.name | String | The name of the replication locations of the newest replicated snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestSnapshot.id | String | The ID of the newest snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestSnapshot.date | String | The date when the newest snapshot was generated. |
| RubrikPolaris.VSphereVm.metadata.newestSnapshot.isIndexed | Boolean | Whether the newest snapshot is indexed or not. |
| RubrikPolaris.VSphereVm.metadata.onDemandSnapshotCount | Number | Count of how many on demand snapshot created in a VM. |
| RubrikPolaris.VSphereVm.metadata.vmwareToolsInstalled | Boolean | Whether the Vmware tools are installed or not. |
| RubrikPolaris.VSphereVm.metadata.cdmLink | String | The Cloud Data Management link to navigate to the VM on cloud. |

#### Command Example

```!rubrik-polaris-vm-object-metadata-get object_id="e060116b-f9dc-56a1-82a6-1b968d2f6cef"```

#### Human Readable Output

### VM Object Data

|Object ID|Name|Snappable ID|SLA Domain|Cluster Name|Total Snapshots|Oldest Snapshot Date|Latest Snapshot Date|
|---|---|---|---|---|---|---|---|
| e060116b-f9dc-56a1-82a6-1b968d2f6cef | Kali-VM | VirtualMachine:::ae4484c6-b4c0-4ce8-b2ba-206a4184540b-vm-521 | DO_NOT_PROTECT | sand2-rbk01 | 42 | 2019-04-24T16:21:12.000Z | 2020-02-12T14:00:36.000Z |

### rubrik-polaris-vm-objects-list

***
Retrieve a list of all the objects of the Vsphere Vm known to the Rubrik.

#### Base Command

`rubrik-polaris-vm-objects-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| is_relic | Filter based on whether VM objects are moved to relic/archive or not.<br/><br/>Possible values are: "True", "False". | Optional |
| is_replicated | Filter based on whether VM objects are replicated or not.<br/><br/>Possible values are: "True", "False". | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Supported values are "ID" and "NAME" only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.VSphereVm.id | String | Unique ID of the object. |
| RubrikPolaris.VSphereVm.name | String | Name of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.objectType | String | Object type of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.replicatedObjectCount | Number | Number of objects replicated in the node in which the object relies. |
| RubrikPolaris.VSphereVm.cluster.id | String | ID of the cluster which is the datastore for the recovered virtual machine. |
| RubrikPolaris.VSphereVm.cluster.name | String | Cluster name of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.cluster.version | String | Cluster version of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.cluster.status | String | Cluster status of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.id | String | ID of the SLA domain which is simply a set of policies that define at what frequencies backups should be performed of the protected objects within Rubrik and for how long they should be either locally or a replication partner or on the archival location. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.name | String | Descriptive name of the SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.description | String | Description of the SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.fid | String | FID of the SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.cluster.id | String | ID of the cluster related to the effective SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.cluster.name | String | Name of the cluster related to the effective SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaSourceObject.fid | String | SLA source object FID. |
| RubrikPolaris.VSphereVm.effectiveSlaSourceObject.name | String | SLA source object name. |
| RubrikPolaris.VSphereVm.effectiveSlaSourceObject.objectType | String | SLA source object type. |
| RubrikPolaris.VSphereVm.slaAssignment | String | A SLA rule when referred at assignment is SLA assignment. |
| RubrikPolaris.VSphereVm.isRelic | Boolean | Whether the object is relic or not. |
| RubrikPolaris.VSphereVm.authorizedOperations | Unknown | List of operations that can be performed on the object. |
| RubrikPolaris.VSphereVm.primaryClusterLocation.id | String | The location ID of the primary cluster to which the object belongs. |
| RubrikPolaris.VSphereVm.primaryClusterLocation.name | String | The location name of the primary cluster to which the object belongs. |
| RubrikPolaris.VSphereVm.logicalPath.fid | String | The logical path ID of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.logicalPath.name | String | The logical path name of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.logicalPath.objectType | String | The logical object type of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.snapshotDistribution.id | String | Rubrik uses a snapshot for powerful data protection. Snapshot distribution ID is the ID of the snapshot distribution node related to a particular object. |
| RubrikPolaris.VSphereVm.snapshotDistribution.onDemandCount | Number | The demand count of distribution of snapshot related to an object. |
| RubrikPolaris.VSphereVm.snapshotDistribution.retrievedCount | Number | The retrieved count of distribution of snapshot related to an object. |
| RubrikPolaris.VSphereVm.snapshotDistribution.scheduledCount | Number | The scheduled count of distribution of snapshot related to an object. |
| RubrikPolaris.VSphereVm.snapshotDistribution.totalCount | Number | The total count of distribution of snapshot related to an object. |
| RubrikPolaris.VSphereVm.reportSnappable.id | String | The ID of the snappable for a particular report related to an object. Snapple supports backups or filesets of physical machines using the rubrik connector. |
| RubrikPolaris.VSphereVm.reportSnappable.archieveStorage | Number | The archived storage of the snappable for a particular report related to an object. |
| RubrikPolaris.VSphereVm.reportSnappable.physicalBytes | Number | The physical byte of the snappable for a particular report related to an object. |
| RubrikPolaris.VSphereVm.vmwareToolsInstalled | Boolean | Whether the vm tools are installed or not. |
| RubrikPolaris.VSphereVm.agentStatus.agentStatus | String | The status of an agent related to an object. The Rubrik agents are connectors also known as Rubrik Backup Service. |
| RubrikPolaris.VSphereVm.agentStatus.disconnectReason | String | Displays the reason if the agent disconnects. |
| RubrikPolaris.PageToken.VSphereVm.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.VSphereVm.name | String | Name of the command. |
| RubrikPolaris.PageToken.VSphereVm.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-polaris-vm-objects-list limit=2```

#### Human Readable Output

### Objects List

|Object ID|Name|Snappable ID|Cluster|Object Type|SLA Domain|Assignment|Snapshots|RBS Status|Source Storage|Archival Storage|
|---|---|---|---|---|---|---|---|---|---|---|
| 0242e84c-773a-5877-b955-1d52765ac852 | sx1-ganebala-l1 | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-206037 | sand1-rbk01 | VmwareVirtualMachine | DO_NOT_PROTECT | Direct | 0 | Unregistered | 0 | 0 |
| 0556f691-b750-556c-baea-800dbb2920e7 | linux-a-Fri Feb 15 2019 04:43:40 GMT+0000 (Greenwich Mean Time)-9P4t | VirtualMachine:::d2f41f4b-5d53-4063-a618-25046a0f4c7d-vm-35806 | sand1-rbk01 | VmwareVirtualMachine | UNPROTECTED | Unassigned | 34 | Unregistered | 0 | 1.115023609 GB |

 Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-sonar-ondemand-scan

***
Trigger an on-demand scan of a system. Supports "Vsphere VM" object type only.

Note: To know the scan status use the "rubrik-sonar-ondemand-scan-status" command. To download the completed request use the "rubrik-sonar-ondemand-scan-result" command.

#### Base Command

`rubrik-sonar-ondemand-scan`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| scan_name | Name of the scan. If not provided, it defaults to "&lt;today's date&gt; Classification". | Optional |
| sonar_policy_analyzer_groups | List of sonar policies to scan.<br/><br/>Note: Users can get the list of analyzer groups by executing the "rubrik-sonar-policy-analyzer-groups-list" command. <br/><br/>Format Accepted: <br/>[<br/>        {<br/>            "id": "543dd5e0-c72c-50e2-a3d9-1688343f472c",<br/>            "name": "HIPAA",<br/>            "groupType": "HIPAA",<br/>            "analyzers": [<br/>                {<br/>                    "id": "9da675b3-944b-5da3-a2da-ed149d300075",<br/>                    "name": "US/UK Passport",<br/>                    "analyzerType": "PASSPORT"<br/>                },<br/>                {<br/>                    "id": "18665533-c28c-5a40-b747-4b6508fecdfa",<br/>                    "name": "US NPI",<br/>                    "analyzerType": "US_HEALTHCARE_NPI"<br/>                }<br/>            ]<br/>      }<br/>]. | Required |
| objects_to_scan | List of VM object IDs to scan.<br/><br/>Note: Users can get the list of VM object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarOndemandScan.crawlId | String | Unique crawl ID. |

#### Command Example

```!rubrik-sonar-ondemand-scan scan_name="GLBA Scan for new user" sonar_policy_analyzer_groups='[{"id":"97c6a54a-acfc-5ab2-a24a-6a7f3a9a1553","name":"GLBA","groupType":"GLBA","analyzers":[{"id":"ed30dfa0-334f-55ff-a1b7-03b6bdd7849b","name":"CreditCard","analyzerType":"CREDIT_CARD"},{"id":"3e60a612-3e97-5f03-b3a1-cfb7a6a67e8f","name":"BANK_ACCT","analyzerType":"US_BANK_ACCT"},{"id":"03b3dc9e-81c1-561c-8235-17cf2fc1c729","name":"USITIN","analyzerType":"US_ITIN"},{"id":"d5ce3ae5-f530-562a-85b1-4a84264a350a","name":"USSSN","analyzerType":"US_SSN"}]}]' objects_to_scan="0887e71c-56ac-59f7-8763-54b726e64dd6, a82e888c-2440-5af9-8c2a-447a97f6746c"```

#### Human Readable Output

### Sonar On-Demand Scan

|Crawl ID|
|---|
| bb4eedc0-594b-4566-b06d-24de0bf752ca |

### rubrik-sonar-ondemand-scan-status

***
Retrieve the status of a scanned system.

Note: To download the completed request use the "rubrik-sonar-ondemand-scan-result" command.

#### Base Command

`rubrik-sonar-ondemand-scan-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| crawl_id | ID for which scanning status is to be obtained.<br/><br/>Note: Users can get the crawl ID by executing the "rubrik-sonar-ondemand-scan" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarOndemandScan.crawlId | String | Crawl ID of the scan for which the rubrik-sonar-ondemand-scan command is hit. |
| RubrikPolaris.SonarOndemandScan.Status.error | String | Error description if any. |
| RubrikPolaris.SonarOndemandScan.Status.snappable.id | String | Snappable ID of the scanned object. |
| RubrikPolaris.SonarOndemandScan.Status.snappable.name | String | Snappable Name of the scanned object. |
| RubrikPolaris.SonarOndemandScan.Status.snappable.objectType | String | Snappable object type of the scanned object. |
| RubrikPolaris.SonarOndemandScan.Status.snapshotTime | Number | Time when the snapshot is taken. |
| RubrikPolaris.SonarOndemandScan.Status.status | String | Status of the scanning or scanned object. |
| RubrikPolaris.SonarOndemandScan.Status.progress | Number | Count of objects that are in progress. |
| RubrikPolaris.SonarOndemandScan.Status.totalHits | Number | Number of total hits obtained from an object that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.groupType | String | Group type of the analyzer. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.id | String | Group ID of the analyzer. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.name | String | Group Name of the analyzer. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.totalHits | Number | Number of total hits obtained from an analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.violations | Number | Number of violations obtained from an analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.permittedHits | Number | Number of permitted hits obtained from an analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.analyzer.id | String | ID of the analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analzerGroupResults.analyzerResults.analyzer.name | String | Name of the analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.analyzer.analyzerType | String | Type of the analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.totalHits | Number | Number of total hits obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.violations | Number | Number of violations obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.permittedHits | Number | Number of permitted hits obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.violationsDelta | Number | Number of violation delta obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.totalHitsDelta | Number | Number of total hits delta obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.cluster.id | String | Cluster ID in which the object is getting scanned. |
| RubrikPolaris.SonarOndemandScan.Status.cluster.name | String | Cluster name in which the object is getting scanned. |
| RubrikPolaris.SonarOndemandScan.Status.cluster.type | String | Cluster type in which the object is getting scanned. |

#### Command Example

```!rubrik-sonar-ondemand-scan-status crawl_id="bb4eedc0-594b-4566-b06d-24de0bf752ca"```

#### Human Readable Output

### Sonar On-Demand Scan Status

Final status of scan with crawl ID bb4eedc0-594b-4566-b06d-24de0bf752ca is IN_PROGRESS

|Object ID|Object Name|Scan Status|
|---|---|---|
| 6e307121-e5dc-5e6a-9a6b-37e1c9afd6b1 | AllTheThings | COMPLETE |
| a82e888c-2440-5af9-8c2a-447a97f6746c | /tmp | IN_PROGRESS |

### rubrik-polaris-vm-object-snapshot-list

***
Search for a Rubrik snapshot of an object based on the provided snapshot ID, exact timestamp, or specific value like earliest/latest, or closest before/after a timestamp.

#### Base Command

`rubrik-polaris-vm-object-snapshot-list`

#### Input

| **Argument Name** | **Description**                                                                                                                                                                                              | **Required** |
| --- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| object_id | The object ID for which the snapshots are to be searched.<br/><br/>Note: Users can get the list of the object IDs by executing the "rubrik-polaris-vm-objects-list" command.                                 | Required |
| snapshot_group_by | Grouping the snapshots on the basis of the selected value.<br/><br/>Possible values are: "Month", "Day", "Year", "Week", "Hour", "Quarter". Default is Day.                                                  | Optional |
| missed_snapshot_group_by | Grouping the missed snapshots on the basis of the selected value.<br/><br/>Possible values are: "MONTH", "DAY", "YEAR", "WEEK", "HOUR", "QUARTER". Default is DAY.                                           | Optional |
| start_date | The start date to get snapshots from.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.                                              | Required |
| end_date | The end date to get snapshots until.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.                                               | Required |
| timezone_offset | The timezone offset from UTC changes to match the configured time zone. Use this argument to filter the data according to the provided timezone offset.<br/><br/>Formats accepted: 1, 1.5, 2, 2.5, 5.5, etc. | Required |
| cluster_connected | Whether the cluster is connected or not.<br/><br/>Possible values are: "True", "False". Default is True.                                                                                                     | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.VSphereVm.id | String | Unique ID of the object. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.unit | String | Unit of snapshot group by connection nodes. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.start | String | Start date of snapshot group by connection nodes. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.end | String | End date of snapshot group by connection nodes. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.count | Number | Count of snapshot connections related to the object. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.id | String | ID of snapshot connection related to the object. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.isIndexed | Boolean | Whether the node is indexed or not. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.isUnindexable | Boolean | Whether the node is unindexable or not. |

#### Command Example

```!rubrik-polaris-vm-object-snapshot-list object_id="86db05d1-292f-5973-b616-2ae3977f4428" start_date="2020-05-19T18:30:00.000000Z" end_date="2020-05-20T18:30:00.000000Z" timezone_offset=5.5```

#### Human Readable Output

### VM Object Snapshots

|Snapshot Details|Snapshot IDs|
|---|---|
| Total Snapshots: 2<br/>Date Range: From 2020-05-19T22:30:00.000Z to 2020-05-20T22:29:59.999Z | 33060f59-9c99-5c48-8305-8d1edfe402d2,<br/>57eac609-9529-5cb5-845a-b7cc78998222 |

### rubrik-sonar-ondemand-scan-result

***
Retrieve the download link for the requested scanned file.

#### Base Command

`rubrik-sonar-ondemand-scan-result`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| crawl_id | ID for which file needs to be downloaded.<br/><br/>Note: Users can get the crawl_id by executing the "rubrik-sonar-ondemand-scan" command. | Required |
| file_type | The type of the file that needs to be downloaded.<br/><br/>Possible values are: "ANY", "HITS", "STALE", "OPEN_ACCESS", "STALE_HITS", "OPEN_ACCESS_HITS". | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarOndemandScan.crawlId | String | Crawl ID of the file that needs to be downloaded. |
| RubrikPolaris.SonarOndemandScan.Result.downloadLink | String | Link to download the file when scan status is complete. |

#### Command Example

```!rubrik-sonar-ondemand-scan-result crawl_id="bb4eedc0-594b-4566-b06d-24de0bf752ca" file_type="HITS"```

#### Human Readable Output

### Sonar On-Demand Scan Result

|Scan result CSV Download Link|
|---|
| Download the [CSV](https://www.example.com/csv_file) file to see the result. |

### rubrik-radar-anomaly-csv-analysis

***
Request for the analysis and retrieve the download link or directly download file for the Radar CSV analyzed file.

#### Base Command

`rubrik-radar-anomaly-csv-analysis`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| cluster_id | The unique ID of the cluster.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |
| snapshot_id | The CDM snapshot ID.<br/><br/>Note: Users can retrieve the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command.<br/>Use the "rubrik-radar-suspicious-file-list" command to retrieve the actual CDM ID from the Anomaly ID.<br/>Example format to get the snapshot CDM ID from Anomaly ID: "&lt;Cluster-ID&gt;:::VirtualMachine:::&lt;Snappable-ID&gt;:::&lt;CDM-ID&gt;". | Required |
| object_id | The VM object ID (Snappable ID).<br/><br/>Note: Users can retrieve the list of Snappable IDs by executing the "rubrik-polaris-vm-objects-list" command.<br/>Example format to get the Snappable ID: "VirtualMachine:::&lt;Snappable-ID&gt;". | Required |
| download_file | If set to True, the command downloads the anomaly analysis CSV file directly on XSOAR server.<br/><br/>Possible values are: True, False. Default is False. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.RadarAnomalyCSV.clusterId | String | Cluster ID of the CSV. |
| RubrikPolaris.RadarAnomalyCSV.snapshotId | String | Snapshot ID of the CSV. |
| RubrikPolaris.RadarAnomalyCSV.objectId | String | Object ID of the CSV. |
| RubrikPolaris.RadarAnomalyCSV.investigationCsvDownloadLink.downloadLink | String | The download link of the CSV analysis. |
| File.Size | String | File size in bytes. |
| File.SHA1 | String | SHA1 hash of file. |
| File.SHA256 | String | SHA256 hash of file. |
| File.SHA512 | String | SHA512 hash of file. |
| File.Name | String | File name. |
| File.SSDeep | String | SSDeep hash of the file. |
| File.EntryID | Unknown | The entry ID of the file. |
| File.Info | String | File information. |
| File.Type | String | The file type. |
| File.MD5 | String | MD5 hash of the file. |
| File.Extension | String | The file extension. |

#### Command Example

```!rubrik-radar-anomaly-csv-analysis cluster_id="0000-000-000-000-0000" snapshot_id="0000-000-000-000-0000" object_id="0000-000-000-000-vm-0000" download_file=True```

#### Human Readable Output
>
>### Radar Anomaly CSV Analysis
>
>|CSV Download Link|
>|---|
>| Download the analyzed [CSV](https://www.example.com/snapshot_000-000-000-000.csv) file. |

>Uploaded file: snapshot_000-000-000-000.csv Download
>
>|Property|Value|
>|---|---|
>| Type | text/csv; charset=utf-8 |
>| Size | 10,069 bytes |
>| Info | ASCII text, with very long lines |
>| MD5 | 10000000000000000000000000 |
>| SHA1 | 1000000000000000000000000000000 |
>| SHA256 | 1000000000000000000000000000000000000000000000000000000000 |
>| SHA512 | 10000000000000000000000000000000000000000000000000000000000000000000000 |
>| SSDeep | 1:100000000000000000000000000000000000000000000000000000000: |

### rubrik-sonar-csv-download

***
Request to download the Sonar CSV Snapshot results file.

Note: To know the ID and status of the download, use the "rubrik-user-downloads-list" command. To download the file, use the "rubrik-sonar-csv-result-download" command.

#### Base Command

`rubrik-sonar-csv-download`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| snapshot_id | ID of the snapshot.<br/><br/>Note: Users can retrieve the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list"  command. | Required |
| object_id | Object ID.<br/><br/>Note: Users can retrieve the list of object IDs by executing "rubrik-polaris-vm-objects-list" command. | Required |
| file_type | The type of the file that needs to be downloaded.<br/><br/>Possible values are: "ANY", "HITS", "STALE", "OPEN_ACCESS", "STALE_HITS", "OPEN_ACCESS_HITS". | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarCSVDownload.snapshotId | String | Snapshot ID of the CSV requested to download. |
| RubrikPolaris.SonarCSVDownload.objectId | String | Object ID of the CSV requested to download. |
| RubrikPolaris.SonarCSVDownload.downloadSnapshotResultsCsv.isSuccessful | Boolean | The status of the download. |

#### Command Example

```!rubrik-sonar-csv-download snapshot_id="c38ec074-0c45-5c72-b611-3322cbd46776" object_id="ac0a6844-a2fc-52b0-bb71-6a55f43677be"```

#### Human Readable Output

### Sonar CSV Download

|Download Status|
|---|
| Success |

### rubrik-gps-snapshot-files-list

***
Retrieve the list of the available files that can be downloaded.

Note: To initiate the file download request use the "rubrik-gps-snapshot-files-download" command.

#### Base Command

`rubrik-gps-snapshot-files-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| snapshot_id | The Snapshot ID of the file that needs to be downloaded.<br/><br/>Note: Users can retrieve the list of the snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command. | Required |
| path | The path of the folder to list the sub-files. If not provided the root directory files will be returned.<br/><br/>Format accepted : "/&lt;directory name&gt;/&lt;sub directory name or file name&gt;"<br/><br/>Example: "/C:", "/C:/Users". | Optional |
| search_prefix | Provide a keyword to search in the file names.<br/><br/>Example: "admin". | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSSnapshotFile.snapshotId | String | Snapshot ID provided as an argument to retrieve the files. |
| RubrikPolaris.GPSSnapshotFile.node.absolutePath | String | The absolute path of the file. |
| RubrikPolaris.GPSSnapshotFile.node.displayPath | String | The display path of the file. |
| RubrikPolaris.GPSSnapshotFile.node.path | String | The path of the file. |
| RubrikPolaris.GPSSnapshotFile.node.filename | String | The name of the file. |
| RubrikPolaris.GPSSnapshotFile.node.fileMode | String | The mode of the file. |
| RubrikPolaris.GPSSnapshotFile.node.size | String | The size of the file. |
| RubrikPolaris.GPSSnapshotFile.node.lastModified | String | The last modified time of the file. |
| RubrikPolaris.PageToken.GPSSnapshotFile.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.GPSSnapshotFile.name | String | Name of the command. |
| RubrikPolaris.PageToken.GPSSnapshotFile.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-gps-snapshot-files-list snapshot_id=90858c2f-e572-5b9c-b455-ba309d50c1a2```

#### Human Readable Output

### GPS Snapshot Files

|File Name|Absolute Path|Path|File Mode|Last Modified|
|---|---|---|---|---|
| C: | /C: | C: | DIRECTORY | 2020-10-05T18:56:18.000Z |
| disk_0_part_1 | /disk_0_part_1 |  | DIRECTORY | 2018-06-14T00:47:18.000Z |

Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-gps-vm-export

***
Request to initiate an export of a snapshot of a virtual machine.

Note: To know about the exported VM's status, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-vm-export`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| vm_name | Name given to the VM that runs the snapshot. If not provided the name will be "&lt;Snapshot VM Name&gt; &lt;MM/DD of snapshot creation&gt; &lt;hh/mm of snapshot creation&gt; &lt;Num&gt;". | Optional |
| object_id | The VM object ID whose snapshot needs to be exported.<br/><br/>Note: Users can get the list of object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |
| snapshot_id | The ID of the snapshot that is to be exported.<br/><br/>Note: Users can get the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command. | Required |
| datastore_id | The ID of the datastore which will be used by the new VM.<br/><br/>Note: Users can get the list of  datastore IDs by executing the "rubrik-gps-vm-datastore-list" command. | Required |
| host_id | The ID of the Vsphere ESXi host on which the new VM will be made. Either host_id or host_compute_cluster_id must be provided.<br/><br/>Note: Users can get the list of host IDs by executing the "rubrik-gps-vm-host-list" command. | Optional |
| host_compute_cluster_id | The ID of the VSphere Compute Cluster of a host. Either host_id or host_compute_cluster_id must be provided. <br/><br/>Note: Users can get the list of Compute Cluster IDs by executing the "rubrik-gps-vm-host-list" command. The ID must belong to the VSphereComputeCluster objectType. | Optional |
| power_on | Whether to turn on the new VM or not.<br/><br/>Possible values are: "True", "False". | Optional |
| keep_mac_addresses | Whether the mac addresses of network devices of the new VM be removed or not.<br/><br/>Possible values are: "True", "False". | Optional |
| remove_network_devices | Whether the network devices on the original VM be kept or not.<br/><br/>Possible values are: "True", "False". | Optional |
| recover_tags | Whether to keep vSphere tags associated with the original VM or not.<br/><br/>Possible values are: "True", "False". | Optional |
| disable_network | Whether to disable networking on the new VM or not.<br/><br/>Possible values are: "True", "False". | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMSnapshotExport.id | String | Snapshot export request ID. |

#### Command Example

```!rubrik-gps-vm-export object_id=d39e956f-a3c9-5307-865b-58ed045b59c5 snapshot_id=07fa66e1-137a-5473-8a8e-825547075d7b datastore_id=5fe3a92a-d848-5325-a1a2-ef6cf7a16376 host_compute_cluster_id=0dc88a78-0d46-57d7-86c6-f1bd97ff979f```

#### Human Readable Output

### GPS VM Export

|Snapshot Export Request ID|
|---|
| dummy_id |

### rubrik-user-downloads-list

***
Retrieve the user downloads. This would return the current and past download history.

Note: To download the requested Sonar CSV Snapshot results file use the "rubrik-sonar-csv-result-download" command.

#### Base Command

`rubrik-user-downloads-list`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.UserDownload.id | Number | The ID of the download. |
| RubrikPolaris.UserDownload.name | String | The name of the download. |
| RubrikPolaris.UserDownload.status | String | The status of the download. |
| RubrikPolaris.UserDownload.progress | Number | The progress of the download. |
| RubrikPolaris.UserDownload.identifier | String | The identifier of the download or the type of download requested. |
| RubrikPolaris.UserDownload.createTime | String | The creation time of the download. |
| RubrikPolaris.UserDownload.completeTime | String | The completion time of the download. |

#### Command Example

```!rubrik-user-downloads-list```

#### Human Readable Output

### User Downloads

|Download ID|Name|Status|Identifier|Creation Time|Completion Time|
|---|---|---|---|---|---|
| 156 | GDIT-billing-test-oct10 | COMPLETED | SONAR_DOWNLOAD | 2021-10-06T07:25:51.676432470Z | 2021-10-06T07:25:51.856374014Z |

### rubrik-gps-sla-domain-list

***
Enumerates the available SLA Domains to apply to the on-demand snapshot as a retention policy.

#### Base Command

`rubrik-gps-sla-domain-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | Name of the SLA Domain to search for. | Optional |
| cluster_id | Cluster, the SLA domain is managed by.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Optional |
| object_type | Filters SLA domain based on the provided object types. Supports comma separated values. <br/><br/>Possible values are: "FILESET_OBJECT_TYPE", "VSPHERE_OBJECT_TYPE". | Optional |
| show_cluster_slas_only | Whether to show Cluster SLAs and not Global SLAs. "False" value will result in showing only Global SLAs. <br/><br/>Possible values are: "True", "False". Default is True. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Possible values are: "NAME", "PROTECTED_OBJECT_COUNT". Default is NAME. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSSLADomain.name | String | Name of the SLA domain. |
| RubrikPolaris.GPSSLADomain.id | String | ID of the SLA domain. |
| RubrikPolaris.GPSSLADomain.description | String | Description of the SLA domain. |
| RubrikPolaris.GPSSLADomain.protectedObjectCount | Number | Number of objects under the SLA Domain. |
| RubrikPolaris.GPSSLADomain.baseFrequency.duration | Number | Base snapshot frequency duration. |
| RubrikPolaris.GPSSLADomain.baseFrequency.unit | String | Base snapshot frequency unit \(HOURS, DAYS etc\). |
| RubrikPolaris.GPSSLADomain.archivalSpec.archivalLocationName | String | Location where the archives are stored. |
| RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.id | String | ID of the archival target. |
| RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.name | String | Name of the archival target. |
| RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.groupType | String | Group type of the archival target. |
| RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.targetType | String | Target type of the archival target. |
| RubrikPolaris.GPSSLADomain.replicationSpec.replicationType | String | Enum value representing the type of replication. Values: UNKNOWN_REPLICATION_TYPE, UNIDIRECTIONAL_REPLICATION_TO_CLUSTER, REPLICATION_TO_CLOUD_REGION, REPLICATION_TO_CLOUD_LOCATION. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.unidirectionalSpec.replicationTargetName | String | Cloud replication target name. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudRegionSpec.replicationTargetRegion | String | Cloud replication target region. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudRegionSpec.cloudProvider | String | Cloud replication service provider. Values:  AWS, AZURE. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudLocationSpec.targetMapping.id | String | ID of the cloud target where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudLocationSpec.targetMapping.name | String | Name of the cloud target where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.cluster.id | String | ID of the cluster where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.cluster.name | String | Name of the cluster where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.accountId | String | Account ID on AWS where the replication happens. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.accountName | String | Account name on AWS where the replication happens. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.region | String | Account region on AWS where the replication happens. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.azureTarget.region | String | Account region on Azure where the replication happens. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.retentionDuration.duration | Number | Replication retention duration. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.retentionDuration.unit | String | Replication retention duration unit. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.targetMapping.id | String | ID of the object target where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.targetMapping.name | String | Name of the object target where replication takes place. |
| RubrikPolaris.GPSSLADomain.localRetentionLimit.duration | Number | Local retention limit duration. |
| RubrikPolaris.GPSSLADomain.localRetentionLimit.unit | String | Local retention limit duration unit. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.frequency | Number | Snapshot frequency every minute. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.retention | Number | Snapshot retention value per minute snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.retentionUnit | String | Snapshot retention time unit per minute snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.frequency | Number | Snapshot hourly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.retention | Number | Snapshot retention value per hour snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.retentionUnit | String | Snapshot retention time unit per hour snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.frequency | Number | Snapshot daily frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.retention | Number | Snapshot retention value per day snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.retentionUnit | String | Snapshot retention unit per day snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.frequency | Number | Snapshot weekly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.retention | Number | Snapshot retention value per week snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.retentionUnit | String | Snapshot retention unit per week snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.dayOfWeek | String | Starting day of the weekly snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.frequency | Number | Snapshot monthly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.retention | Number | Snapshot retention value per month snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.retentionUnit | String | Snapshot retention unit per month snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.dayOfMonth | String | Starting day of the month snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.frequency | Number | Snapshot quarterly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.retention | Number | Snapshot retention value per quarter snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.retentionUnit | String | Snapshot retention unit per quarter snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.dayOfQuarter | String | Starting day of the quarterly snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.quarterStartMonth | String | Starting month of the quarterly snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.frequency | Number | Snapshot yearly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.retention | Number | Snapshot retention value per year snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.retentionUnit | String | Snapshot retention unit per year snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.dayOfYear | String | Starting day of the yearly snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.yearStartMonth | String | Starting month of the yearly snapshot. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.awsRdsConfig.logRetention.duration | Number | Duration of retentioning AWS Relational database logs. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.awsRdsConfig.logRetention.unit | String | Unit of duration of retentioning AWS Relational database logs. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.incrementalFrequency.duration | Number | Duration of retentioning SAP HANA incremental backups. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.incrementalFrequency.unit | String | Unit of duration of retentioning SAP HANA incremental backups. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.differentialFrequency.duration | Number | Duration of retentioning SAP HANA differential backups. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.differentialFrequency.unit | String | Unit of duration of retentioning SAP HANA differential backups. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.logRetention.duration | Number | Duration of retensioning SAP HANA Database logs. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.logRetention.unit | String | Unit of duration of retentioning SAP HANA Database logs. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.vmwareVmConfig.logRetentionSeconds | Number | Seconds of retentioning VMWare virtual machine logs. |
| RubrikPolaris.GPSSLADomain.objectTypes | Unknown | List of object types associated with this SLA Domain. |

#### Command Example

```!rubrik-gps-sla-domain-list cluster_id=4d4a41d5-8910-4e4d-9dca-0798f5fc6d61 limit=2```

#### Human Readable Output

### GPS SLA Domains

|SLA Domain ID|SLA Domain Name|Base Frequency|Protected Object Count|Archival Location|Description|Replication Target 1|Replication Target 2|
|---|---|---|---|---|---|---|---|
| 00000000-0000-0000-0000-000000000002 | Bronzecd | 1 Days | 0 | AWS S3:bucket-1234 | Rubrik default Bronze level SLA Domain policy | sand2-rbk01 | sand2-rbk02 |
| 00000000-0000-0000-0000-000000000000 | Gold | 4 Hours | 0 |  | Rubrik default Gold level SLA Domain policy | sand2-rbk01 |  |

### rubrik-sonar-csv-result-download

***
Retrieve the download link for the requested Sonar CSV Snapshot file.

#### Base Command

`rubrik-sonar-csv-result-download`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| download_id | The ID of the download, requested using "rubrik-sonar-csv-download" command.<br/><br/>Note: Users can retrieve the list of downloads containing ID by executing the "rubrik-user-downloads-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarCSVDownload.downloadId | String | The download ID of the download request. |
| RubrikPolaris.SonarCSVDownload.getDownloadUrl.url | String | The link of the file that needs to be downloaded. |

#### Command Example

```!rubrik-sonar-csv-result-download download_id=65```

#### Human Readable Output

### Sonar CSV Result

|Download URL|
|---|
| Download the [CSV](https://www.example.com/csv_file) file to see the result. |

### rubrik-gps-vm-snapshot-create

***
Triggers an on-demand snapshot of a system.

Note: To know about the status of the on-demand snapshot creation, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-vm-snapshot-create`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| object_id | The ID of the object whose snapshot is to be created. <br/><br/>Note: Users can get the list of object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |
| sla_domain_id | The ID of the SLA domain retention policy to be applied on the object.<br/><br/>Note: Users can get the list of SLA Domain IDs by executing the "rubrik-gps-sla-domain-list" command. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSOndemandSnapshot.id | String | ID of the requested snapshot. |
| RubrikPolaris.GPSOndemandSnapshot.status | String | Status of the requested snapshot. |

#### Command Example

```!rubrik-gps-vm-snapshot-create object_id=ac0a6844-a2fc-52b0-bb71-6a55f43677be```

#### Human Readable Output

### GPS VM Snapshot

|On-Demand Snapshot Request ID|Status|
|---|---|
| dummy_id | QUEUED |

### rubrik-gps-snapshot-files-download

***
Request to download the snapshot file from the backup.

Note: To know about the file information and which file can be downloaded, use the "rubrik-gps-snapshot-files-list" command. To know about the status of the downloadable files, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-snapshot-files-download`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| snapshot_id | The Snapshot ID of the file that needs to be downloaded.<br/><br/>Note: Users can retrieve the list of the snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command. | Required |
| file_path | The absolute path of the file to be downloaded. A list of files can be downloaded as a zip folder. Multiple file paths can be separated with comma(,).<br/><br/>Note: Users can retrieve the list of the files with absolute path by executing the "rubrik-gps-snapshot-files-list" command.<br/><br/>Format accepted: "/&lt;directory name&gt;/&lt;sub directory name or file name&gt;"<br/><br/>Example: "/C:/PerfLogs/Admin", "/C:/Windows/Microsoft.NET". | Required |
| object_type | The type of object for which the file to be downloaded.<br/><br/>Possible values are: "WindowsFileset", "LinuxFileset", "VolumeGroup", "VmwareVm". Default is VmwareVm. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSSnapshotFileDownload.id | String | The ID of the download. |
| RubrikPolaris.GPSSnapshotFileDownload.status | String | Status of the download. |
| RubrikPolaris.GPSSnapshotFileDownload.links.href | String | Link of the download. |
| RubrikPolaris.GPSSnapshotFileDownload.links.rel | String | Relationship of the download. |

#### Command Example

```!rubrik-gps-snapshot-files-download snapshot_id=3765b5b5-827b-5588-8c34-5cb737a28685 file_path="/.autorelabel"```

#### Human Readable Output

### Snapshot File Request ID

|ID|Status|
|---|---|
| dummy_id | QUEUED |

### rubrik-gps-vm-livemount

***
Performs a live mount of a virtual machine snapshot.

Note: To know about the live mount status, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-vm-livemount`

#### Input

| **Argument Name** | **Description**                                                                                                                                                                             | **Required** |
| --- |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| snappable_id | The snappable ID.                                                                                                                                                                           | Required |
| should_recover_tags | Whether to keep vSphere tags associated with the VM or not.<br/><br/>Possible values are: "True", "False". Default is True.                                                                 | Optional |
| power_on | Whether to power on the mount or not.<br/><br/>Possible values are: "True", "False". Default is True.                                                                                       | Optional |
| keep_mac_addresses | Whether the mac addresses of network devices be removed or not.<br/><br/>Possible values are: "True", "False". Default is False.                                                            | Optional |
| remove_network_devices | Whether the network devices of the original VM be kept.<br/><br/>Possible values are: "True", "False". Default is False.                                                                    | Optional |
| host_id | The ID of the Vsphere ESXi host on which the new VM will be mounted.<br/><br/>Note: Users can get the list of host IDs by executing the "rubrik-gps-vm-host-list" command.                  | Optional |
| cluster_id | ID of the compute cluster where the new VM will be mounted.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.               | Optional |
| resource_pool_id | ID of the resource pool where the new VM will be mounted.                                                                                                                                   | Optional |
| snapshot_fid | ID of the snapshot to recover.                                                                                                                                                              | Optional |
| vm_name | Name given to the VM that runs the snapshot. If not provided the name will be "&lt;Snapshot VM Name&gt; &lt;MM/DD of snapshot creation&gt; &lt;hh/mm of snapshot creation&gt; &lt;Num&gt;". | Optional |
| vnic_bindings | List of network bindings for vNIC of the VM.  <br/><br/> e.g. [{"networkDeviceInfo":{"key":2000,"name":"Network adapter"},"backingNetworkInfo":{"moid":"db68871d-0fbf-5551-97de-4c234885766b","name":"Router"}}]            | Optional |
| recovery_point | Point in time to recover to, e.g.: "2023-03-04T05:06:07.890".                                                                                                                               | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMLiveMount.id | String | ID of the Live mount request. |

#### Command Example

```!rubrik-gps-vm-livemount snapshot_id=d680b484-0084-5231-a05d-18e9cd5402fc vm_name=live-mount-demo```

#### Human Readable Output

### GPS VM Livemount

|VM Live Mount Request ID|
|---|
| dummy_id |

### rubrik-gps-vm-host-list

***
Retrieve the list of available Vsphere Hosts.

#### Base Command

`rubrik-gps-vm-host-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | The name of the host to search for. | Optional |
| cluster_id | To list hosts from the specific cluster.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Supported values are "ID" and "NAME" only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMHost.id | String | ID of the Vsphere host. |
| RubrikPolaris.GPSVMHost.name | String | Name of the Vsphere host. |
| RubrikPolaris.GPSVMHost.physicalPath.fid | String | ID of a physical path of a node. |
| RubrikPolaris.GPSVMHost.physicalPath.name | String | Name of a physical path of a node. |
| RubrikPolaris.GPSVMHost.physicalPath.objectType | String | Type of a physical path of a node, for example, VSphereComputeCluster, VSphereDatacenter etc. |
| RubrikPolaris.PageToken.GPSVMHost.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.GPSVMHost.name | String | Name of the command. |
| RubrikPolaris.PageToken.GPSVMHost.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-gps-vm-host-list```

#### Human Readable Output

### GPS VM Hosts

|VSphere Host ID|Name|Physical Host|
|---|---|---|
| f57bfebf-c7c9-5310-a5fd-1f0aeea5ba25 | sjc-40302-sand1-esx02.rubrikdemo.com | {'id': '72480b29-0eaa-57a9-8c5c-45b7e1c2c826', 'name': 'Sandbox-1 SJC Cluster', 'objectType': 'VSphereComputeCluster'},<br/>{'id': '3f3a92de-c7f3-57f7-989f-3731db83aeab', 'name': 'Sandbox-1 Datacenter', 'objectType': 'VSphereDatacenter'},<br/>{'id': '415859e2-fd22-53ea-8de1-041d99298fe3', 'name': 'sand1-vcsa.rubrikdemo.com', 'objectType': 'VSphereVCenter'} |

### rubrik-gps-vm-datastore-list

***
Retrieve the list of the available datastores on a Vsphere Host.

#### Base Command

`rubrik-gps-vm-datastore-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | The name of the datastore to search for. | Optional |
| host_id | The ID of a Vsphere host whose datastores are to be listed.<br/><br/>Note: Users can get the list of host IDs by executing the "rubrik-gps-vm-host-list" command. | Required |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Supported values are "ID" and "NAME" only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMHost.id | String | ID of the Vsphere host. |
| RubrikPolaris.GPSVMHost.Datastore.id | String | ID of the Vsphere datastore. |
| RubrikPolaris.GPSVMHost.Datastore.name | String | Name of the Vsphere datastore. |
| RubrikPolaris.GPSVMHost.Datastore.capacity | Number | Datastore capacity in bytes. |
| RubrikPolaris.GPSVMHost.Datastore.isLocal | Boolean | Whether the datastore is local or remote. |
| RubrikPolaris.GPSVMHost.Datastore.freeSpace | Number | Free space on the datastore in bytes. |
| RubrikPolaris.GPSVMHost.Datastore.datastoreType | String | Type of datastore, for example, "NFS",  "VMFS" etc. |
| RubrikPolaris.PageToken.GPSVMHost.Datastore.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.GPSVMHost.Datastore.name | String | Name of the command. |
| RubrikPolaris.PageToken.GPSVMHost.Datastore.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-gps-vm-datastore-list```

#### Human Readable Output

### GPS VM Datastores

|VSphere Datastore ID|Name|Capacity|Free Space|Datastore Type|
|---|---|---|---|---|
| dummy_datastore_id | dummy-repo | 0.53362190336 TB | 0.188318314496 TB | NFS |

### rubrik-event-list

***
Retrieve the list of events.

#### Base Command

`rubrik-event-list`

#### Input

| **Argument Name** | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | **Required** |
| --- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| activity_status | Filter the events based on the provided activity statuses. Supports comma separated values.<br/><br/>Possible values are: "UNKNOWN_EVENT_STATUS", "SUCCESS", "FAILURE", "INFO", "CANCELED", "RUNNING", "WARNING", "CANCELING", "TASK_SUCCESS", "QUEUED", "TASK_FAILURE", "PARTIAL_SUCCESS".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Optional |
| activity_type | Filter the events based on provided activity types. Supports comma separated values.<br/><br/>Possible values are: "UNKNOWN_EVENT_TYPE", "ARCHIVE", "AUTH_DOMAIN", "AWS_EVENT", "BACKUP", "CLASSIFICATION", "CLOUD_NATIVE_SOURCE", "CLOUD_NATIVE_VIRTUAL_MACHINE", "CLOUD_NATIVE_VM", "CONFIGURATION", "CONVERSION", "CONNECTION", "DIAGNOSTIC", "DISCOVERY", "DOWNLOAD", "FAILOVER", "FILESET", "HARDWARE", "HDFS", "HOST_EVENT", "HYPERV_SCVMM", "HYPERV_SERVER", "INDEX", "INSTANTIATE", "LEGAL_HOLD", "LOCAL_RECOVERY", "MAINTENANCE", "NUTANIX_CLUSTER", "RANSOMWARE_INVESTIGATION_ANALYSIS", "RECOVERY", "REPLICATION", "RESOURCE_OPERATIONS", "ANOMALY", "STORAGE", "STORAGE_ARRAY", "STORM_RESOURCE", "SUPPORT", "SYNC", "SYSTEM", "TEST_FAILOVER", "THREAT_HUNT", "TPR", "LOCK_SNAPSHOT", "UPGRADE", "VCENTER", "VCD", "VOLUME_GROUP", "EMBEDDED_EVENT", "ISOLATED_RECOVERY", "OWNERSHIP", "LOG_BACKUP", "K8S".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Optional |
| severity | Filter the events based on provided severities. Supports comma separated values.<br/><br/>Possible values are: "SEVERITY_INFO", "SEVERITY_CRITICAL", "SEVERITY_WARNING".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Optional |
| object_name | Filter out events based on object name.<br/><br/>Note: Users can get the object names by executing the "rubrik-polaris-vm-objects-list" or "rubrik-polaris-object-search" command.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Optional |
| object_type | Filter the events based on provided object types. Supports comma separated values.<br/><br/>Possible values are: "UNKNOWN_EVENT_OBJECT_TYPE", "RUBRIK_SAAS_ACCOUNT", "APP_BLUEPRINT", "APP_FLOWS", "OBJECT_TYPE_AUTH_DOMAIN", "AWS_ACCOUNT", "AWS_EVENT_TYPE", "AZURE_NATIVE_SUBSCRIPTION", "AZURE_NATIVE_VM", "AZURE_NATIVE_DISK", "AZURE_SQL_DATABASE", "AZURE_SQL_MANAGED_INSTANCE", "AZURE_SQL_DATABASE_SERVER", "AZURE_SQL_MANAGED_INSTANCE_DATABASE", "CAPACITY_BUNDLE", "OBJECT_TYPE_CLOUD_NATIVE_VIRTUAL_MACHINE", "OBJECT_TYPE_CLOUD_NATIVE_VM", "CERTIFICATE", "CLUSTER", "COMPUTE_INSTANCE", "DATA_LOCATION", "DB2_DATABASE", "DB2_INSTANCE", "EC2_INSTANCE", "ENVOY", "FAILOVER_CLUSTER_APP", "EXOCOMPUTE", "EXCHANGE_DATABASE", "OBJECT_TYPE_HDFS", "HOST", "OBJECT_TYPE_HYPERV_SCVMM", "OBJECT_TYPE_HYPERV_SERVER", "HYPERV_VM", "JOB_INSTANCE", "LDAP", "LINUX_FILESET", "LINUX_HOST", "MANAGED_VOLUME", "MSSQL", "NAS_FILESET", "WEBHOOK", "NAS_HOST", "NAS_SYSTEM", "OBJECT_TYPE_NUTANIX_CLUSTER", "NUTANIX_VM", "O365_CALENDAR", "O365_MAILBOX", "O365_ONEDRIVE", "O365_SITE", "O365_SHARE_POINT_DRIVE", "O365_SHARE_POINT_LIST", "O365_TEAM", "O365_ORGANIZATION", "O365_GROUP", "OBJECT_PROTECTION", "ORACLE", "ORACLE_DB", "ORACLE_HOST", "ORACLE_RAC", "AWS_NATIVE_ACCOUNT", "AWS_NATIVE_EBS_VOLUME", "AWS_NATIVE_EC2_INSTANCE", "RUBRIK_SAAS_EBS_VOLUME", "RUBRIK_SAAS_EC2_INSTANCE", "PUBLIC_CLOUD_MACHINE_INSTANCE", "SAML_SSO", "SAP_HANA_DB", "SAP_HANA_SYSTEM", "SHARE_FILESET", "SLA_DOMAIN", "SMB_DOMAIN", "SNAP_MIRROR_CLOUD", "OBJECT_TYPE_STORAGE_ARRAY", "STORAGE_ARRAY_VOLUME_GROUP", "STORAGE_LOCATION", "STORM", "SUPPORT_BUNDLE", "USER", "OBJECT_TYPE_UPGRADE", "OBJECT_TYPE_VCD", "VCD_VAPP", "OBJECT_TYPE_VCENTER", "VMWARE_COMPUTE_CLUSTER", "VMWARE_VM", "OBJECT_TYPE_VOLUME_GROUP", "WINDOWS_FILESET", "WINDOWS_HOST", "GCP_NATIVE_PROJECT", "AWS_NATIVE_RDS_INSTANCE", "GCP_NATIVE_GCE_INSTANCE", "GCP_NATIVE_DISK", "KUPR_CLUSTER", "KUPR_NAMESPACE", "CASSANDRA_COLUMN_FAMILY", "CASSANDRA_KEYSPACE", "CASSANDRA_SOURCE", "MONGODB_COLLECTION", "MONGODB_DATABASE", "MONGODB_SOURCE", "CLOUD_DIRECT_NAS_EXPORT", "MONGO_COLLECTION", "MONGO_DATABASE", "MONGO_SOURCE", "CERTIFICATE_MANAGEMENT", "AWS_NATIVE_S3_BUCKET", "AZURE_STORAGE_ACCOUNT", "K8S_CLUSTER", "K8S_RESOURCE_SET", "AZURE_AD_TENANT". | Optional |
| cluster_id | Filter the events based on provided cluster IDs. Supports comma separated values.<br/><br/>Note: Users can get the list of cluster IDs by executing the "rubrik-gps-cluster-list" command.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Optional |
| start_date | The start date to fetch updated events from.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Optional |
| end_date | The end date to fetch updated events until.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Optional |
| next_page_token | The next page cursor to retrieve the next set of results.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Possible values are: "LAST_UPDATED", "LOCATION", "OBJECT_TYPE", "CLUSTER_NAME", "OBJECT_NAME", "START_TIME", "ACTIVITY_TYPE", "SEVERITY", "ACTIVITY_STATUS". Default is LAST_UPDATED.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC","DESC". Default is DESC.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.Event.id | Number | ID of the event. |
| RubrikPolaris.Event.startTime | String | Start time of the event. |
| RubrikPolaris.Event.fid | String | FID of the event. |
| RubrikPolaris.Event.activitySeriesId | String | Activity Series ID of the event. |
| RubrikPolaris.Event.lastUpdated | String | Date time when the event was last updated. |
| RubrikPolaris.Event.lastActivityType | String | Last Activity Type of the event. |
| RubrikPolaris.Event.lastActivityStatus | String | Last Activity Status of the event. |
| RubrikPolaris.Event.location | String | Location of the event. |
| RubrikPolaris.Event.objectId | String | ID of the object. |
| RubrikPolaris.Event.objectName | String | Name of the object. |
| RubrikPolaris.Event.objectType | String | Type of the object. |
| RubrikPolaris.Event.severity | String | Severity of the event. |
| RubrikPolaris.Event.progress | String | Progress of the event. |
| RubrikPolaris.Event.cluster.id | String | The ID of the cluster. |
| RubrikPolaris.Event.cluster.name | String | The name of the cluster. |
| RubrikPolaris.Event.activityConnection.nodes.id | String | ID of the activity connection. |
| RubrikPolaris.Event.activityConnection.nodes.message | String | Message of the activity connection. |
| RubrikPolaris.Event.activityConnection.nodes.severity | String | Severity of the activity connection. |
| RubrikPolaris.Event.activityConnection.nodes.time | String | Date time when the activity connection was last updated. |
| RubrikPolaris.PageToken.Event.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.Event.name | String | Name of the command. |
| RubrikPolaris.PageToken.Event.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-event-list limit=1```

#### Human Readable Output

### Events

|Event ID|Activity Series ID|Cluster ID|Object ID|Object Name|Severity|Start Time|Last Updated|Last Activity Type|Last Activity Status|
|---|---|---|---|---|---|---|---|---|---|
| 7739500 | 422d17c0-737d-44df-98a0-a7fa9f714c0d | cc19573c-db6c-418a-9d48-067a256543ba | Fileset:::f2666679-5b94-4116-9cbf-6ab69e575522 | AllTheThings | Info | 2021-10-25T12:15:36.911Z | 2021-10-25T12:16:10.212Z | Index | Success |

 Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-polaris-object-list

***
Retrieve the list of Rubrik objects, based on the provided filters.

#### Base Command

`rubrik-polaris-object-list`

#### Input

| **Argument Name** | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | **Required** |
| --- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| type_filter | Filter the objects based on the provided object types. Supports comma separated values.<br/><br/>Possible values are: "MONGODB_DATABASE", "FilesetTemplate", "VcdOrgVdc", "ShareFileset", "KuprNamespace", "O365Group", "AwsNativeEbsVolume", "OracleDatabase", "O365Mailbox", "MONGO_DB", "AzureNativeResourceGroup", "AZURE_SQL_MANAGED_INSTANCE_DB", "Db2Database", "HOST_FAILOVER_CLUSTER", "VolumeGroup", "AzureNativeVm", "VcdOrg", "Db2Instance", "PhysicalHost", "AwsNativeRdsInstance", "AzureSqlManagedInstanceServer", "O365Site", "VmwareVirtualMachine", "O365User", "ORACLE_DATA_GUARD_GROUP", "AwsNativeEc2Instance", "MssqlInstance", "NutanixVirtualMachine", "CASSANDRA_COLUMN_FAMILY", "MONGO_COLLECTION", "O365Org", "OracleHost", "NAS_FILESET", "SapHanaDatabase", "AllSubHierarchyType", "AWS_NATIVE_S3_BUCKET", "NasSystem", "O365Teams", "VSphereFolder", "VSphereResourcePool", "GcpNativeDisk", "AwsNativeAccount", "VSphereDatacenter", "AZURE_STORAGE_ACCOUNT", "VSphereComputeCluster", "HypervCluster", "CASSANDRA_SOURCE", "VSphereTag", "VcdVapp", "RubrikEbsVolume", "NasVolume", "NasNamespace", "Vcd", "VcdVimServer", "AZURE_SQL_DATABASE_DB", "VSPHERE_VIRTUAL_DISK", "MssqlDatabaseBatchMaintenance", "EXCHANGE_SERVER", "CLOUD_DIRECT_NAS_EXPORT", "VcdCatalog", "O365File", "HypervSCVMM", "Blueprint", "AzureSqlDatabaseServer", "FeldsparSite", "CloudNativeTagRule", "Mssql", "MONGO_SOURCE", "HostShare", "SnapMirrorCloud", "O365Calendar", "O365SharePointDrive", "VSphereNetwork", "Fileset", "SapHanaSystem", "O365Onedrive", "Hdfs", "Ec2Instance", "WindowsCluster", "GcpNativeProject", "MONGODB_COLLECTION", "MONGO_DATABASE", "VSphereDatastore", "AZURE_AD_TENANT", "HypervServer", "VSphereHost", "AppBlueprint", "MssqlAvailabilityGroup", "LinuxFileset", "MANAGED_VOLUME_EXPORT", "CASSANDRA_KEYSPACE", "HypervVirtualMachine", "GcpNativeGCEInstance", "StorageArrayVolumeGroup", "O365SharePointList", "ExchangeDatabase", "NutanixCluster", "AzureNativeManagedDisk", "AzureNativeSubscription", "VSPHERE_DATASTORE_CLUSTER", "ManagedVolume", "FAILOVER_CLUSTER_APP", "VSphereVCenter", "NasShare", "EXCHANGE_DAG", "KuprCluster", "OracleRac", "MONGODB_SOURCE", "ORCHESTRATED_APPLICATION_RECOVERY_BLUEPRINT", "VSphereTagCategory", "ORCHESTRATED_APPLICATION_RECOVERY_PLAN", "WindowsVolumeGroup", "RubrikEc2Instance", "WindowsFileset". | Required |
| cluster_id | Filter the objects based on the provided cluster IDs. Supports comma separated values.<br/><br/>Note: Users can get the list of cluster IDs by executing the "rubrik-gps-cluster-list" command.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Optional |
| next_page_token | The next page cursor to retrieve the next set of results.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Supported values are "ID" and "NAME" only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.Object.id | String | ID of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.name | String | Name of the SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.id | String | ID of the SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.description | String | Description of the SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.cluster.id | String | Cluster ID of effective SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.cluster.name | String | Cluster name of effective SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.fid | String | FID of effective SLA domain of the object. |
| RubrikPolaris.Object.isPassthrough | Boolean | Whether the object is passthrough or not. |
| RubrikPolaris.Object.cluster.id | String | Cluster ID of the object. |
| RubrikPolaris.Object.cluster.name | String | Cluster name of the object. |
| RubrikPolaris.Object.primaryClusterLocation.id | String | ID of the primary cluster location of the object. |
| RubrikPolaris.Object.logicalPath.name | String | Name of the logical path of the object. |
| RubrikPolaris.Object.logicalPath.objectType | String | Object Type of the logical path of the object. |
| RubrikPolaris.Object.physicalPath.name | String | Name of the physical path of the object. |
| RubrikPolaris.Object.physicalPath.objectType | String | Object Type of the physical path of the object. |
| RubrikPolaris.Object.name | String | Name of the object. |
| RubrikPolaris.Object.objectType | String | Type of the object. |
| RubrikPolaris.PageToken.Object.has_next_page | Boolean | Whether the result has the next page or not. |
| RubrikPolaris.PageToken.Object.name | String | Name of the command. |
| RubrikPolaris.PageToken.Object.next_page_token | String | Next page token. |

#### Command Example

```!rubrik-polaris-object-list limit=1```

#### Human Readable Output

### Objects

|Object ID|Object Name|Object Type|Location|Cluster Name|SLA Domain Name|
|---|---|---|---|---|---|
| 0014037c-70ae-4c53-b1cf-df6926b88968 | Christian LeCorre | O365User | Rubrik Demo\EMEA Users\AMER Users | x | UNPROTECTED |

 Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-polaris-object-snapshot-list

***
Retrieve Rubrik snapshot(s) of an object, based on the provided object ID.

#### Base Command

`rubrik-polaris-object-snapshot-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| object_id | The object ID for which the snapshots are to be searched.<br/><br/>Note: Users can get the list of the object IDs by executing the "rubrik-polaris-object-list" command. | Required |
| start_date | The start date to get snapshots from.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.<br/><br/>Note: start_date and end_date both or none must be initialized. | Optional |
| end_date | The end date to get snapshots until.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.<br/><br/>Note: start_date and end_date both or none must be initialized. | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |
| snapshot_type | List of snapshot types to filter snapshots. Supports comma separated values.<br/><br/>Possible values are: "SCHEDULED", "ON_DEMAND", "DOWNLOADED". | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "Asc", "Desc". Default is Asc. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.Object.id | String | ID of the object. |
| RubrikPolaris.Object.Snapshot.id | String | ID of the snapshot. |
| RubrikPolaris.Object.Snapshot.date | String | Date of the snapshot. |
| RubrikPolaris.Object.Snapshot.isArchivalCopy | Boolean | Whether the snapshot is an archival copy or not. |
| RubrikPolaris.Object.Snapshot.isReplica | Boolean | Whether the snapshot is a replica or not. |
| RubrikPolaris.Object.Snapshot.isOnDemandSnapshot | Boolean | Whether the snapshot is on demand or not. |
| RubrikPolaris.Object.Snapshot.isDownloadedSnapshot | Boolean | Whether the snapshot is downloaded or not. |
| RubrikPolaris.Object.Snapshot.cluster.id | String | Cluster ID of the snapshot. |
| RubrikPolaris.Object.Snapshot.cluster.name | String | Cluster name of the snapshot. |
| RubrikPolaris.Object.Snapshot.cluster.version | String | Cluster version of the snapshot. |
| RubrikPolaris.Object.Snapshot.cluster.status | String | Cluster status of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.name | String | Name of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.fid | String | FID of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.cluster.id | String | Cluster ID of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.cluster.name | String | Cluster name of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.id | String | ID of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.name | String | Archival name of snapshot retention of the snapshot. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.isExpirationDateCalculated | String | Whether archival expiration date of snapshot retention of the snapshot is calculated or not. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.expirationTime | String | Archival expiration time of snapshot retention of the snapshot. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.name | String | Name of snapshot retention of the snapshot. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.isExpirationDateCalculated | Boolean | Whether the expiration date is calculated or not. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.expirationTime | String | Expiration time of snapshot retention of the snapshot. |
| RubrikPolaris.PageToken.Object.Snapshot.has_next_page | Boolean | Whether the result has the next page or not. |
| RubrikPolaris.PageToken.Object.Snapshot.name | String | Name of the command. |
| RubrikPolaris.PageToken.Object.Snapshot.next_page_token | String | Next Page Token. |

#### Command Example

```!rubrik-polaris-object-snapshot-list object_id=06515737-388a-57aa-9c8e-54b3f1ee5d8b limit=1```

#### Human Readable Output

### Object Snapshots

|Snapshot ID|Creation Date|Cluster Name|SLA Domain Name|
|---|---|---|---|
| a7adc499-b896-5ad6-bfc2-0aae0ed99459 | 2021-10-28T19:35:52.000Z | sand2-rbk01 | 12hr-30d-AWS |

 Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-radar-ioc-scan

***
Triggers an IOC scan of a system.

Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command and to list the running/completed IOC scans on a cluster use the "rubrik-radar-ioc-scan-list" command.

#### Base Command

`rubrik-radar-ioc-scan`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| cluster_id | ID of the cluster on which to perform a scan.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |
| object_id | Object ID of the system on which to perform the scan. Supports comma separated values.<br/><br/>Note: Users can get the list of object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |
| scan_name | Name of the scan. Default is PAXSOAR-1.1.0.| Optional |
| ioc_type | The type of the indicator to scan for.<br/><br/>Possible values are: "INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME", "INDICATOR_OF_COMPROMISE_TYPE_HASH", "INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE".<br/><br/>Note: To provide multiple IOCs use the argument "advance_ioc". | Optional |
| ioc_value | Value of the indicator to scan for.<br/><br/>Note: To provide multiple IOCs use the argument "advance_ioc". | Optional |
| advance_ioc | Json encoded Indicators Of Compromise to scan. Json keys signify the type of IOC and the corresponding list of values are the values of the IOC's. If provided, will ignore the ioc_type and ioc_value arguments.<br/><br/>Possible keys to indicate type of indicator: <br/>INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE<br/><br/>Format Accepted:<br/>{<br/>"&lt;ioc_type1&gt;": ["&lt;ioc_value1&gt;", "&lt;ioc_value2&gt;"],<br/>"&lt;ioc_type2&gt;": "&lt;ioc_value2&gt;"<br/>}<br/><br/>Example:<br/>{<br/>"INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME": ["C:\Users\Malware_Executible.ps1", "\bin\Malware_Executible"],<br/>"INDICATOR_OF_COMPROMISE_TYPE_HASH": ["e5c1b9c44be582f895eaea3d3738c5b4", "f541b9844be897f895eaea3d3738cfb2"],<br/>"INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE": "rule match_everything {condition:true}"<br/>}. | Optional |
| start_date | Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.<br/><br/>Examples of more supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates. | Optional |
| end_date | Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.<br/><br/>Examples of more supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates. | Optional |
| max_snapshots_per_object | Maximum number of snapshots to scan per object. | Optional |
| max_file_size | Maximum size of the file in bytes that will be included in the scan. The maximum allowed size is 15000000 bytes. Default is 5000000. | Optional |
| snapshot_id | Provide comma separated snapshot IDs on which to perform a scan separated by colon for each object ID (in the same order). Supports comma separated values.<br/><br/>Format accepted:<br/>object_1_snapshot_id_1, object_1_snapshot_id_2: object_2_snapshot_id_1<br/><br/>Example:<br/>B405e8c0-1fcd-401c-a6f6-42f758aad6df, e179eb47-534b-4624-b155-f33d188902e2: 1e1681bf-4479-4339-a4bb-59901598caa5<br/><br/>Note: Users can retrieve the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command.<br/><br/>Note: Do not provide "snapshot_start_date", "snapshot_end_date" and, "max_snapshots_per_object" arguments if snapshot ID is provided. | Optional |
| paths_to_include | Paths to include in the scan. Supports comma separated values.<br/><br/>Format accepted:<br/>path_to_include_1, path_to_include_2. | Optional |
| paths_to_exclude | Paths to exclude from the scan. Supports comma separated values.<br/><br/>Format accepted:<br/>path_to_exclude_1, path_to_exclude_2. | Optional |
| paths_to_exempt | Paths to exempt from exclusion. Supports comma separated values.<br/><br/>Format accepted:<br/>path_to_exempt_1, path_to_exempt_2. | Optional |
| requested_hash_types | The type of hash values of the matched files to return in the result. Supports comma separated values.<br/><br/>Possible values are: "HASH_TYPE_M_D5", "HASH_TYPE_SH_A1", "HASH_TYPE_SH_A256". | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.RadarIOCScan.id | String | ID of the IOC scan. |
| RubrikPolaris.RadarIOCScan.status | String | Status of the IOC scan trigger request. |

#### Command Example

```!rubrik-radar-ioc-scan scan_name="Revil Ransomware Scan" ioc_type="INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME" ioc_value="revil.exe" cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43" object_id="868aa03d-4145-4cb1-808b-e10c4f7a3741"```

#### Human Readable Output

### Radar IOC Scan

|Scan ID|Status|
|---|---|
| dummy-ioc-id | RUNNING |

### rubrik-radar-ioc-scan-results

***
Retrieves the results of IOC scan of a system.

Note: To initiate a scan use the "rubrik-radar-ioc-scan" command and to list the running/completed scans on a cluster use the "rubrik-radar-ioc-scan-list" command.

#### Base Command

`rubrik-radar-ioc-scan-results`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| scan_id | ID of the IOC scan whose results are to be retrieved.<br/><br/>Note: Users can get the scan ID by executing the "rubrik-radar-ioc-scan" command. | Required |
| cluster_id | ID of the cluster on which the scan was performed.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.RadarIOCScan.id | String | ID of the IOC scan. |
| RubrikPolaris.RadarIOCScan.status | String | Overall status of the scan. |
| RubrikPolaris.RadarIOCScan.indicatorsOfCompromise.iocType | String | Type of IOC that was scanned. |
| RubrikPolaris.RadarIOCScan.indicatorsOfCompromise.iocValue | String | Value of the IOC that was scanned. |
| RubrikPolaris.RadarIOCScan.results.objectId | String | ID of the system that was scanned. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.status | String | Status of the scan on the snapshot. Values: MALWARE_SCAN_IN_SNAPSHOT_STATUS_PENDING, MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED, MALWARE_SCAN_IN_SNAPSHOT_STATUS_ERROR. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.snapshotDate | String | The date-time at which the snapshot was taken. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.snapshotId | String | ID of the snapshot that was scanned. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.numFiles | Number | Number of files encountered during scan. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.numFilesScanned | Number | Number of files that were scanned on that snapshot. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.totalFilesScannedSizeBytes | Number | The total file size of the files scanned. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.indicatorIndex | Number | Index of indicator in inputs for the scan. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.aclDetails | String | JSON encoded file access control list \(ACL\) information. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.creationTime | String | File creation date-time. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.modificationTime | String | File modification date-time. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.path | String | File path that matched the malware Indicator Of Compromise. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.yaraMatchDetails.name | String | The name of the matching YARA rule. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.yaraMatchDetails.tags | Unknown | Optional YARA tags. Described in https://yara.readthedocs.io/en/latest/writingrules.html\#rule-tags. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.requestedHashDetails.hashType | String | Hash algorithm type. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.requestedHashDetails.hashValue | String | Hash value of the content at path. |

#### Command Example

```!rubrik-radar-ioc-scan-results scan_id="bf687fcf-84d7-47f6-8bd1-54e8cf439680" cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43"```

#### Human Readable Output

### Radar IOC Scan Results

Scan ID: bf687fcf-84d7-47f6-8bd1-54e8cf439680
Status: FINISHED

|Snapshot ID|Snapshot Date|Object ID|Snapshot Scan Status|Scan Statistics|Matches|
|---|---|---|---|---|---|
| b7d6b871-796e-4e7c-99cf-328007c9d5c1 | 2021-10-29T07:03:30.669Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-81407 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142630, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| 3779a895-94bf-437e-b63a-61e73e215901 | 2021-10-28T07:00:09.297Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-81407 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142630, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| a871683f-f4fa-475f-806c-58f06e6782dc | 2021-10-26T07:04:07.139Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-81407 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142630, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| 129f22f4-0359-4e7d-aa53-9edf4e33cff1 | 2021-10-29T12:01:43.383Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72277 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142138, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| b9264942-c71c-4b91-b9a7-74a7ba0f6166 | 2021-10-29T08:01:39.388Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72277 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142138, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| 9f12b533-b740-4fb9-af94-4411b0aee01d | 2021-10-29T00:01:04.357Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72277 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142139, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |

### rubrik-gps-async-result

***
Retrieve the result of an asynchronous request. This command will retrieve the result of requests made by commands "rubrik-gps-snapshot-files-download", "rubrik-gps-vm-livemount", "rubrik-gps-vm-export", "rubrik-gps-vm-snapshot-create", and "rubrik-gps-vm-recover-files".

#### Base Command

`rubrik-gps-async-result`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| request_id | ID of the request.<br/><br/>Note: Users can get the request ID by executing any of the commands that make a request. Possible commands are mentioned in the command description. | Required |
| cluster_id | ID of the cluster on which request was made.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |
| cluster_ip_address | IP address of the cluster node to access the download link. Only required to retrieve the results of the command "rubrik-gps-snapshot-files-download".<br/><br/>Note: Users can retrieve the list of the IP addresses by executing the "rubrik-gps-cluster-list" command. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSAsyncResult.id | String | The ID of the request. |
| RubrikPolaris.GPSAsyncResult.status | String | Status of the request. |
| RubrikPolaris.GPSAsyncResult.nodeId | String | ID of the node. |
| RubrikPolaris.GPSAsyncResult.progress | Number | Progress of the request in range 0 to 100. |
| RubrikPolaris.GPSAsyncResult.error.message | String | JSON stringified message object when an error occurs. |
| RubrikPolaris.GPSAsyncResult.links.href | String | Link to a resource. |
| RubrikPolaris.GPSAsyncResult.links.rel | String | Type of the resource pointed by the link. |

#### Command Example

```!rubrik-gps-async-result request_id="EXPORT_VMWARE_SNAPSHOT_6e101218-141f-4101-b334-3c1bf440bfee_466b7d74-0d13-4e54-9a57-2ea4d7b00a0c:::0" cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43"```

#### Human Readable Output

### GPS Asynchronous Request Result

|ID|Status|Node ID|Links|
|---|---|---|---|
| dummy_id | FAILED | cluster:::RVMHM219S004941 | [self](https://www.example.com/)<br/> |

### rubrik-gps-cluster-list

***
Retrieve the list of the available rubrik clusters.

#### Base Command

`rubrik-gps-cluster-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| type | Filter out clusters based on their type. Supports comma separated values.<br/><br/>Possible values are: "Cloud", "Robo", "ExoCompute", "OnPrem", "Polaris", "Unknown". | Optional |
| name | Filter out clusters based on name. Supports comma separated values. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Possible values are: "ClusterName", "ClusterType", "RegisteredAt", "ESTIMATED_RUNWAY". Default is ClusterName. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "Asc", "Desc". Default is Asc. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSCluster.id | String | ID of the cluster. |
| RubrikPolaris.GPSCluster.name | String | Name of the cluster. |
| RubrikPolaris.GPSCluster.type | String | Type of the cluster. Values are Cloud, Robo, ExoCompute, OnPrem, Unknown, Polaris. |
| RubrikPolaris.GPSCluster.status | String | Status of the cluster. Values are Connected, Disconnected, Initializing. |
| RubrikPolaris.GPSCluster.version | String | Version of the cluster. |
| RubrikPolaris.GPSCluster.defaultAddress | String | Default address assigned to the cluster. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.clusterStatus.message | String | Message about the cluster upgrade/current condition. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.clusterStatus.status | String | Upgrade/current status of the cluster. It provides information like -- upgrading, upgrade scheduled, stable, downloading packages, pre-checks running and many more. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.overallProgress | Number | Progress \(in percentage\) of an upgrade, if running. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.scheduleUpgradeAt | String | Shows the date-time of a scheduled upgrade. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.downloadedVersion | String | The version that was downloaded but not yet installed. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.version | String | The current version of the cluster. |
| RubrikPolaris.GPSCluster.productType | String | The product type. Values are CDM, DATOS, POLARIS. |
| RubrikPolaris.GPSCluster.estimatedRunway | Number | Estimated number of days remaining before additional data storage space is required on the cluster. |
| RubrikPolaris.GPSCluster.snapshotCount | Number | The total number of snapshots that are taken of different objects in the cluster. |
| RubrikPolaris.GPSCluster.geoLocation.address | String | Geological address of the cluster. |
| RubrikPolaris.GPSCluster.lastConnectionTime | String | Time when the cluster was last polled. |
| RubrikPolaris.GPSCluster.metric.totalCapacity | Number | Total storage capacity of the cluster in Bytes. |
| RubrikPolaris.GPSCluster.metric.availableCapacity | Number | Available storage capacity of the cluster in Bytes. |
| RubrikPolaris.GPSCluster.snappableConnection.count | Number | The number of objects in the cluster whose snapshots can be taken. |
| RubrikPolaris.GPSCluster.state.connectedState | String | Status of the cluster. Values are Connected, Disconnected, Initializing. |
| RubrikPolaris.GPSCluster.state.clusterRemovalState | String | State of the cluster when it is being removed from the platform. Values are DATA_DELETING, WAITING_FOR_DATA_DELETION, UNREGISTERED, FAILED, DISCONNECTING, REGISTERED. |
| RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.id | String | ID of a node in a cluster. |
| RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.status | String | Status of a node in a cluster. |
| RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.ipAddress | String | IP Address of a node in a cluster. |
| RubrikPolaris.GPSCluster.passesConnectivityCheck | Boolean | Whether the cluster passes the connectivity check. |
| RubrikPolaris.GPSCluster.globalManagerConnectivityStatus.urls.url | String | URL of a global manager of the cluster. |
| RubrikPolaris.GPSCluster.globalManagerConnectivityStatus.urls.isReachable | Boolean | Whether the global manager is reachable. |
| RubrikPolaris.GPSCluster.connectivityLastUpdated | String | The date-time of when the cluster was last polled for connectivity. |
| RubrikPolaris.GPSCluster.lambdaFeatureHistory.wasRadarEverEnabled | Boolean | Whether Polaris Radar was ever enabled on the cluster. |
| RubrikPolaris.GPSCluster.lambdaFeatureHistory.wasSonarEverEnabled | Boolean | Whether Polaris Sonar was ever enabled on the cluster. |

#### Command Example

```!rubrik-gps-cluster-list name="sand1"```

#### Human Readable Output

### GPS Clusters

|Cluster ID|Cluster Name|Connection Status|Cluster Location|Total Capacity|Free Space|Protected Objects|Cluster Version|IP Address|
|---|---|---|---|---|---|---|---|---|
| cc19573c-db6c-418a-9d48-067a256543ba | sand1-rbk01 | Connected | San Francisco, CA, USA | 52.605821063168 TB | 45.484602130432 TB | 205 | 7.0.0-EA1-14307 | X.X.X.X, X.X.X.X |

### rubrik-radar-ioc-scan-list

***
Lists the running/completed IOC scans on a cluster.

Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command. To initiate a scan use the "rubrik-radar-ioc-scan" command.

#### Base Command

`rubrik-radar-ioc-scan-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| cluster_id | ID of the cluster whose IOC scans are to be listed.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.RadarIOCScan.id | String | ID of the IOC scan. |
| RubrikPolaris.RadarIOCScan.startTime | String | Start time of the scan. |
| RubrikPolaris.RadarIOCScan.endTime | String | End time of the scan. |
| RubrikPolaris.RadarIOCScan.snapshots.id | String | Object ID of the system. |
| RubrikPolaris.RadarIOCScan.snapshots.snapshots | Unknown | List of snapshot IDs that are included in the scan. |

#### Command Example

```!rubrik-radar-ioc-scan-list cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43"```

#### Human Readable Output

### Radar IOC Scans

|Scan ID|Start Time|End Time|Scanned Objects|
|---|---|---|---|
| fcac511b-20b4-472d-9b65-9198cff8cd49 | 2021-10-12T04:52:08.777Z | Not Finished | VirtualMachine:::90da5ffb-432f-4dac-8c73-39260ff5493e-vm-5952003d-f95c-4ae0-bf9b-b5a80b210935 |
| ad435ff1-617b-468a-b5d3-736fa0e278b0 | 2021-10-28T06:05:53.059Z | 2021-10-28T07:16:16.715Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72277, VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72279 |

### rubrik-gps-vm-recover-files

***
Recovers files from a snapshot backup, back into a system.

Note: To know about the recovery status, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-vm-recover-files`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| cluster_id | ID of the cluster where the snapshot resides.<br/><br/>Note: Users can get the cluster ID by executing the "rubrik-gps-cluster-list" command. | Required |
| snapshot_id | ID of the snapshot from which to recover files.<br/><br/>Note: Users can get the snapshot ID by executing the "rubrik-polaris-vm-object-snapshot-list" command. | Required |
| paths_to_recover | Comma separated paths of files and directories that will be recovered from the snapshot.<br/><br/>Note: Users can get the list of paths in a snapshot by executing the "rubrik-gps-snapshot-files-list" command. | Required |
| restore_path | Path on the destination object on which recovery will be done. | Required |
| destination_object_id | ID of the object where the files will be restored into. If not provided, Rubrik will use the snapshots object.<br/><br/>Note: Users can get the object ID by executing the "rubrik-polaris-vm-objects-list" command. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMRecoverFiles.id | String | Recover files request ID. |

#### Command Example

```!rubrik-gps-vm-recover-files cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43" snapshot_id="e2a0ffa8-82a3-518b-8532-0608a0e7380f" path_to_recover="/bin,/boot" restore_path="/tmp/backup1"```

#### Human Readable Output

### GPS VM Recover Files

|Recover Files Request ID|
|---|
| dummy_id |

### rubrik-sonar-user-access-list

***
Retrieve the user access information.

#### Base Command

`rubrik-sonar-user-access-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| user_name | The name of the user to search for. | Optional |
| user_email | The email or the UPN of the user to search for. | Optional |
| search_time_period | Specify the search time period to look for user access.<br/><br/>Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.<br/><br/>For example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z. Default is 7 days. | Optional |
| risk_levels | The comma-separated list of risk levels.<br/><br/>Supported values are: UNKNOWN_RISK, HIGH_RISK, MEDIUM_RISK, LOW_RISK, NO_RISK.<br/><br/>Note: For any other values, whether the obtained result is filtered or not, is not confirmed. | Optional |
| group_id | Specify the group ID to filter with. | Optional |
| include_whitelisted_results | The boolean indicates to include the whitelisted results.<br/><br/>Possible values are: "True", "False". Default is False. | Optional |
| principal_summary_category | Specify the principal summary category to filter with.<br/><br/>Supported values are: PRINCIPAL_SUMMARY_CATEGORY_UNSPECIFIED, USERS_WITH_SENSITIVE_ACCESS, NEW_USERS_WITH_SENSITIVE_ACCESS, USERS_WITH_RISK_LEVEL_INCREASE. Default is USERS_WITH_SENSITIVE_ACCESS.<br/><br/>Note: For any other values, whether the obtained result is filtered or not, is not confirmed. | Optional |
| limit | Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50. | Optional |
| page_number | Specify the page number to get the particular page of results in the response. Default is 1.<br/><br/>Note: This argument is only applicable when provided with the "user_email" argument. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Supported values are: RISK_LEVEL, RISK_SENSITIVE_FILES, RISK_SENSITIVE_HITS, TOTAL_SENSITIVE_HITS, TOTAL_SENSITIVE_FILES, SID, TOTAL_SENSITIVE_OBJECTS. Default is RISK_LEVEL.<br/><br/>Note: For any other values, whether the obtained result is filtered or not, is not confirmed. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is DESC. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.UserAccess.principalId | String | The ID of the user. |
| RubrikPolaris.UserAccess.fullName | String | The full name of the user. |
| RubrikPolaris.UserAccess.upn | String | The user principal name. |
| RubrikPolaris.UserAccess.riskLevel | String | The risk level of the user. |
| RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.totalCount | Number | The total number of high-risk files. |
| RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.violatedCount | Number | The number of high-risk files that violate policies. |
| RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.__typename | String | The high-risk file count field type. |
| RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.totalCount | Number | Total number of medium-risk files. |
| RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.violatedCount | Number | The number of medium-risk files that violate policies. |
| RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.__typename | String | The type of the medium risk file count field. |
| RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.totalCount | Number | The total number of low-risk files. |
| RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.violatedCount | Number | The number of low-risk files that violate policies. |
| RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.__typename | String | The type of the low-risk file count field. |
| RubrikPolaris.UserAccess.sensitiveFiles.__typename | String | The type of the sensitive files field. |
| RubrikPolaris.UserAccess.totalSensitiveHits.totalHits | Number | The total number of sensitive hits. |
| RubrikPolaris.UserAccess.totalSensitiveHits.violatedHits | Number | The number of sensitive hits that violate policies. |
| RubrikPolaris.UserAccess.totalSensitiveHits.__typename | String | The type of the total sensitive hits field. |
| RubrikPolaris.UserAccess.sensitiveObjectCount.totalCount | Number | The total number of sensitive objects. |
| RubrikPolaris.UserAccess.sensitiveObjectCount.violatedCount | Number | The Number of sensitive objects that violate policies. |
| RubrikPolaris.UserAccess.sensitiveObjectCount.__typename | String | The type of the sensitive object count field. |
| RubrikPolaris.UserAccess.numDescendants | Number | The number of descendant users associated with this user. |
| RubrikPolaris.UserAccess.domainName | String | The domain name associated with this user. |
| RubrikPolaris.UserAccess.__typename | String | The type of the User Access field. |
| RubrikPolaris.PageToken.UserAccess.name | String | Name of the command. |
| RubrikPolaris.PageToken.UserAccess.startCursor | String | The start cursor for the current page. |
| RubrikPolaris.PageToken.UserAccess.endCursor | String | The end cursor for the current page. |
| RubrikPolaris.PageToken.UserAccess.hasNextPage | Boolean | Whether the result has the next page or not. |
| RubrikPolaris.PageToken.UserAccess.hasPreviousPage | Boolean | Whether the result has the previous page or not. |
| RubrikPolaris.PageToken.UserAccess.next_upn_page_number | String | The next UPN page number. |
| RubrikPolaris.PageToken.UserAccess.has_next_upn_page | Boolean | Whether the result has the next UPN page or not. |

#### Command example

```!rubrik-sonar-user-access-list user_name="Demo Rubrik" user_email="demo@rubrik.com" limit="1"```

#### Context Example

```json
{
    "RubrikPolaris": {
        "PageToken": {
            "UserAccess": {
                "endCursor": "cursor_1",
                "hasNextPage": false,
                "hasPreviousPage": false,
                "has_next_upn_page": false,
                "name": "rubrik-sonar-user-access-list",
                "next_upn_page_number": 1,
                "startCursor": "cursor_1"
            }
        },
        "UserAccess": {
            "__typename": "PrincipalSummary",
            "domainName": "rubrik.com",
            "fullName": "Demo Rubrik",
            "numDescendants": 0,
            "principalId": "S-1-0-01-0000000000-0000000000-000000000-0001",
            "riskLevel": "HIGH_RISK",
            "sensitiveFiles": {
                "__typename": "SensitiveFiles",
                "highRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 124
                },
                "lowRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 0
                },
                "mediumRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 0
                }
            },
            "sensitiveObjectCount": {
                "__typename": "SummaryCount",
                "totalCount": 0,
                "violatedCount": 1
            },
            "totalSensitiveHits": {
                "__typename": "SummaryHits",
                "totalHits": 0,
                "violatedHits": 86972
            },
            "upn": "demo@rubrik.com"
        }
    }
}

Human Readable Output

User Access (Showing Records 1-1 out of 1)

User ID User Full Name User Principal Name Risk Level Total Sensitive Objects Total Sensitive Files Total Sensitive Hits
S-1-0-01-0000000000-0000000000-000000000-0001 Demo Rubrik demo@rubrik.com HIGH_RISK 1 124 86972

Note: To retrieve the next set of results, use next_page_token = “cursor_2”.

If next_page_token is provided, then it will reset the record numbers. For the initial use of next_page_token, please avoid specifying the page_number.

rubrik-sonar-user-access-get

Retrieve the user access information based on the provided user ID.

Base Command

rubrik-sonar-user-access-get

Input

Argument Name Description Required
user_id Specify the user_id to retrieve the user access information.

Note: Users can get the list of the user IDs by executing the “rubrik-sonar-user-access-list” command.		 Required
search_time_period Specify the search time period to look for user access. Default is 7 days.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z.		 Optional
historical_delta_days Specify the number of days in the past to collect delta for the sensitive hits. Default is 7. Optional
include_whitelisted_results The boolean indicates to include the whitelisted results. Default is False.

Possible values are: “True”, “False”.		 Optional

Context Output

Path Type Description
RubrikPolaris.UserAccess.principalId String The ID of the user.
RubrikPolaris.UserAccess.fullName String The full name of the user.
RubrikPolaris.UserAccess.upn String The user principal name.
RubrikPolaris.UserAccess.riskLevel String The risk level of the user.
RubrikPolaris.UserAccess.policy_hits_summary.__typename String The type of object representing the policy hits summary.
RubrikPolaris.UserAccess.policy_hits_summary.policyId String The unique identifier of the policy associated with the hits summary.
RubrikPolaris.UserAccess.policy_hits_summary.policyName String The human-readable name of the policy associated with the hits summary.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.__typename String The type of object representing the analyzer hits for a specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.__typename String The type of object representing high-risk hits for the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.totalHits Number The total number of high-risk hits detected by the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.violatedHits Number The number of high-risk hits that violated security policies.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.__typename String The type of object representing low-risk hits for the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.totalHits Number The total number of low-risk hits detected by the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.violatedHits Number The number of low-risk hits that violated security policies.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.__typename String The type of object representing medium-risk hits for the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.totalHits Number The total number of medium-risk hits detected by the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.violatedHits Number The number of medium-risk hits that violated security policies.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.__typename String The type of object representing the total number of hits for the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.totalHits Number The total number of hits detected by the analyzer (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.violatedHits Number The number of hits detected by the analyzer that violated security policies (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.__typename String The type of object representing the difference in analyzer hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.__typename String The type of object representing the difference in high-risk hits for the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.totalHits Number The difference in the total number of high-risk hits detected by the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.violatedHits Number The difference in the number of high-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.__typename String The type of object representing the difference in low-risk hits for the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.totalHits Number The difference in the total number of low-risk hits detected by the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.violatedHits Number The difference in the number of low-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.__typename String The type of object representing the difference in medium-risk hits for the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.totalHits Number The difference in the total number of medium-risk hits detected by the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.violatedHits Number The difference in the number of medium-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.__typename String The type of object representing the total difference in hits for the analyzer between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.totalHits Number The total difference in the number of hits detected by the analyzer between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.violatedHits Number The difference in the number of hits detected by the analyzer that violated security policies between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.__typename String The type of object representing the difference in risk hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.__typename String The type of object representing the difference in high-risk hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.totalHits Number The difference in the total number of high-risk hits detected between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.violatedHits Number The difference in the number of high-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.__typename String The type of object representing the difference in low-risk hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.totalHits Number The difference in the total number of low-risk hits detected between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.violatedHits Number The difference in the number of low-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.__typename String The type of object representing the difference in medium-risk hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.totalHits Number The difference in the total number of medium-risk hits detected between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.violatedHits Number The difference in the number of medium-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.__typename String The type of object representing the total difference in risk hits between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.totalHits Number The total difference in the number of risk hits detected between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.violatedHits Number The difference in the number of risk hits detected that violated security policies between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.__typename String The type of object representing the risk hits for a specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.__typename String The type of object representing high-risk hits for the risk engine.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.totalHits Number The total number of high-risk hits detected by the risk engine for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.violatedHits Number The number of high-risk hits that violated security policies for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.__typename String The type of object representing low-risk hits for the risk engine.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.totalHits Number The total number of low-risk hits detected by the risk engine for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.violatedHits Number The number of low-risk hits that violated security policies for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.__typename String The type of object representing medium-risk hits for the risk engine.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.totalHits Number The total number of medium-risk hits detected by the risk engine for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.violatedHits Number The number of medium-risk hits that violated security policies for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.__typename String The type of object representing the total number of risk hits for the specific SID (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.totalHits Number The total number of risk hits detected by the risk engine for the specific SID (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.violatedHits Number The number of risk hits detected by the risk engine that violated security policies for the specific SID (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.__typename String The type of object representing the sensitive files associated with the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.__typename String The type of object representing the total number of sensitive files associated with the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.totalCount Number The total number of sensitive files associated with the specific SID, including both compliant and non-compliant files.
RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.violatedCount Number The number of sensitive files associated with the specific SID that violate security policies.
RubrikPolaris.UserAccess.riskReasons.accessRiskReasons Unknown The reasons why the user’s access is considered risky.
RubrikPolaris.UserAccess.riskReasons.insecureReasons Unknown The reasons why the user’s access is considered insecure.
RubrikPolaris.UserAccess.riskReasons.__typename String The type of the risk reasons field.
RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.totalCount Number The total number of high-risk files.
RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.violatedCount Number The number of high-risk files that violate policies.
RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.__typename String The high-risk file count field type.
RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.totalCount Number Total number of medium-risk files.
RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.violatedCount Number The number of medium-risk files that violate policies.
RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.__typename String The type of the medium risk file count field.
RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.totalCount Number The total number of low-risk files.
RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.violatedCount Number The number of low-risk files that violate policies.
RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.__typename String The type of the low-risk file count field.
RubrikPolaris.UserAccess.sensitiveFiles.__typename String The type of the sensitive files field.
RubrikPolaris.UserAccess.totalSensitiveHits.totalHits Number The total number of sensitive hits.
RubrikPolaris.UserAccess.totalSensitiveHits.violatedHits Number The number of sensitive hits that violate policies.
RubrikPolaris.UserAccess.totalSensitiveHits.__typename String The type of the total sensitive hits field.
RubrikPolaris.UserAccess.sensitiveObjectCount.totalCount Number The total number of sensitive objects.
RubrikPolaris.UserAccess.sensitiveObjectCount.violatedCount Number The Number of sensitive objects that violate policies.
RubrikPolaris.UserAccess.sensitiveObjectCount.__typename String The type of the sensitive object count field.
RubrikPolaris.UserAccess.numDescendants Number The number of descendant users associated with this user.
RubrikPolaris.UserAccess.domainName String The domain name associated with this user.
RubrikPolaris.UserAccess.directGroups.name String The name of the direct group.
RubrikPolaris.UserAccess.directGroups.sid String The security identifier (SID) of the direct group.
RubrikPolaris.UserAccess.directGroups.__typename String The type of the direct groups field.
RubrikPolaris.UserAccess.__typename String The type of the User Access field.

Command example

!rubrik-sonar-user-access-get user_id="S-1-0-01-0000000000-0000000000-000000000-0001"

Context Example

{
    "RubrikPolaris": {
        "UserAccess": {
            "__typename": "PrincipalSummary",
            "directGroups": [
                {
                    "__typename": "UserAccessGroup",
                    "name": "Domain Admins",
                    "sid": "S-1-0-01-0000000000-0000000000-000000000-002"
                },
                {
                    "__typename": "UserAccessGroup",
                    "name": "Domain Users",
                    "sid": "S-1-0-01-0000000000-0000000000-000000000-003"
                }
            ],
            "domainName": "rubrik.com",
            "fullName": "DemoRubrik",
            "numDescendants": 0,
            "principalId": "S-1-0-01-0000000000-0000000000-000000000-0001",
            "riskLevel": "HIGH_RISK",
            "policy_hits_summary": [
                {
                    "policyId": "00000000-0000-0000-0000-000000000001",
                    "policyName": "Policy 1",
                    "sidSensitiveFiles": {
                        "totalFileCount": {
                            "totalCount": 164,
                            "violatedCount": 164,
                            "__typename": "SummaryCount"
                        },
                        "__typename": "SensitiveFiles"
                    },
                    "sidAnalyzerHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 138118,
                            "violatedHits": 138118,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 138118,
                            "violatedHits": 138118,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidDeltaAnalyzerHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidRiskHits": {
                        "highRiskHits": {
                            "totalHits": 138118,
                            "violatedHits": 138118,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 138118,
                            "violatedHits": 138118,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidDeltaRiskHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "__typename": "PolicyHitsSummary"
                },
                {
                    "policyId": "00000000-0000-0000-0000-000000000002",
                    "policyName": "Policy 2",
                    "sidSensitiveFiles": {
                        "totalFileCount": {
                            "totalCount": 130,
                            "violatedCount": 130,
                            "__typename": "SummaryCount"
                        },
                        "__typename": "SensitiveFiles"
                    },
                    "sidAnalyzerHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 101434,
                            "violatedHits": 101434,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 101434,
                            "violatedHits": 101434,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidDeltaAnalyzerHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidRiskHits": {
                        "highRiskHits": {
                            "totalHits": 101434,
                            "violatedHits": 101434,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 101434,
                            "violatedHits": 101434,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidDeltaRiskHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "__typename": "PolicyHitsSummary"
                }
            ],
            "riskReasons": {
                "__typename": "PrincipalRiskReasons",
                "accessRiskReasons": [
                    "MEDIUM_RISK_ANALYZER_HITS",
                    "OPEN_ACCESS"
                ],
                "insecureReasons": [
                    "PASSWORD_NEVER_EXPIRES"
                ]
            },
            "sensitiveFiles": {
                "__typename": "SensitiveFiles",
                "highRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 250
                },
                "lowRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 0
                },
                "mediumRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 0
                }
            },
            "sensitiveObjectCount": {
                "__typename": "SummaryCount",
                "totalCount": 0,
                "violatedCount": 2
            },
            "totalSensitiveHits": {
                "__typename": "SummaryHits",
                "totalHits": 0,
                "violatedHits": 173954
            },
            "upn": "demo@rubrik.com"
        }
    }
}

Human Readable Output

User Access

User ID User Full Name User Principal Name Risk Level Access Risk Reason(s) Insecure Reason(s) Groups Total Sensitive Objects Total Sensitive Files Total Sensitive Hits
S-1-0-01-0000000000-0000000000-000000000-0001 DemoRubrik demo@rubrik.com HIGH_RISK MEDIUM_RISK_ANALYZER_HITS, OPEN_ACCESS PASSWORD_NEVER_EXPIRES Domain Admins, Domain Users 2 250 173954

Sensitive Hits

Policy Name Total Sensitive Files Total Sensitive Hits Sensitive Hits Delta High Risk Hits Medium Risk Hits Low Risk Hits
Policy 1 164 138118 0 0 138118 0
Policy 2 130 101434 0 0 101434 0

rubrik-sonar-file-context-list

Retrieve the context of the file, folder, or file share for the provided object and the file details.

Base Command

rubrik-sonar-file-context-list

Input

Argument Name Description Required
object_id The Object ID or the Snappable ID.

Note: Users can get the list of the object IDs by executing the “rubrik-polaris-object-list” command.		 Required
snapshot_id The Snapshot ID of the object.

Note: Users can get the list of the snapshot IDs by executing the “rubrik-polaris-object-snapshot-list” command.		 Required
file_name Specify the name of the file, folder, or file share object. Optional
file_path Specify the standard file path to filter with. Optional
user_id Specify the user ID to filter with.

Note: Users can get the list of the user IDs by executing the “rubrik-sonar-user-access-list” command.		 Optional
include_whitelisted_results The boolean indicates to include the whitelisted results.

Possible values are: “True”, “False”. Default is False.		 Optional
limit Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50. Optional
sort_by Specify the field to use for sorting the response.

Supported values are: HITS, NAME, DAILY_CHANGE, LAST_ACCESS_TIME, OPEN_ACCESS_TYPE, FILES_WITH_HITS, FILES_WITH_OPEN_ACCESS_HITS, STALE_FILES_WITH_HITS, CLUSTER, OBJECT_NAME, OBJECT_LOCATION, SNAPSHOT_TIME, NUM_ACTIVITIES, NUM_ACTIVITIES_DELTA, NATIVE_PATH. Default is HITS.

Note: For any other values, whether the obtained result is filtered or not, is not confirmed.		 Optional
sort_order Specify the order to sort the data in.

Possible values are: “ASC”, “DESC”. Default is DESC.		 Optional
next_page_token The next page cursor to retrieve the next set of results. Optional

Context Output

Path Type Description
RubrikPolaris.FileContext.nativePath String The native path of the file.
RubrikPolaris.FileContext.stdPath String The standardized path of the file.
RubrikPolaris.FileContext.filename String The filename.
RubrikPolaris.FileContext.mode String The file mode.
RubrikPolaris.FileContext.size Number The file size in bytes.
RubrikPolaris.FileContext.lastAccessTime Number The last access time of the file in milliseconds since the epoch.
RubrikPolaris.FileContext.lastModifiedTime Number The last modified time of the file in milliseconds since the epoch.
RubrikPolaris.FileContext.creationTime Number The creation time of the file in milliseconds since the epoch.
RubrikPolaris.FileContext.lastScanTime Number The last scan time of the file in milliseconds since the epoch.
RubrikPolaris.FileContext.directory String The value of Directory.
RubrikPolaris.FileContext.createdBy String The user who created the file.
RubrikPolaris.FileContext.modifiedBy String The user who last modified the file.
RubrikPolaris.FileContext.numDescendantFiles Number The number of descendant files of the file.
RubrikPolaris.FileContext.numDescendantErrorFiles Number The number of descendant files of the file that could not be processed.
RubrikPolaris.FileContext.numDescendantSkippedExtFiles Number The number of descendant files of the file that were skipped because of their file extension.
RubrikPolaris.FileContext.numDescendantSkippedSizeFiles Number The number of descendant files of the file that were skipped because of their file size.
RubrikPolaris.FileContext.errorCode String The error code, if any, for the file.
RubrikPolaris.FileContext.hits.totalHits Number The total number of hits for the file.
RubrikPolaris.FileContext.hits.violations Number The number of violations for the file.
RubrikPolaris.FileContext.hits.violationsDelta Number The change in the number of violations for the file since the last scan.
RubrikPolaris.FileContext.hits.totalHitsDelta Number The change in the total number of hits for the file since the last scan.
RubrikPolaris.FileContext.hits.__typename String The type of the hits field.
RubrikPolaris.FileContext.filesWithHits.totalHits Number The total number of files with hits.
RubrikPolaris.FileContext.filesWithHits.violations Number The number of files with violations.
RubrikPolaris.FileContext.filesWithHits.__typename String The type of the files with hits field.
RubrikPolaris.FileContext.openAccessFilesWithHits.totalHits Number The total number of open access files with hits.
RubrikPolaris.FileContext.openAccessFilesWithHits.violations Number The number of open access files with violations.
RubrikPolaris.FileContext.openAccessFilesWithHits.__typename String The type of the open access files with hits field.
RubrikPolaris.FileContext.staleFilesWithHits.totalHits Number The total number of stale files with hits.
RubrikPolaris.FileContext.staleFilesWithHits.violations Number The number of stale files with violations.
RubrikPolaris.FileContext.staleFilesWithHits.__typename String The type of the stale files with hits field.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.groupType String The type of the analyzer group.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.id String The ID of the analyzer group.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.name String The name of the analyzer group.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.__typename String The type of the analyzer group field.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.totalHits Number The total number of hits for the analyzer results.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.violations Number The number of violations for the analyzer results.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.__typename String The type of the hits field.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.id String The ID of the analyzer.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.name String The name of the analyzer.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.analyzerType String The type of the analyzer.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.__typename String The type of the analyzer field.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.__typename String The type of the analyzer results field.
RubrikPolaris.FileContext.analyzerGroupResults.hits.totalHits Number The total number of hits for the analyzer group results.
RubrikPolaris.FileContext.analyzerGroupResults.hits.violations Number The number of violations for the analyzer group results.
RubrikPolaris.FileContext.analyzerGroupResults.hits.violationsDelta Number The change in the number of violations for the analyzer group results since the last scan.
RubrikPolaris.FileContext.analyzerGroupResults.hits.totalHitsDelta Number The change in the total number of hits for the analyzer group results since the last scan.
RubrikPolaris.FileContext.analyzerGroupResults.hits.__typename String The type of the hits field.
RubrikPolaris.FileContext.analyzerGroupResults.__typename String The type of the analyzer group results field.
RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.totalCount Number The total number of high-risk files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.violatedCount Number The number of high-risk files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.__typename String The type of the high-risk file count field.
RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.totalCount Number The total number of medium-risk files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.violatedCount Number The number of medium-risk files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.__typename String The type of the medium risk file count field.
RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.totalCount Number The total number of low-risk files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.violatedCount Number The number of low-risk files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.__typename String The type of the low-risk file count field.
RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.totalCount Number The total number of no-risk files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.violatedCount Number The number of no-risk files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.__typename String The type of the no-risk file count field.
RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.totalCount Number The total number of files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.violatedCount Number The number of files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.__typename String The type of the total file count field.
RubrikPolaris.FileContext.sensitiveFiles.__typename String The type of the sensitive files field.
RubrikPolaris.FileContext.sensitiveHits.highRiskHits.totalHits Number The total number of high-risk sensitive hits for the file.
RubrikPolaris.FileContext.sensitiveHits.highRiskHits.violatedHits Number The number of high-risk sensitive hits for the file that violates policies.
RubrikPolaris.FileContext.sensitiveHits.highRiskHits.__typename String The type of the high-risk hits field.
RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.totalHits Number The total number of medium-risk sensitive hits for the file.
RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.violatedHits Number The number of medium-risk sensitive hits for the file that violates policies.
RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.__typename String The type of the medium-risk hits field.
RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.totalHits Number The total number of low-risk sensitive hits for the file.
RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.violatedHits Number The number of low-risk sensitive hits for the file that violates policies.
RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.__typename String The type of the low-risk hits field.
RubrikPolaris.FileContext.sensitiveHits.noRiskHits.totalHits Number The total number of no-risk sensitive hits for the file.
RubrikPolaris.FileContext.sensitiveHits.noRiskHits.violatedHits Number The number of no-risk sensitive hits for the file that violates policies.
RubrikPolaris.FileContext.sensitiveHits.noRiskHits.__typename String The type of the no-risk hits field.
RubrikPolaris.FileContext.sensitiveHits.__typename String The type of the sensitive hits field.
RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.totalHits Number The total number of high-risk analyzer hits for the file.
RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.violatedHits Number The number of high-risk analyzer hits for the file that violates policies.
RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.__typename String The type of the high-risk hits field.
RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.totalHits Number The total number of medium-risk analyzer hits for the file.
RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.violatedHits Number The number of medium-risk analyzer hits for the file that violates policies.
RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.__typename String The type of the medium-risk hits field.
RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.totalHits Number The total number of low-risk analyzer hits for the file.
RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.violatedHits Number The number of low-risk analyzer hits for the file that violates policies.
RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.__typename String The type of the low-risk hits field.
RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.totalHits Number The total number of no-risk analyzer hits for the file.
RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.violatedHits Number The number of no-risk analyzer hits for the file that violates policies.
RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.__typename String The type of the no-risk hits field.
RubrikPolaris.FileContext.analyzerRiskHits.__typename String The type of the analyzer risk hits field.
RubrikPolaris.FileContext.analyzerResults.hits.totalHits Number The total number of hits for the analyzer results.
RubrikPolaris.FileContext.analyzerResults.hits.violations Number The number of violations for the analyzer results.
RubrikPolaris.FileContext.analyzerResults.hits.__typename String The type of the hits field.
RubrikPolaris.FileContext.analyzerResults.analyzer.id String The ID of the analyzer.
RubrikPolaris.FileContext.analyzerResults.analyzer.name String The name of the analyzer.
RubrikPolaris.FileContext.analyzerResults.analyzer.analyzerType String The type of the analyzer.
RubrikPolaris.FileContext.analyzerResults.analyzer.__typename String The type of the analyzer field.
RubrikPolaris.FileContext.analyzerResults.__typename String The type of the analyzer results field.
RubrikPolaris.FileContext.openAccessType String The open access type for the file.
RubrikPolaris.FileContext.stalenessType String The staleness type for the file.
RubrikPolaris.FileContext.numActivities Number The number of activities for the file.
RubrikPolaris.FileContext.numActivitiesDelta Number The change in the number of activities for the file since the last time it was checked.
RubrikPolaris.FileContext.exposureSummary.exposureType String The exposure type of the file.
RubrikPolaris.FileContext.exposureSummary.fileCount.totalCount Number The total number of files with this exposure type.
RubrikPolaris.FileContext.exposureSummary.fileCount.violatedCount Number The number of files with this exposure type that violates policies.
RubrikPolaris.FileContext.exposureSummary.fileCount.__typename String The type of the file count field.
RubrikPolaris.FileContext.exposureSummary.__typename String The type of the exposure summary field.
RubrikPolaris.FileContext.dbEntityType String The database entity type of the file.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.siteId String The site ID of the MIP label.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.labelName String The name of the MIP label.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.labelId String The ID of the MIP label.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.hasProtection Boolean Whether the MIP label has protection applied.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.__typename String The type of the MIP label field.
RubrikPolaris.FileContext.mipLabelsSummary.filesCount.violatedCount Number The number of files with this MIP label that violates policies.
RubrikPolaris.FileContext.mipLabelsSummary.filesCount.totalCount Number The total number of files with this MIP label.
RubrikPolaris.FileContext.mipLabelsSummary.filesCount.__typename String The type of the files count field.
RubrikPolaris.FileContext.mipLabelsSummary.__typename String The type of the MIP labels summary field.
RubrikPolaris.FileContext.documentTypesSummary.id String The ID of the document type.
RubrikPolaris.FileContext.documentTypesSummary.name String The name of the document type.
RubrikPolaris.FileContext.documentTypesSummary.filesCount.totalCount Number The total number of files of this document type.
RubrikPolaris.FileContext.documentTypesSummary.filesCount.violatedCount Number The number of files of this document type that violates policies.
RubrikPolaris.FileContext.documentTypesSummary.filesCount.__typename String The type of the files count field.
RubrikPolaris.FileContext.documentTypesSummary.__typename String The type of the document types summary field.
RubrikPolaris.FileContext.__typename String The type of the file context field.
RubrikPolaris.PageToken.FileContext.name String Name of the command.
RubrikPolaris.PageToken.FileContext.startCursor String The start cursor for the current page.
RubrikPolaris.PageToken.FileContext.endCursor String The end cursor for the current page.
RubrikPolaris.PageToken.FileContext.hasNextPage Boolean Whether the result has the next page or not.
RubrikPolaris.PageToken.FileContext.hasPreviousPage Boolean Whether the result has the previous page or not.

Command example

!rubrik-sonar-file-context-list object_id="1" snapshot_id="1" limit="2"

Context Example

{
    "RubrikPolaris": {
        "FileContext": [
            {
                "__typename": "FileResult",
                "analyzerGroupResults": [
                    {
                        "__typename": "AnalyzerGroupResult",
                        "analyzerGroup": {
                            "__typename": "AnalyzerGroup",
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000001",
                            "name": "UK PII"
                        },
                        "analyzerResults": [
                            {
                                "__typename": "AnalyzerResult",
                                "analyzer": {
                                    "__typename": "Analyzer",
                                    "analyzerType": "UK_UTR",
                                    "id": "00000000-0000-0000-0000-000000000001",
                                    "name": "UK UTR"
                                },
                                "hits": {
                                    "__typename": "Hits",
                                    "totalHits": 0,
                                    "violations": 0
                                }
                            }
                        ],
                        "hits": {
                            "__typename": "Hits",
                            "totalHits": 0,
                            "totalHitsDelta": 0,
                            "violations": 2000,
                            "violationsDelta": 0
                        }
                    }
                ],
                "analyzerResults": [
                    {
                        "__typename": "AnalyzerResult",
                        "analyzer": {
                            "__typename": "Analyzer",
                            "analyzerType": "UK_UTR",
                            "id": "00000000-0000-0000-0000-000000000001",
                            "name": "UK UTR"
                        },
                        "hits": {
                            "__typename": "Hits",
                            "totalHits": 0,
                            "violations": 0
                        }
                    }
                ],
                "analyzerRiskHits": {
                    "__typename": "AnalyzerHits",
                    "highRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 1500
                    },
                    "lowRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 100
                    },
                    "mediumRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 400
                    },
                    "noRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    }
                },
                "createdBy": "admin",
                "creationTime": 1648099578,
                "dbEntityType": "NAS",
                "directory": "/C:/File Shares",
                "documentTypesSummary": [
                    {
                        "__typename": "DocumentTypeSummary",
                        "filesCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        },
                        "id": "00000000-0000-0000-0000-000000000003",
                        "name": "Spreadsheet"
                    }
                ],
                "errorCode": "NO_ERROR",
                "exposureSummary": [
                    {
                        "__typename": "ExposureSummary",
                        "exposureType": "OPEN_ACCESS",
                        "fileCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        }
                    }
                ],
                "filename": "uk_drivers_license_number.xlsx",
                "filesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "hits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "totalHitsDelta": 0,
                    "violations": 2000,
                    "violationsDelta": 0
                },
                "lastAccessTime": 1648099578,
                "lastModifiedTime": 1648099578,
                "lastScanTime": 1648099578,
                "mipLabelsSummary": [
                    {
                        "__typename": "MipLabelSummary",
                        "filesCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        },
                        "mipLabel": {
                            "__typename": "MipLabel",
                            "hasProtection": true,
                            "labelId": "00000000-0000-0000-0000-000000000002",
                            "labelName": "Confidential",
                            "siteId": "00000000-0000-0000-0000-000000000001"
                        }
                    }
                ],
                "mode": "FILE",
                "modifiedBy": "admin",
                "nativePath": "/C:/File Shares/drivers_license_number.xlsx",
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "numDescendantErrorFiles": 0,
                "numDescendantFiles": 0,
                "numDescendantSkippedExtFiles": 0,
                "numDescendantSkippedSizeFiles": 0,
                "openAccessFilesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "openAccessType": "INHERITED",
                "sensitiveFiles": {
                    "__typename": "SensitiveFiles",
                    "highRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 1
                    },
                    "lowRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "mediumRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "noRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "totalFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 1
                    }
                },
                "sensitiveHits": {
                    "__typename": "SensitiveHits",
                    "highRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 1500,
                        "violatedHits": 1500
                    },
                    "lowRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 100,
                        "violatedHits": 100
                    },
                    "mediumRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 400,
                        "violatedHits": 400
                    },
                    "noRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    }
                },
                "size": 85708,
                "staleFilesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "stalenessType": "IS_STALE",
                "stdPath": "/C:/File Shares/uk_drivers_license_number.xlsx"
            },
            {
                "__typename": "FileResult",
                "analyzerGroupResults": [
                    {
                        "__typename": "AnalyzerGroupResult",
                        "analyzerGroup": {
                            "__typename": "AnalyzerGroup",
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000001",
                            "name": "UK PII"
                        },
                        "analyzerResults": [
                            {
                                "__typename": "AnalyzerResult",
                                "analyzer": {
                                    "__typename": "Analyzer",
                                    "analyzerType": "UK_NINO",
                                    "id": "00000000-0000-0000-0000-000000000001",
                                    "name": "UK NINO"
                                },
                                "hits": {
                                    "__typename": "Hits",
                                    "totalHits": 0,
                                    "violations": 0
                                }
                            }
                        ],
                        "hits": {
                            "__typename": "Hits",
                            "totalHits": 0,
                            "totalHitsDelta": 0,
                            "violations": 1712,
                            "violationsDelta": 0
                        }
                    }
                ],
                "analyzerResults": [
                    {
                        "__typename": "AnalyzerResult",
                        "analyzer": {
                            "__typename": "Analyzer",
                            "analyzerType": "UK_NINO",
                            "id": "00000000-0000-0000-0000-000000000001",
                            "name": "UK NINO"
                        },
                        "hits": {
                            "__typename": "Hits",
                            "totalHits": 0,
                            "violations": 0
                        }
                    }
                ],
                "analyzerRiskHits": {
                    "__typename": "AnalyzerHits",
                    "highRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 1712
                    },
                    "lowRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    },
                    "mediumRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    },
                    "noRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    }
                },
                "createdBy": "admin",
                "creationTime": 1648099580,
                "dbEntityType": "NAS",
                "directory": "/C:/File Shares",
                "documentTypesSummary": [
                    {
                        "__typename": "DocumentTypeSummary",
                        "filesCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        },
                        "id": "00000000-0000-0000-0000-000000000003",
                        "name": "Spreadsheet"
                    }
                ],
                "errorCode": "NO_ERROR",
                "exposureSummary": [
                    {
                        "__typename": "ExposureSummary",
                        "exposureType": "OPEN_ACCESS",
                        "fileCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        }
                    }
                ],
                "filename": "uk_national_insurance_number.csv",
                "filesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "hits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "totalHitsDelta": 0,
                    "violations": 1712,
                    "violationsDelta": 0
                },
                "lastAccessTime": 1648099580,
                "lastModifiedTime": 1648099580,
                "lastScanTime": 1648099580,
                "mipLabelsSummary": [
                    {
                        "__typename": "MipLabelSummary",
                        "filesCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        },
                        "mipLabel": {
                            "__typename": "MipLabel",
                            "hasProtection": true,
                            "labelId": "00000000-0000-0000-0000-000000000002",
                            "labelName": "Confidential",
                            "siteId": "00000000-0000-0000-0000-000000000001"
                        }
                    }
                ],
                "mode": "FILE",
                "modifiedBy": "admin",
                "nativePath": "/C:/File Shares/uk_national_insurance_number.csv",
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "numDescendantErrorFiles": 0,
                "numDescendantFiles": 0,
                "numDescendantSkippedExtFiles": 0,
                "numDescendantSkippedSizeFiles": 0,
                "openAccessFilesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "openAccessType": "INHERITED",
                "sensitiveFiles": {
                    "__typename": "SensitiveFiles",
                    "highRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 1
                    },
                    "lowRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "mediumRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "noRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "totalFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 1
                    }
                },
                "sensitiveHits": {
                    "__typename": "SensitiveHits",
                    "highRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 1712,
                        "violatedHits": 1712
                    },
                    "lowRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    },
                    "mediumRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    },
                    "noRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    }
                },
                "size": 120064,
                "staleFilesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "stalenessType": "IS_STALE",
                "stdPath": "/C:/File Shares/uk_national_insurance_number.csv"
            }
        ],
        "PageToken": {
            "FileContext": {
                "endCursor": "cursor_2",
                "hasNextPage": true,
                "hasPreviousPage": false,
                "name": "rubrik-sonar-file-context-list",
                "startCursor": "cursor_1"
            }
        }
    }
}

Human Readable Output

File Context

File Name File Size in Bytes Total Risk Hits Daily Hits Change High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits File Path Access Type Last Access Time Last Modified Time Data Categories
uk_drivers_license_number.xlsx 85708 2000 0 1500 400 100 0 /C:/File Shares/uk_drivers_license_number.xlsx INHERITED 2022-03-24T05:26:18Z 2022-03-24T05:26:18Z - id: 00000000-0000-0000-0000-000000000001
name: UK PII
totalViolatedHits: 2000
uk_national_insurance_number.csv 120064 1712 0 1712 0 0 0 /C:/File Shares/uk_national_insurance_number.csv INHERITED 2022-03-24T05:26:20Z 2022-03-24T05:26:20Z - id: 00000000-0000-0000-0000-000000000001
name: UK PII
totalViolatedHits: 1712

Note: To retrieve the next set of results use, “next_page_token” = cursor_2

rubrik-radar-suspicious-file-list

Retrieve the suspicious list of files for a snapshot ID with detected file anomalies.

Base Command

rubrik-radar-suspicious-file-list

Input

Argument Name Description Required
snapshot_id The Snapshot ID of the object or Activity Series ID.

Note: Users can get the list of the snapshot IDs by executing the “rubrik-polaris-object-snapshot-list” command. For the Activity Series ID, the users can execute the “rubrik-event-list” command with the “activity_type” argument set to “ANOMALY”.		 Required

Context Output

Path Type Description
RubrikPolaris.SuspiciousFile.id String The anomaly result ID.
RubrikPolaris.SuspiciousFile.snapshotFid String The snapshot ID.
RubrikPolaris.SuspiciousFile.cluster.id String The cluster ID.
RubrikPolaris.SuspiciousFile.cluster.defaultAddress String The default address of the cluster.
RubrikPolaris.SuspiciousFile.cluster.systemStatusAffectedNodes.ipAddress String The IP address of the affected node.
RubrikPolaris.SuspiciousFile.cluster.name String The cluster name.
RubrikPolaris.SuspiciousFile.cluster.version String The cluster version.
RubrikPolaris.SuspiciousFile.cluster.status String The cluster status.
RubrikPolaris.SuspiciousFile.cluster.__typename String The type name of the cluster response.
RubrikPolaris.SuspiciousFile.cdmId String The snapshot CDM ID.
RubrikPolaris.SuspiciousFile.managedId String The managed object ID.
RubrikPolaris.SuspiciousFile.anomalyProbability Number The probability of the anomaly.
RubrikPolaris.SuspiciousFile.workloadId String The workload ID.
RubrikPolaris.SuspiciousFile.location String The location of the anomaly.
RubrikPolaris.SuspiciousFile.isAnomaly Boolean Indicates if the file is an anomaly.
RubrikPolaris.SuspiciousFile.objectType String The object type.
RubrikPolaris.SuspiciousFile.snappableNew.objectType String The object type of the snapshot.
RubrikPolaris.SuspiciousFile.severity String The severity of the anomaly.
RubrikPolaris.SuspiciousFile.detectionTime Date The detection time of the anomaly.
RubrikPolaris.SuspiciousFile.snapshotDate Date The snapshot date of the anomaly.
RubrikPolaris.SuspiciousFile.encryption String The encryption standard of the anomaly.
RubrikPolaris.SuspiciousFile.resolutionStatus String The resolution status of the anomaly.
RubrikPolaris.SuspiciousFile.anomalyType String The type of the anomaly.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.strainId String The ID of the Ransomware Strain.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalAffectedFiles Number The total number of affected files.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalRansomwareNotes Number The total number of ransomware notes.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath String The path of the affected file.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.lastModified Date The last modified time of the affected file.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.fileSizeBytes Number The size of the affected file in bytes.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.__typename String The type name of the affected file response.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath String The path of the ransomware note file.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.lastModified Date The last modified time of the ransomware note file.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.fileSizeBytes Number The size of the ransomware note file in bytes.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.__typename String The type name of the ransomware note file response.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.__typename String The type name of the strain analysis response.
RubrikPolaris.SuspiciousFile.anomalyInfo.__typename String The type name of the anomaly response.
RubrikPolaris.SuspiciousFile.__typename String The type name of the suspicious file response.

Command example

!rubrik-radar-suspicious-file-list snapshot_id="00000000-0000-0000-0000-000000000001"

Context Example

{
    "RubrikPolaris": {
      "SuspiciousFile": {
        "id": "00000000-0000-0000-0000-000000000001:::VirtualMachine:::00000000-0000-0000-0000-000000000001-vm-206:::00000000-0000-0000-0000-000000000001",
        "snapshotFid": "00000000-0000-0000-0000-000000000001",
        "cluster": {
          "id": "00000000-0000-0000-0000-000000000001",
          "defaultAddress": "cluster.rubrik",
          "systemStatusAffectedNodes": [
            {
              "ipAddress": "0.0.0.0"
            }
          ],
          "name": "Cluster_B",
          "version": "8.1.3",
          "status": "Connected",
          "__typename": "Cluster"
        },
        "snappableNew": {
          "objectType": "VmwareVirtualMachine"
        },
        "cdmId": "00000000-0000-0000-0000-000000000001",
        "managedId": "VirtualMachine:::00000000-0000-0000-0000-000000000001-vm-206",
        "anomalyProbability": 0.949999988079071,
        "workloadId": "00000000-0000-0000-0000-000000000001-vm-206",
        "location": "instance.rubrik",
        "isAnomaly": true,
        "severity": "Critical",
        "detectionTime": "2024-02-05T18:49:03.000Z",
        "snapshotDate": "2024-02-05T16:59:30.000Z",
        "encryption": "HIGH",
        "resolutionStatus": "UNRESOLVED",
        "anomalyType": "FILESYSTEM",
        "anomalyInfo": {
          "strainAnalysisInfo": [
            {
              "strainId": "LockBit",
              "totalAffectedFiles": 1,
              "totalRansomwareNotes": 1,
              "sampleAffectedFilesInfo": [
                {
                  "filePath": "/C:/Shares/Restore-My-Files.txt.lockbit",
                  "lastModified": "2024-02-05T16:00:44.000Z",
                  "fileSizeBytes": 2512,
                  "__typename": "SuspiciousFileInfo"
                }
              ],
              "sampleRansomwareNoteFilesInfo": [
                {
                  "filePath": "/C:/Users/Public/Desktop/Restore-My-Files.txt",
                  "lastModified": "2024-02-08T02:00:03.000Z",
                  "fileSizeBytes": 2484,
                  "__typename": "SuspiciousFileInfo"
                }
              ],
              "__typename": "StrainInfo"
            }
          ],
          "__typename": "AnomalyInfo"
        },
        "__typename": "GetAnomalyDetailsReply"
      }
    }
}

Human Readable Output

Anomaly Information

Anomaly ID Is Anomaly Anomaly Probability Severity Encryption Anomaly Anomaly Type Resolution Status Total Suspicious Files Total Ransomware Note Detection Time Snapshot Time
00000000-0000-0000-0000-000000000001:::VirtualMachine:::00000000-0000-0000-0000-000000000001-vm-206:::00000000-0000-0000-0000-000000000001 true 0.949999988079071 Critical HIGH LockBit FILESYSTEM UNRESOLVED 1 1 2024-02-05T18:49:03.000Z 2024-02-05T16:59:30.000Z

Suspicious Files

File Path Suspicious Activity File Size in Bytes Last Modified Time
/C:/Shares/Restore-My-Files.txt.lockbit Ransomware Encryption 2512 2024-02-05T16:00:44.000Z
/C:/Users/Public/Desktop/Restore-My-Files.txt Ransomware Note 2484 2024-02-08T02:00:03.000Z

ip

Retrieve the sensitive information available for the given IP address(es).

Base Command

ip

Input

Argument Name Description Required
ip The IP address(es) for which to retrieve sensitive information. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
IP.Address String IP address.
IP.Relationships.EntityA String The source of the relationship.
IP.Relationships.EntityB String The destination of the relationship.
IP.Relationships.Relationship String The name of the relationship.
IP.Relationships.EntityAType String The type of the source of the relationship.
IP.Relationships.EntityBType String The type of the destination of the relationship.
IP.ASN String The autonomous system name for the IP address, for example: “AS8948”.
IP.Hostname String The hostname that is mapped to this IP address.
IP.Geo.Location String The geolocation where the IP address is located, in the format: latitude:longitude.
IP.Geo.Country String The country in which the IP address is located.
IP.Geo.Description String Additional information about the location.
IP.DetectionEngines Number The total number of engines that checked the indicator.
IP.PositiveDetections Number The number of engines that positively detected the indicator as malicious.
IP.Malicious.Vendor String The vendor reporting the IP address as malicious.
IP.Malicious.Description String A description explaining why the IP address was reported as malicious.
IP.Tags Unknown Tags of the IP address.
IP.FeedRelatedIndicators.value String Indicators that are associated with the IP address.
IP.FeedRelatedIndicators.type String The type of the indicators that are associated with the IP address.
IP.FeedRelatedIndicators.description String The description of the indicators that are associated with the IP address.
IP.MalwareFamily String The malware family associated with the IP address.
IP.Organization.Name String The organization of the IP address.
IP.Organization.Type String The organization type of the IP address.
IP.ASOwner String The autonomous system owner of the IP address.
IP.Region String The region in which the IP address is located.
IP.Port String Ports that are associated with the IP address.
IP.Internal Boolean Whether the IP address is internal or external.
IP.UpdatedDate Date The date that the IP address was last updated.
IP.Registrar.Abuse.Name String The name of the contact for reporting abuse.
IP.Registrar.Abuse.Address String The address of the contact for reporting abuse.
IP.Registrar.Abuse.Country String The country of the contact for reporting abuse.
IP.Registrar.Abuse.Network String The network of the contact for reporting abuse.
IP.Registrar.Abuse.Phone String The phone number of the contact for reporting abuse.
IP.Registrar.Abuse.Email String The email address of the contact for reporting abuse.
IP.Campaign String The campaign associated with the IP address.
IP.TrafficLightProtocol String The Traffic Light Protocol (TLP) color that is suitable for the IP address.
IP.CommunityNotes.note String Notes on the IP address that were given by the community.
IP.CommunityNotes.timestamp Date The time in which the note was published.
IP.Publications.source String The source in which the article was published.
IP.Publications.title String The name of the article.
IP.Publications.link String A link to the original article.
IP.Publications.timestamp Date The time in which the article was published.
IP.ThreatTypes.threatcategory String The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc.
IP.ThreatTypes.threatcategoryconfidence String The confidence level provided by the vendor for the threat type category For example, a confidence of 90 for the threat type category ‘malware’ means that the vendor rates that this is 90% confidence of being a malware.
RubrikPolaris.IP.ip String IP address of the object.
RubrikPolaris.IP.generalInfo.fid String The foreign ID of the object.
RubrikPolaris.IP.generalInfo.name String The name of the object.
RubrikPolaris.IP.generalInfo.objectType String The type of the object.
RubrikPolaris.IP.generalInfo.protectionStatus String The protection status of the object.
RubrikPolaris.IP.generalInfo.lastSnapshot Date The timestamp of the last snapshot of the object.
RubrikPolaris.IP.generalInfo.redirectLink String The link to the object in the Rubrik UI.
RubrikPolaris.IP.sensitiveInfo.riskLevel String The risk level of the object.
RubrikPolaris.IP.sensitiveInfo.sensitiveFiles.mediumCount String The number of sensitive files of medium risk level.
RubrikPolaris.IP.sensitiveInfo.sensitiveHits Number The number of sensitive files.
RubrikPolaris.IP.sensitiveInfo.openAccessFiles Number The number of open access files.
RubrikPolaris.IP.sensitiveInfo.staleFiles Number The number of stale files.
RubrikPolaris.IP.sensitiveInfo.redirectLink String The link to the sensitive information in the Rubrik UI.
RubrikPolaris.IP.sensitiveInfo.policyNames String The names of the policies associated with the object.
RubrikPolaris.IP.anomalyInfo.severity String The severity of the anomaly.
RubrikPolaris.IP.anomalyInfo.detectionTime Date The timestamp of the anomaly detection.
RubrikPolaris.IP.anomalyInfo.createdFileCount String The number of created files.
RubrikPolaris.IP.anomalyInfo.deletedFileCount String The number of deleted files.
RubrikPolaris.IP.anomalyInfo.modifiedFileCount String The number of modified files.
RubrikPolaris.IP.anomalyInfo.suspiciousFileCount String The number of suspicious files.
RubrikPolaris.IP.anomalyInfo.redirectLink String The link to the anomaly information in the Rubrik UI.
RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.huntId String The ID of the latest threat hunt.
RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.huntStartTime Date The timestamp of the latest threat hunt.
RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.isMalicious String Whether the latest threat hunt is malicious.
RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.huntId String The ID of the latest malicious threat hunt.
RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.huntStartTime Date The timestamp of the latest malicious threat hunt.
RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.isMalicious String Whether the latest malicious threat hunt is malicious.
RubrikPolaris.IP.threatHuntInfo.redirectLink String The link to the threat hunt information in the Rubrik UI.
RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.snapshotFid String The foreign ID of the latest threat monitoring snapshot.
RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.monitoringScanTime Date The timestamp of the latest threat monitoring scan.
RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.isMalicious String Whether the latest threat monitoring snapshot is malicious.
RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.snapshotFid String The foreign ID of the latest malicious threat monitoring snapshot.
RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.monitoringScanTime Date The timestamp of the latest malicious threat monitoring scan.
RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.isMalicious String Whether the latest malicious threat monitoring snapshot is malicious.
RubrikPolaris.IP.threatMonitoringInfo.redirectLink String The link to the threat monitoring information in the Rubrik UI.

Command example

!ip ip="0.0.0.1"

Context Example

{
    "DBotScore": {
        "Indicator": "0.0.0.1",
        "Reliability": "A - Completely reliable",
        "Score": 2,
        "Type": "ip",
        "Vendor": "Rubrik Security Cloud"
    },
    "IP": {
        "Address": "0.0.0.1",
        "UpdatedDate": "2024-10-21T08:51:52Z"
    },
    "RubrikPolaris": {
        "IP": {
            "ip": "0.0.0.1",
            "generalInfo": {
                "fid": "12345678-1234-1234-1234-123456789012",
                "name": "DEMO-RADAR",
                "objectType": "Vsphere Virtual Machine",
                "protectionStatus": "Protected",
                "lastSnapshot": "2024-10-18T06:02:25Z",
                "redirectLink": "https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview"
            },
            "sensitiveInfo": {
                "riskLevel": "Medium",
                "sensitiveFiles": {
                    "mediumCount": "11"
                },
                "sensitiveHits": 2910,
                "openAccessFiles": 6,
                "staleFiles": 11,
                "redirectLink": "https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse",
                "policyNames": [
                    "U.S. PII"
                ]
            },
            "anomalyInfo": {
                "severity": "Critical",
                "detectionTime": "2024-10-14T17:57:06Z",
                "createdFileCount": "4487",
                "deletedFileCount": "4477",
                "modifiedFileCount": "32",
                "suspiciousFileCount": "4476",
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary"
            },
            "threatHuntInfo": {
                "latestThreatHunt": {
                    "huntId": "12345678-1234-1234-1234-123456789012",
                    "huntStartTime": "2024-10-11T09:23:26Z",
                    "isMalicious": "Matches Found"
                },
                "latestMaliciousThreatHunt": {
                    "huntId": "12345678-1234-1234-1234-123456789012",
                    "huntStartTime": "2024-10-11T09:23:26Z",
                    "isMalicious": "Matches Found"
                },
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details"
            },
            "threatMonitoringInfo": {
                "latestThreatMonitoring": {
                    "snapshotFid": "12345678-1234-1234-1234-123456789012",
                    "monitoringScanTime": "2024-10-18T05:51:31Z",
                    "isMalicious": "No Matches"
                },
                "latestMaliciousThreatMonitoring": {
                    "snapshotFid": "12345678-1234-1234-1234-123456789012",
                    "monitoringScanTime": "2024-10-14T04:41:15Z",
                    "isMalicious": "Matches Found"
                },
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90"
            }
        }
    }
}

Human Readable Output

General Information for the given medium risk IP: 0.0.0.1

Fid Last Snapshot Name Object Type Protection Status Redirect Link
12345678-1234-1234-1234-123456789012 2024-10-18T06:02:25Z DEMO-RADAR Vsphere Virtual Machine Protected https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview

Sensitive Information

Open Access Files Policy Names Redirect Link Risk Level Sensitive Files Sensitive Hits Stale Files
6 U.S. PII https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse Medium mediumCount: 11 2910 11

Anomaly Information

Created File Count Deleted File Count Detection Time Modified File Count Redirect Link Severity Suspicious File Count
4487 4477 2024-10-14T17:57:06Z 32 https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary Critical 4476

Threat Hunt Information

Latest Malicious Threat Hunt Latest Threat Hunt Redirect Link
huntId: 12345678-1234-1234-1234-123456789012
huntStartTime: 2024-10-11T09:23:26Z
isMalicious: Matches Found		 huntId: 12345678-1234-1234-1234-123456789012
huntStartTime: 2024-10-11T09:23:26Z
isMalicious: Matches Found		 https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details

Threat Monitoring Information

Latest Malicious Threat Monitoring Latest Threat Monitoring Redirect Link
snapshotFid: 12345678-1234-1234-1234-123456789012
monitoringScanTime: 2024-10-14T04:41:15Z
isMalicious: Matches Found		 snapshotFid: 12345678-1234-1234-1234-123456789012
monitoringScanTime: 2024-10-18T05:51:31Z
isMalicious: No Matches		 https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90

domain

Retrieve the sensitive information available for the given domain(s).

Base Command

domain

Input

Argument Name Description Required
domain The domain(s) for which to retrieve sensitive information. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
Domain.Name String The domain name, for example: “google.com”.
Domain.Relationships.EntityA string The source of the relationship.
Domain.Relationships.EntityB string The destination of the relationship.
Domain.Relationships.Relationship string The name of the relationship.
Domain.Relationships.EntityAType string The type of the source of the relationship.
Domain.Relationships.EntityBType string The type of the destination of the relationship.
Domain.DNS String A list of IP objects resolved by DNS.
Domain.DetectionEngines Number The total number of engines that checked the indicator.
Domain.PositiveDetections Number The number of engines that positively detected the indicator as malicious.
Domain.CreationDate Date The date that the domain was created.
Domain.UpdatedDate String The date that the domain was last updated.
Domain.ExpirationDate Date The expiration date of the domain.
Domain.DomainStatus Datte The status of the domain.
Domain.NameServers Unknown (List<String>) Name servers of the domain.
Domain.Organization String The organization of the domain.
Domain.Subdomains Unknown (List<String>) Subdomains of the domain.
Domain.Admin.Country String The country of the domain administrator.
Domain.Admin.Email String The email address of the domain administrator.
Domain.Admin.Name String The name of the domain administrator.
Domain.Admin.Phone String The phone number of the domain administrator.
Domain.Registrant.Country String The country of the registrant.
Domain.Registrant.Email String The email address of the registrant.
Domain.Registrant.Name String The name of the registrant.
Domain.Registrant.Phone String The phone number for receiving abuse reports.
Domain.Tags Unknown Tags of the domain.
Domain.FeedRelatedIndicators.value String Indicators that are associated with the domain.
Domain.FeedRelatedIndicators.type String The type of the indicators that are associated with the domain.
Domain.FeedRelatedIndicators.description String The description of the indicators that are associated with the domain.
Domain.MalwareFamily String The malware family associated with the domain.
Domain.WHOIS.DomainStatus String The status of the domain.
Domain.WHOIS.NameServers String (List<String>) Name servers of the domain.
Domain.WHOIS.CreationDate Date The date that the domain was created.
Domain.WHOIS.UpdatedDate Date The date that the domain was last updated.
Domain.WHOIS.ExpirationDate Date The expiration date of the domain.
Domain.WHOIS.Registrant.Name String The name of the registrant.
Domain.WHOIS.Registrant.Email String The email address of the registrant.
Domain.WHOIS.Registrant.Phone String The phone number of the registrant.
Domain.WHOIS.Registrar.Name String The name of the registrar, for example: “GoDaddy”.
Domain.WHOIS.Registrar.AbuseEmail String The email address of the contact for reporting abuse.
Domain.WHOIS.Registrar.AbusePhone String The phone number of contact for reporting abuse.
Domain.WHOIS.Admin.Name String The name of the domain administrator.
Domain.WHOIS.Admin.Email String The email address of the domain administrator.
Domain.WHOIS.Admin.Phone String The phone number of the domain administrator.
Domain.WHOIS/History String List of Whois objects.
Domain.Malicious.Vendor String The vendor reporting the domain as malicious.
Domain.Malicious.Description String A description explaining why the domain was reported as malicious.
Domain.DomainIDNName String The internationalized domain name (IDN) of the domain.
Domain.Port String Ports that are associated with the domain.
Domain.Internal Bool Whether or not the domain is internal or external.
Domain.Category String The category associated with the indicator.
Domain.Campaign String The campaign associated with the domain.
Domain.TrafficLightProtocol String The Traffic Light Protocol (TLP) color that is suitable for the domain.
Domain.ThreatTypes.threatcategory String The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc.
Domain.ThreatTypes.threatcategoryconfidence String Threat Category Confidence is the confidence level provided by the vendor for the threat type category For example a confidence of 90 for threat type category ‘malware’ means that the vendor rates that this is 90% confidence of being a malware.
Domain.Geo.Location String The geolocation where the domain address is located, in the format: latitude:longitude.
Domain.Geo.Country String The country in which the domain address is located.
Domain.Geo.Description String Additional information about the location.
Domain.Tech.Country String The country of the domain technical contact.
Domain.Tech.Name String The name of the domain technical contact.
Domain.Tech.Organization String The organization of the domain technical contact.
Domain.Tech.Email String The email address of the domain technical contact.
Domain.CommunityNotes.note String Notes on the domain that were given by the community.
Domain.CommunityNotes.timestamp Date The time in which the note was published.
Domain.Publications.source String The source in which the article was published.
Domain.Publications.title String The name of the article.
Domain.Publications.link String A link to the original article.
Domain.Publications.timestamp Date The time in which the article was published.
Domain.Billing String The billing address of the domain.
RubrikPolaris.Domain.domain String The domain of the object.
RubrikPolaris.Domain.generalInfo.fid String The foreign ID of the object.
RubrikPolaris.Domain.generalInfo.name String The name of the object.
RubrikPolaris.Domain.generalInfo.objectType String The type of the object.
RubrikPolaris.Domain.generalInfo.protectionStatus String The protection status of the object.
RubrikPolaris.Domain.generalInfo.lastSnapshot Date The timestamp of the last snapshot of the object.
RubrikPolaris.Domain.generalInfo.redirectLink String The link to the object in the Rubrik UI.
RubrikPolaris.Domain.sensitiveInfo.riskLevel String The risk level of the object.
RubrikPolaris.Domain.sensitiveInfo.sensitiveFiles.mediumCount String The number of sensitive files of medium risk level.
RubrikPolaris.Domain.sensitiveInfo.sensitiveHits Number The number of sensitive files.
RubrikPolaris.Domain.sensitiveInfo.openAccessFiles Number The number of open access files.
RubrikPolaris.Domain.sensitiveInfo.staleFiles Number The number of stale files.
RubrikPolaris.Domain.sensitiveInfo.redirectLink String The link to the sensitive information in the Rubrik UI.
RubrikPolaris.Domain.sensitiveInfo.policyNames String The names of the policies associated with the object.
RubrikPolaris.Domain.anomalyInfo.severity String The severity of the anomaly.
RubrikPolaris.Domain.anomalyInfo.detectionTime Date The timestamp of the anomaly detection.
RubrikPolaris.Domain.anomalyInfo.createdFileCount String The number of created files.
RubrikPolaris.Domain.anomalyInfo.deletedFileCount String The number of deleted files.
RubrikPolaris.Domain.anomalyInfo.modifiedFileCount String The number of modified files.
RubrikPolaris.Domain.anomalyInfo.suspiciousFileCount String The number of suspicious files.
RubrikPolaris.Domain.anomalyInfo.redirectLink String The link to the anomaly information in the Rubrik UI.
RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.huntId String The ID of the latest threat hunt.
RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.huntStartTime Date The timestamp of the latest threat hunt.
RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.isMalicious String Whether the latest threat hunt is malicious.
RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.huntId String The ID of the latest malicious threat hunt.
RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.huntStartTime Date The timestamp of the latest malicious threat hunt.
RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.isMalicious String Whether the latest malicious threat hunt is malicious.
RubrikPolaris.Domain.threatHuntInfo.redirectLink String The link to the threat hunt information in the Rubrik UI.
RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.snapshotFid String The foreign ID of the latest threat monitoring snapshot.
RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.monitoringScanTime Date The timestamp of the latest threat monitoring scan.
RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.isMalicious String Whether the latest threat monitoring snapshot is malicious.
RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.snapshotFid String The foreign ID of the latest malicious threat monitoring snapshot.
RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.monitoringScanTime Date The timestamp of the latest malicious threat monitoring scan.
RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.isMalicious String Whether the latest malicious threat monitoring snapshot is malicious.
RubrikPolaris.Domain.threatMonitoringInfo.redirectLink String The link to the threat monitoring information in the Rubrik UI.

Command example

!domain domain="DEMO-RADAR" using-brand=RubrikPolaris

Context Example

{
    "DBotScore": {
        "Indicator": "DEMO-RADAR",
        "Reliability": "A - Completely reliable",
        "Score": 2,
        "Type": "domain",
        "Vendor": "Rubrik Security Cloud"
    },
    "Domain": {
        "Name": "DEMO-RADAR",
        "UpdatedDate": "2024-11-05T04:34:47Z",
        "WHOIS": {
            "UpdatedDate": "2024-11-05T04:34:47Z"
        }
    },
    "RubrikPolaris": {
        "Domain": {
            "domain": "DEMO-RADAR",
            "generalInfo": {
                "fid": "12345678-1234-1234-1234-123456789012",
                "name": "DEMO-RADAR",
                "objectType": "Vsphere Virtual Machine",
                "protectionStatus": "Protected",
                "lastSnapshot": "2024-10-18T06:02:25Z",
                "redirectLink": "https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview"
            },
            "anomalyInfo": {
                "severity": "Critical",
                "detectionTime": "2024-10-14T17:57:06Z",
                "createdFileCount": "4487",
                "deletedFileCount": "4477",
                "modifiedFileCount": "32",
                "suspiciousFileCount": "4476",
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary"
            },
            "sensitiveInfo": {
                "riskLevel": "Medium",
                "sensitiveFiles": {
                    "mediumCount": "11"
                },
                "sensitiveHits": 2910,
                "openAccessFiles": 6,
                "staleFiles": 11,
                "redirectLink": "https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse",
                "policyNames": [
                    "U.S. PII"
                ]
            },
            "threatHuntInfo": {
                "latestThreatHunt": {
                    "huntId": "12345678-1234-1234-1234-123456789012",
                    "huntStartTime": "2024-10-11T09:23:26Z",
                    "isMalicious": "Matches Found"
                },
                "latestMaliciousThreatHunt": {
                    "huntId": "12345678-1234-1234-1234-123456789012",
                    "huntStartTime": "2024-10-11T09:23:26Z",
                    "isMalicious": "Matches Found"
                },
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details"
            },
            "threatMonitoringInfo": {
                "latestThreatMonitoring": {
                    "snapshotFid": "12345678-1234-1234-1234-123456789012",
                    "monitoringScanTime": "2024-10-18T05:51:31Z",
                    "isMalicious": "No Matches"
                },
                "latestMaliciousThreatMonitoring": {
                    "snapshotFid": "12345678-1234-1234-1234-123456789012",
                    "monitoringScanTime": "2024-10-14T04:41:15Z",
                    "isMalicious": "Matches Found"
                },
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90"
            }
        }
    }
}

Human Readable Output

General Information for the given medium risk domain: DEMO-RADAR

Fid Last Snapshot Name Object Type Protection Status Redirect Link
12345678-1234-1234-1234-123456789012 2024-10-18T06:02:25Z DEMO-RADAR Vsphere Virtual Machine Protected https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview

Sensitive Information

Open Access Files Policy Names Redirect Link Risk Level Sensitive Files Sensitive Hits Stale Files
6 U.S. PII https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse Medium mediumCount: 11 2910 11

Anomaly Information

Created File Count Deleted File Count Detection Time Modified File Count Redirect Link Severity Suspicious File Count
4487 4477 2024-10-14T17:57:06Z 32 https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary Critical 4476

Threat Hunt Information

Latest Malicious Threat Hunt Latest Threat Hunt Redirect Link
huntId: 12345678-1234-1234-1234-123456789012
huntStartTime: 2024-10-11T09:23:26Z
isMalicious: Matches Found		 huntId: 12345678-1234-1234-1234-123456789012
huntStartTime: 2024-10-11T09:23:26Z
isMalicious: Matches Found		 https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details

Threat Monitoring Information

Latest Malicious Threat Monitoring Latest Threat Monitoring Redirect Link
snapshotFid: 12345678-1234-1234-1234-123456789012
monitoringScanTime: 2024-10-14T04:41:15Z
isMalicious: Matches Found		 snapshotFid: 12345678-1234-1234-1234-123456789012
monitoringScanTime: 2024-10-18T05:51:31Z
isMalicious: No Matches		 https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90

rubrik-radar-anomaly-status-update

Updates the status of the Anomaly detection.

Note: Run the “rubrik-radar-suspicious-file-list” command first to check the resolution status of the Anomaly Detection snapshot before executing this command.

Base Command

rubrik-radar-anomaly-status-update

Input

Argument Name Description Required
anomaly_type The type of the anomaly.

Note: For Anomaly Type, users can execute the “rubrik-radar-suspicious-file-list” command. Possible values are: FILESYSTEM, HYPERVISOR.		 Required
anomaly_id The ID of the Anomaly or Activity Series ID.

Note: For Activity Series ID, users can execute the “rubrik-event-list” command with the “activity_type” argument set to “ANOMALY”.		 Required
workload_id The workload ID (Snappable ID).

Note: Users can execute the “rubrik-event-list” command with the “activity_type” argument set to “ANOMALY” and get the value of “fid” from the context.		 Required
false_positive_type The type for marking the anomaly as a false positive. Possible values are: FP_TYPE_UNSPECIFIED, OS_UPDATE, APPLICATION_UPDATE, LOG_ROTATION, OTHER, NFA_SCHEDULED_MAINTENANCE, NFA_UNSCHEDULED_MAINTENANCE. Optional
false_positive_reason The reason for marking the anomaly as a false positive when the “false_positive_type” argument is set to OTHER. Optional

Context Output

Path Type Description
RubrikPolaris.AnomalyStatus.command_name String The name of the command.
RubrikPolaris.AnomalyStatus.anomaly_type String The type of the Anomaly.
RubrikPolaris.AnomalyStatus.anomaly_id String The ID of the Anomaly.
RubrikPolaris.AnomalyStatus.workload_id String The workload ID.
RubrikPolaris.AnomalyStatus.is_resloved Boolean Whether the Anomaly is resolved.
RubrikPolaris.AnomalyStatus.false_positive_type String The type of the false positive.
RubrikPolaris.AnomalyStatus.false_positive_reason String The reason for marking the Anomaly detection snapshot as a false positive.

Command example

!rubrik-radar-anomaly-status-update anomaly_id=00000000-0000-0000-0000-000000000001 anomaly_type=FILESYSTEM workload_id=00000000-0000-0000-0000-000000000002

Context Example

{
    "RubrikPolaris": {
        "AnomalyStatus": {
            "anomaly_id": "00000000-0000-0000-0000-000000000001",
            "anomaly_type": "FILESYSTEM",
            "command_name": "rubrik-radar-anomaly-update-status",
            "is_resloved": true,
            "workload_id": "00000000-0000-0000-0000-000000000002"
        }
    }
}

Human Readable Output

Anomaly detection with the ID 00000000-0000-0000-0000-000000000001 resolved successfully

rubrik-threat-monitoring-matched-object-list

List the matched objects for Threat Monitoring.

Base Command

rubrik-threat-monitoring-matched-object-list

Input

Argument Name Description Required
cluster_id The unique ID of the cluster. Supports comma separated values.

Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.		 Optional
object_type Filter the objects based on the provided object types. Supports comma separated values.

Note: Values not included in the predefined options can be found in the documentation.		 Optional
object_name Filter objects by their name. Supports partial matches. Optional
match_type Filter the objects by the match type. Supports comma separated values.

Possible values are: INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE.		 Optional
start_time Filter the objects detected after this time.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z. Default is 7 days.		 Optional
limit Number of results to retrieve in the response. The maximum allowed size is 1000. Optional
next_page_token The next page cursor to retrieve the next set of results. Optional

Context Output

Path Type Description
RubrikPolaris.ThreatMonitoring.objectFid String The unique identifier (FID) of the object.
RubrikPolaris.ThreatMonitoring.objectName String The name of the matched object.
RubrikPolaris.ThreatMonitoring.objectType String The type of the matched object.
RubrikPolaris.ThreatMonitoring.matchType Unknown A list of match types found for the object.
RubrikPolaris.ThreatMonitoring.filesMatched Number The number of files matched with the threat monitoring object.
RubrikPolaris.ThreatMonitoring.lastDetection Date The timestamp of the most recent detection.
RubrikPolaris.ThreatMonitoring.cluster.name String The name of the cluster the object belongs to.
RubrikPolaris.ThreatMonitoring.cluster.id String The unique identifier of the cluster.
RubrikPolaris.ThreatMonitoring.cluster.__typename String The GraphQL typename of the cluster object.
RubrikPolaris.ThreatMonitoring.__typename String The GraphQL typename of the matched object.
RubrikPolaris.PageToken.ThreatMonitoring.endCursor String The end cursor of the threat monitoring data.
RubrikPolaris.PageToken.ThreatMonitoring.hasNextPage Boolean A flag indicating if there is a next page of threat monitoring data.
RubrikPolaris.PageToken.ThreatMonitoring.hasPreviousPage Boolean A flag indicating if there is a previous page of threat monitoring data.
RubrikPolaris.PageToken.ThreatMonitoring.name String The name of the threat monitoring data.
RubrikPolaris.PageToken.ThreatMonitoring.total_matched_count Number The total number of matched objects.
RubrikPolaris.PageToken.ThreatMonitoring.startCursor String The start cursor of the threat monitoring data.

Command example

!rubrik-threat-monitoring-matched-object-list begin_time="3 days"

Context Example

{
    "RubrikPolaris": {
        "ThreatMonitoring": [
            {   
                "__typename": "dummy-typename",
                "cluster": {
                    "__typename": "dummy-typename",
                    "id": "dummy-cluster-id-123",
                    "name": "dummy-cluster-name"
                },
                "filesMatched": 1,
                "lastDetection": "2025-01-01T00:00:00.000Z",
                "matchType": [
                    "dummy-match-type"
                ],
                "objectFid": "dummy-fid-789012",
                "objectName": "dummy-object-name-456",
                "objectType": "dummy-object-type"
            }
        ],
        "PageToken": {
            "ThreatMonitoring": {
                "endCursor": "dummy-end-cursor",
                "hasNextPage": true,
                "hasPreviousPage": false,
                "name": "rubrik-threat-monitoring-matched-object-list",
                "startCursor": "dummy-start-cursor",
                "total_matched_count": 2
            }
        }
    }
}

Human Readable Output

Threat Monitoring Object List

Object ID Object Name Object Type Total Files Matched Match Types Last Detection Time Cluster ID Cluster Name
dummy-fid-789012 dummy-object-name-456 dummy-object-type 0 dummy-match-type 2025-01-01T00:00:00.000Z dummy-cluster-id-123 dummy-cluster-name

Note: To retrieve the next set of results use, “next_page_token” = dummy-end-cursor

rubrik-threat-monitoring-matched-object-get

Get the matched object for Threat Monitoring.

Base Command

rubrik-threat-monitoring-matched-object-get

Input

Argument Name Description Required
object_id The object ID for the threat monitoring object.

Note: Users can retrieve the object ID by executing the “rubrik-threat-monitoring-matched-object-list” command.		 Required

Context Output

Path Type Description
RubrikPolaris.ThreatMonitoring.id String The ID of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.name String The name of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.objectType String The object type of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.slaAssignment String The SLA assignment of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.slaPauseStatus String The SLA pause status of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.id String The ID of the effective SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.name String The name of the effective SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.version String The version of the effective SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.__typename String The type name of the effective SLA domain.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.id String The ID of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.totalCount Integer The total count of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.scheduledCount Integer The scheduled count of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.onDemandCount Integer The on-demand count of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.retrievedCount Integer The retrieved count of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.__typename String The type name of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.id String The ID of the effective retention SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.name String The name of the effective retention SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.version String The version of the effective retention SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.__typename String The type name of the effective retention SLA domain.
RubrikPolaris.ThreatMonitoring.configuredSlaDomain.id String The ID of the configured SLA domain.
RubrikPolaris.ThreatMonitoring.configuredSlaDomain.name String The name of the configured SLA domain.
RubrikPolaris.ThreatMonitoring.configuredSlaDomain.version String The version of the configured SLA domain.
RubrikPolaris.ThreatMonitoring.configuredSlaDomain.__typename String The type name of the configured SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.fid String The FID of the effective SLA source object.
RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.name String The name of the effective SLA source object.
RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.objectType String The object type of the effective SLA source object.
RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.__typename String The type name of the effective SLA source object.
RubrikPolaris.ThreatMonitoring.logicalPath.fid String The FID of the logical path.
RubrikPolaris.ThreatMonitoring.logicalPath.name String The name of the logical path.
RubrikPolaris.ThreatMonitoring.logicalPath.objectType String The object type of the logical path.
RubrikPolaris.ThreatMonitoring.logicalPath.__typename String The type name of the logical path.
RubrikPolaris.ThreatMonitoring.physicalPath.fid String The FID of the physical path.
RubrikPolaris.ThreatMonitoring.physicalPath.name String The name of the physical path.
RubrikPolaris.ThreatMonitoring.physicalPath.objectType String The object type of the physical path.
RubrikPolaris.ThreatMonitoring.physicalPath.__typename String The type name of the physical path.
RubrikPolaris.ThreatMonitoring.numWorkloadDescendants Integer The number of workload descendants.
RubrikPolaris.ThreatMonitoring.allOrgs.id String The ID of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.name String The name of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.description String The description of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.mfaStatus String The MFA status of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.allUrls String The all URLs of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.__typename String The type name of the organization.
RubrikPolaris.ThreatMonitoring.securityMetadata.lowSensitiveHits Integer The low sensitive hits of the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.mediumSensitiveHits Integer The medium sensitive hits of the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.highSensitiveHits Integer The high sensitive hits of the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.sensitivityStatus String The sensitivity status of the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.isLaminarEnabled Boolean A flag indicating whether laminar is enabled for the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.id String The ID of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.name String The name of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.totalHits Integer The total hits of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.totalViolatedHits Integer The total violated hits of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.__typename String The type name of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.__typename String The type name of the security metadata.
RubrikPolaris.ThreatMonitoring.__typename String The type name of the threat monitoring data.

Command example

!rubrik-threat-monitoring-matched-object-get object_id="00000000-0000-0000-0000-000000000001"

Context Example

{
    "RubrikPolaris": {
        "ThreatMonitoring": {
            "id": "00000000-0000-0000-0000-000000000001",
            "name": "DUMMY-NAME",
            "objectType": "Dummy_Object_Type",
            "slaAssignment": "Dummy_Assignment",
            "slaPauseStatus": false,
            "effectiveSlaDomain": {
                "id": "dummy-sla-id",
                "name": "Dummy_SLA_Domain",
                "version": "v0",
                "__typename": "Global_Sla_Reply"
            },
            "Snapshot_Distribution": {
                "id": "dummy-snapshot-id",
                "totalCount": 0,
                "scheduledCount": 0,
                "onDemandCount": 0,
                "retrievedCount": 0,
                "__typename": "Snapshot_Distribution"
            },
            "effectiveRetentionSlaDomain": null,
            "configuredSlaDomain": {
                "id": "dummy-configured-sla-id",
                "name": "Dummy_Configured_SLA",
                "version": "v0",
                "__typename": "Global_Sla_Reply"
            },
            "effectiveSlaSourceObject": {
                "fid": "dummy-fid-001",
                "name": "DUMMY-SOURCE-NAME",
                "objectType": "Dummy_Source_Type",
                "__typename": "Path_Node"
            },
            "logicalPath": [
                {
                    "fid": "dummy-logical-fid-001",
                    "name": "Dummy_Logical_Name1",
                    "objectType": "Dummy_Logical_Type1",
                    "__typename": "Path_Node"
                },
                {
                    "fid": "dummy-logical-fid-002",
                    "name": "Dummy_Logical_Name2",
                    "objectType": "Dummy_Logical_Type2",
                    "__typename": "Path_Node"
                }
            ],
            "physicalPath": [
                {
                    "fid": "dummy-physical-fid-001",
                    "name": "Dummy_Physical_Name1",
                    "objectType": "Dummy_Physical_Type1",
                    "__typename": "Path_Node"
                },
                {
                    "fid": "dummy-physical-fid-002",
                    "name": "Dummy_Physical_Name2",
                    "objectType": "Dummy_Physical_Type2",
                    "__typename": "Path_Node"
                }
            ],
            "numWorkloadDescendants": 0,
            "allOrgs": [],
            "securityMetadata": null,
            "__typename": "Vsphere_Vm"
        }
    }
}

Human Readable Output

Threat Monitoring Object Details

ID Name Object Type SLA Assignment Effective SLA Domain SLA Pause Status Configured SLA Domain Effective SLA Source Object Logical Path Physical Path NumWorkload Descendants
dummy-id-001 DUMMY-NAME Dummy_Object_Type Dummy_Assignment id: dummy-sla-id
name: Dummy_SLA_Domain
version: v0		 false id: dummy-configured-sla-id
name: Dummy_Configured_SLA
version: v0		 fid: dummy-fid-001
name: DUMMY-SOURCE-NAME
objectType: Dummy_Source_Type		 - fid: dummy-logical-fid-001
name: Dummy_Logical_Name1
objectType: Dummy_Logical_Type1
- fid: dummy-logical-fid-002
name: Dummy_Logical_Name2
objectType: Dummy_Logical_Type2		 - fid: dummy-physical-fid-001
name: Dummy_Physical_Name1
objectType: Dummy_Physical_Type1
- fid: dummy-physical-fid-002
name: Dummy_Physical_Name2
objectType: Dummy_Physical_Type2		 0

rubrik-threat-monitoring-matched-file-list

List the matched files for the Threat Monitoring object.

Base Command

rubrik-threat-monitoring-matched-file-list

Input

Argument Name Description Required
object_id The object ID for the threat monitoring object.

Note: Users can retrieve the object ID by executing the “rubrik-threat-monitoring-matched-object-list” command.		 Required
file_name Filter files by their name. Supports partial matches. Optional
limit Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50. Optional
next_page_token The next page cursor to retrieve the next set of results. Optional

Context Output

Path Type Description
RubrikPolaris.ThreatMonitoringFile.filepath String The full path of the matched file.
RubrikPolaris.ThreatMonitoringFile.detectedTime Date The timestamp when the file was detected.
RubrikPolaris.ThreatMonitoringFile.fileName String The name of the matched file.
RubrikPolaris.ThreatMonitoringFile.fileSize Number The size of the matched file in bytes.
RubrikPolaris.ThreatMonitoringFile.matchedSnapshotDate Date The date of the snapshot where the match occurred.
RubrikPolaris.ThreatMonitoringFile.matchedSnapshotFid String The FID of the snapshot where the match occurred.
RubrikPolaris.ThreatMonitoringFile.isMatchedSnapshotExpired Boolean A flag indicating whether the matched snapshot has expired.
RubrikPolaris.ThreatMonitoringFile.isFirstObservedSnapshotExpired Boolean A flag indicating whether the first observed snapshot has expired.
RubrikPolaris.ThreatMonitoringFile.matchType String The type of indicator match.
RubrikPolaris.ThreatMonitoringFile.isQuarantinedInFirstObservedSnapshot Boolean A flag indicating whether the file is quarantined in the first observed snapshot.
RubrikPolaris.ThreatMonitoringFile.objectFid String The FID of the associated object.
RubrikPolaris.ThreatMonitoringFile.firstObservedSnapshotFid String The FID of the first observed snapshot.
RubrikPolaris.ThreatMonitoringFile.firstObservedSnapshotDate Date The date of the first observed snapshot.
RubrikPolaris.ThreatMonitoringFile.objectType String The type of the associated object.
RubrikPolaris.ThreatMonitoringFile.objectName String The name of the associated object.
RubrikPolaris.ThreatMonitoringFile.matchId Number The ID of the match event.
RubrikPolaris.ThreatMonitoringFile.__typename String The GraphQL typename of the file match object.
RubrikPolaris.PageToken.ThreatMonitoringFile.endCursor String The end cursor of the threat monitoring file data.
RubrikPolaris.PageToken.ThreatMonitoringFile.hasNextPage Boolean A flag indicating if there is a next page of threat monitoring file data.
RubrikPolaris.PageToken.ThreatMonitoringFile.hasPreviousPage Boolean A flag indicating if there is a previous page of threat monitoring file data.
RubrikPolaris.PageToken.ThreatMonitoringFile.name String The name of the threat monitoring file data.
RubrikPolaris.PageToken.ThreatMonitoringFile.total_matched_count Number The total number of matched files.
RubrikPolaris.PageToken.ThreatMonitoringFile.startCursor String The start cursor of the threat monitoring file data.

Command example

!rubrik-threat-monitoring-matched-file-list object_id="dummy-object-id"

Context Example

{
    "RubrikPolaris": {
        "ThreatMonitoringFile": [
            {
                "filepath": "/dummy/path/file1.txt",
                "detectedTime": "2025-01-01T00:00:00.000Z",
                "fileName": "file1.txt",
                "fileSize": 1234,
                "matchedSnapshotDate": "2025-01-02T00:00:00.000Z",
                "matchedSnapshotFid": "dummy-snapshot-fid-1",
                "isMatchedSnapshotExpired": false,
                "isFirstObservedSnapshotExpired": false,
                "matchType": "DUMMY_TYPE",
                "isQuarantinedInFirstObservedSnapshot": true,
                "objectFid": "dummy-object-id",
                "firstObservedSnapshotFid": "dummy-first-snapshot-fid-1",
                "firstObservedSnapshotDate": "2025-01-02T00:00:00.000Z",
                "objectType": "DummyObjectType",
                "objectName": "dummy-object-name-1",
                "matchId": 1111,
                "__typename": "FileMatch"
            },
            {
                "filepath": "/dummy/path/file2.txt",
                "detectedTime": "2025-01-03T00:00:00.000Z",
                "fileName": "file2.txt",
                "fileSize": 5678,
                "matchedSnapshotDate": "2025-01-04T00:00:00.000Z",
                "matchedSnapshotFid": "dummy-snapshot-fid-2",
                "isMatchedSnapshotExpired": true,
                "isFirstObservedSnapshotExpired": true,
                "matchType": "DUMMY_TYPE",
                "isQuarantinedInFirstObservedSnapshot": false,
                "objectFid": "dummy-object-id",
                "firstObservedSnapshotFid": "dummy-first-snapshot-fid-2",
                "firstObservedSnapshotDate": "2025-01-04T00:00:00.000Z",
                "objectType": "DummyObjectType",
                "objectName": "dummy-object-name-2",
                "matchId": 2222,
                "__typename": "FileMatch"
            }
        ],
        "PageToken": {
            "ThreatMonitoringFile": {
                "startCursor": "dummy-start-cursor",
                "endCursor": "dummy-end-cursor",
                "hasNextPage": true,
                "hasPreviousPage": false,
                "name": "rubrik-threat-monitoring-matched-file-list",
                "total_matched_count": 99
            }
        }
    }
}

Human Readable Output

Threat Monitoring File List

File Name File Path File Size Matched Snapshot ID Matched Snapshot Date Matched Snapshot Expired
file1.txt /dummy/path/file1.txt 1234 dummy-snapshot-fid-1 2025-01-02T00:00:00.000Z false
file2.txt /dummy/path/file2.txt 5678 dummy-snapshot-fid-2 2025-01-04T00:00:00.000Z true

Note: To retrieve the next set of results use, “next_page_token” = dummy-end-cursor

rubrik-threat-monitoring-matched-file-get

Get the matched file for the Threat Monitoring object.

Base Command

rubrik-threat-monitoring-matched-file-get

Input

Argument Name Description Required
matched_snapshot_id ID of the snapshot where the threat monitoring match was found.

Note: Users can retrieve the matched snapshot ID by executing the “rubrik-threat-monitoring-matched-file-list” command.		 Required
file_path Path of the file.

Note: Users can retrieve the file path by executing the “rubrik-threat-monitoring-matched-file-list” command.		 Required

Context Output

Path Type Description
RubrikPolaris.ThreatMonitoringFile.matchedFileMd5 String The MD5 hash of the matched file.
RubrikPolaris.ThreatMonitoringFile.matchedFileSha1 String The SHA1 hash of the matched file.
RubrikPolaris.ThreatMonitoringFile.matchedFileSha256 String The SHA256 hash of the matched file.
RubrikPolaris.ThreatMonitoringFile.iocDetails.matchType String The type of IOC match.
RubrikPolaris.ThreatMonitoringFile.iocDetails.intelFeedName String The name of the intelligence feed that provided the IOC.
RubrikPolaris.ThreatMonitoringFile.iocDetails.malwareName String The name of the malware associated with the IOC.
RubrikPolaris.ThreatMonitoringFile.iocDetails.iocRuleAuthor String The author of the IOC rule.
RubrikPolaris.ThreatMonitoringFile.iocDetails.malwareDescription String The description of the malware associated with the IOC.
RubrikPolaris.ThreatMonitoringFile.iocDetails.iocHashHex String The hash value of the IOC in hexadecimal format.
RubrikPolaris.ThreatMonitoringFile.iocDetails.iocStatus String The status of the IOC.
RubrikPolaris.ThreatMonitoringFile.iocDetails.__typename String The GraphQL typename of the IOC details.
RubrikPolaris.ThreatMonitoringFile.isQuarantinedInFirstObservedSnapshot Boolean A flag indicating whether the file was quarantined in the first observed snapshot.
RubrikPolaris.ThreatMonitoringFile.detectedSnapshotDate String The date when the file was detected in the snapshot.
RubrikPolaris.ThreatMonitoringFile.firstDetectedSnapshotFid String The ID of the first snapshot where the file was detected.
RubrikPolaris.ThreatMonitoringFile.filePath String The full path of the file.
RubrikPolaris.ThreatMonitoringFile.fileName String The name of the file.
RubrikPolaris.ThreatMonitoringFile.__typename String The GraphQL typename of the threat monitoring file.

Command example

!rubrik-threat-monitoring-matched-file-get matched_snapshot_id="test-id" file_path="/dummy/path/file1.txt"

Context Example

{
    "RubrikPolaris": {
        "ThreatMonitoringFile": {
            "matchedFileMd5": "00000000000000001",
            "matchedFileSha1": "0000000000000000000000001",
            "matchedFileSha256": "0000000000000000000000000000000000000000000000000000000000001",
            "iocDetails": [
                {
                    "matchType": "IOC_HASH",
                    "intelFeedName": "Dummy_Feed",
                    "malwareName": "Dummy_Malware",
                    "iocRuleAuthor": "Dummy_Author",
                    "malwareDescription": "Dummy description for testing purposes",
                    "iocHashHex": "00000000000000001",
                    "iocStatus": "ACTIVE",
                    "__typename": "IOCDetails"
                }
            ],
            "isQuarantinedInFirstObservedSnapshot": false,
            "detectedSnapshotDate": "2025-01-01T00:00:00.000Z",
            "firstDetectedSnapshotFid": "00000000-0000-0000-0000-000000000001",
            "filePath": "/dummy/path/file1.txt",
            "fileName": "dummyfile.com",
            "__typename": "ThreatMonitoringFileMatchDetailsV2"
        }
    }
}

Human Readable Output

Threat Monitoring File Details

File Name File Path File Hashes IOC Details First Detected Snapshot FID Detected Snapshot Date Quarantined In First Observed Snapshot
dummyfile.com /dummy/path/file1.txt MD5: 00000000000000001
SHA1: 0000000000000000000000001
SHA256: 0000000000000000000000000000000000000000000000000000000000001		 - matchType: IOC_HASH
intelFeedName: Dummy_Feed
malwareName: Dummy_Malware
iocRuleAuthor: Dummy_Author
malwareDescription: Dummy description for testing purposes
iocHashHex: 00000000000000001
iocStatus: ACTIVE		 00000000-0000-0000-0000-000000000001 2025-01-01T00:00:00.000Z false

rubrik-ioc-scan-list-v2

List details of the Turbo and Advance Threat Hunt.

Base Command

rubrik-ioc-scan-list-v2

Input

Argument Name Description Required
cluster_id The ID of the cluster whose IOC scans are to be listed. Supports comma separated values.

Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.		 Optional
ioc_match Filter hunts on any matches.

Possible values are: MATCHES_FOUND, NO_MATCHES, UNSCANNED.		 Optional
hunt_status Filter by hunt status.

Possible values are: ABORTED, CANCELED, CANCELING, FAILED, IN_PROGRESS, PARTIALLY_SUCCEEDED, PENDING, SUCCEEDED.		 Optional
quarantine_status Filter by quarantine matches.

Possible values are: QUARANTINED_MATCHES, NO_QUARANTINED_MATCHES.		 Optional
start_time Filter the threat hunts that started after this time.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z. Default is 7 days.		 Optional
end_time Filter the threat hunts that ended before this time.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.		 Optional
limit Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50. Optional
next_page_token The next page cursor to retrieve the next set of results. Optional

Context Output

Path Type Description
RubrikPolaris.IOCScan.huntId string The unique identifier for the threat hunt.
RubrikPolaris.IOCScan.name string The name of the threat hunt.
RubrikPolaris.IOCScan.createdBy.id string The ID of the user who initiated the hunt.
RubrikPolaris.IOCScan.createdBy.username string The username of the user who initiated the hunt.
RubrikPolaris.IOCScan.createdBy.email string The email of the user who initiated the hunt.
RubrikPolaris.IOCScan.createdBy.__typename string The GraphQL typename of the user object.
RubrikPolaris.IOCScan.huntType string The type of the threat hunt.
RubrikPolaris.IOCScan.startTime date The start time of the threat hunt.
RubrikPolaris.IOCScan.status string The current status of the threat hunt.
RubrikPolaris.IOCScan.stats.totalProcessedSnapshots number The total number of processed snapshots.
RubrikPolaris.IOCScan.stats.totalAffectedObjects number The total number of affected objects.
RubrikPolaris.IOCScan.stats.totalAffectedSnapshots number The total number of affected snapshots.
RubrikPolaris.IOCScan.stats.totalUniqueMatchedPaths number The total number of unique matched file paths.
RubrikPolaris.IOCScan.stats.totalSucceededScans number The total number of successful scans.
RubrikPolaris.IOCScan.stats.totalSnapshotsScanned number The total number of snapshots scanned.
RubrikPolaris.IOCScan.stats.totalUniqueQuarantinedPaths number The total number of unique quarantined file paths.
RubrikPolaris.IOCScan.stats.totalObjectsScanned number The total number of objects scanned.
RubrikPolaris.IOCScan.stats.totalIocs number The total number of IOCs used in the scan.
RubrikPolaris.IOCScan.stats.__typename string The GraphQL typename of the stats object.
RubrikPolaris.IOCScan.huntDetails.startTime date The start time of the detailed threat hunt process.
RubrikPolaris.IOCScan.huntDetails.endTime date The end time of the detailed threat hunt process.
RubrikPolaris.IOCScan.huntDetails.cluster.id string The ID of the cluster used in the hunt.
RubrikPolaris.IOCScan.huntDetails.cluster.name string The name of the cluster used in the hunt.
RubrikPolaris.IOCScan.huntDetails.cluster.__typename string The GraphQL typename of the cluster object.
RubrikPolaris.IOCScan.huntDetails.config.name string The name of the configuration used in the hunt.
RubrikPolaris.IOCScan.huntDetails.config.indicatorsOfCompromise unknown The list of indicators of compromise.
RubrikPolaris.IOCScan.huntDetails.config.__typename string The GraphQL typename of the hunt config object.
RubrikPolaris.IOCScan.huntDetails.__typename string The GraphQL typename of the hunt details object.
RubrikPolaris.IOCScan.__typename string The GraphQL typename of the top-level threat hunt object.
RubrikPolaris.PageToken.IOCScan.endCursor string The end cursor of the IOC scan data.
RubrikPolaris.PageToken.IOCScan.hasNextPage boolean A flag indicating if there is a next page of IOC scan data.
RubrikPolaris.PageToken.IOCScan.hasPreviousPage boolean A flag indicating if there is a previous page of IOC scan data.
RubrikPolaris.PageToken.IOCScan.name string The name of the IOC scan data.
RubrikPolaris.PageToken.IOCScan.startCursor string The start cursor of the IOC scan data.
RubrikPolaris.PageToken.IOCScan.total_matched_count number The total number of matched IOC scans.

Command example

!rubrik-ioc-scan-list-v2 limit=1

Context Example

{
    "RubrikPolaris": {
        "IOCScan": [
            {
                "huntId": "dummy-hunt-id-0001",
                "name": "Dummy Threat Hunt",
                "createdBy": {
                    "id": "client|dummy-user-id",
                    "username": "dummyuser",
                    "email": "dummyuser@example.com",
                    "__typename": "User"
                },
                "huntType": "THREAT_HUNT_V2",
                "startTime": "2025-07-01T00:00:00.000Z",
                "status": "SUCCEEDED",
                "stats": {
                    "totalProcessedSnapshots": 10,
                    "totalAffectedObjects": 2,
                    "totalAffectedSnapshots": 1,
                    "totalUniqueMatchedPaths": 3,
                    "totalSucceededScans": 10,
                    "totalSnapshotsScanned": 12,
                    "totalUniqueQuarantinedPaths": 1,
                    "totalObjectsScanned": 20,
                    "totalIocs": 5,
                    "__typename": "ThreatHuntStats"
                },
                "huntDetails": {
                    "startTime": "2025-07-01T00:00:00.000Z",
                    "endTime": "2025-07-01T01:00:00.000Z",
                    "cluster": {
                        "id": "dummy-cluster-id",
                        "name": "Dummy Cluster",
                        "__typename": "Cluster"
                    },
                    "config": {
                        "name": "Dummy Hunt Config",
                        "indicatorsOfCompromise": [],
                        "__typename": "ThreatHuntConfig"
                    },
                    "__typename": "ThreatHuntDetails"
                },
                "__typename": "ThreatHunt"
            }
        ],
        "PageToken": {
            "IOCScan": {
                "endCursor": "dummy-end-cursor",
                "hasNextPage": true,
                "hasPreviousPage": false,
                "startCursor": "dummy-start-cursor",
                "name": "rubrik-ioc-scan-list-v2",
                "total_matched_count": 2
            }
        }
    }
}

Human Readable Output

IOC Scan List

Hunt ID Hunt Type Status Start Time
dummy-hunt-id-0001 THREAT_HUNT_V2 SUCCEEDED 2025-07-01T00:00:00.000Z

Note: To retrieve the next set of results use, “next_page_token” = dummy-end-cursor

rubrik-ioc-scan-results-v2

Retrieve details of the Turbo and Advance Threat Hunt.

Base Command

rubrik-ioc-scan-results-v2

Input

Argument Name Description Required
hunt_id The ID of the threat hunt.

Note: Users can retrieve the hunt ID by executing the “rubrik-ioc-scan-list-v2” command.		 Required

Context Output

Path Type Description
RubrikPolaris.IOCScan.hunt_id string The ID of the threat hunt.
RubrikPolaris.IOCScan.totalObjectFids number The total number of object FIDs involved in the threat hunt.
RubrikPolaris.IOCScan.startTime date The start time of the threat hunt.
RubrikPolaris.IOCScan.endTime date The end time of the threat hunt.
RubrikPolaris.IOCScan.status string The current status of the threat hunt.
RubrikPolaris.IOCScan.totalMatchedSnapshots number The total number of matched snapshots.
RubrikPolaris.IOCScan.totalScannedSnapshots number The total number of scanned snapshots.
RubrikPolaris.IOCScan.totalUniqueFileMatches number The total number of unique file matches.
RubrikPolaris.IOCScan.clusters.id string The ID of the cluster.
RubrikPolaris.IOCScan.clusters.name string The name of the cluster.
RubrikPolaris.IOCScan.clusters.type string The type of the cluster.
RubrikPolaris.IOCScan.clusters.__typename string The GraphQL typename of the cluster object.
RubrikPolaris.IOCScan.baseConfig.name string The name of the base configuration used in the threat hunt.
RubrikPolaris.IOCScan.baseConfig.notes string The notes added to the hunt configuration.
RubrikPolaris.IOCScan.baseConfig.maxMatchesPerSnapshot number The maximum number of matches allowed per snapshot.
RubrikPolaris.IOCScan.baseConfig.threatHuntType string The type of the threat hunt.
RubrikPolaris.IOCScan.baseConfig.__typename string The GraphQL typename of the base configuration object.
RubrikPolaris.IOCScan.baseConfig.ioc.__typename string The GraphQL typename of the IOC object.
RubrikPolaris.IOCScan.baseConfig.ioc.iocList.__typename string The GraphQL typename of the IOC list container.
RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.iocKind string The type of IOC.
RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.iocValue string The value of the IOC indicator.
RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.__typename string The GraphQL typename of the IOC indicator.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.__typename string The GraphQL typename of the snapshot scan limit object.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.__typename string The GraphQL typename of the scan limit configuration.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.maxSnapshotsPerObject number The maximum snapshots to scan per object.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.startTime date The start time for the snapshot scan window.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.endTime date The end time for the snapshot scan window.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.__typename string The GraphQL typename of the scan limit configuration.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.objectSnapshotConfig string An object snapshot configuration.
RubrikPolaris.IOCScan.baseConfig.fileScanCriteria string A file scan criteria.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalObjectsScanned number The total number of objects scanned during the hunt.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalAffectedObjects number The total number of affected objects.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalUnaffectedObjects number The total number of unaffected objects.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalObjectsUnscannable number The total number of objects that couldn’t be scanned.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.unaffectedObjectsFromDb number The number of clean objects retrieved from the database.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.cleanRecoverableObjectLimit number The maximum number of clean recoverable objects allowed.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.__typename string The GraphQL typename of the object metrics reply.
RubrikPolaris.IOCScan.__typename string The GraphQL typename of the root hunt details object.

Command example

!rubrik-ioc-scan-results-v2 hunt_id="test-hunt-id"

Context Example

{
    "RubrikPolaris": {
        "IOCScan": {
            "hunt_id": "test-hunt-id",
            "totalObjectFids": 100,
            "startTime": "2025-01-01T08:00:00.000Z",
            "endTime": "2025-01-01T09:00:00.000Z",
            "status": "SUCCEEDED",
            "totalMatchedSnapshots": 10,
            "totalScannedSnapshots": 200,
            "totalUniqueFileMatches": 3,
            "clusters": [
                {
                    "id": "dummy-cluster-id-123",
                    "name": "Dummy_Cluster",
                    "type": "DummyType",
                    "__typename": "Cluster"
                }
            ],
            "baseConfig": {
                "name": "Dummy Threat Hunt Config",
                "notes": "Dummy note here.",
                "maxMatchesPerSnapshot": 0,
                "threatHuntType": "TURBO_THREAT_HUNT",
                "ioc": {
                    "iocList": {
                        "indicatorsOfCompromise": [
                            {
                                "iocKind": "IOC_HASH",
                                "iocValue": "dummyhashvalue0000000000000000000001",
                                "__typename": "IndicatorOfCompromise"
                            },
                            {
                                "iocKind": "IOC_HASH",
                                "iocValue": "dummyhashvalue0000000000000000000002",
                                "__typename": "IndicatorOfCompromise"
                            }
                        ],
                        "__typename": "IndicatorOfCompromiseInputOutputListType"
                    },
                    "__typename": "Ioc"
                },
                "snapshotScanLimit": {
                    "scanLimit": {
                        "scanConfig": {
                            "maxSnapshotsPerObject": 5,
                            "startTime": "2025-01-01T00:00:00.000Z",
                            "endTime": "2025-01-10T00:00:00.000Z",
                            "__typename": "SnapshotScanConfig"
                        },
                        "__typename": "ScanLimit"
                    },
                    "__typename": "HuntScanSnapshotLimit"
                },
                "__typename": "ThreatHuntBaseConfig"
            },
            "__typename": "ThreatHuntDetailsV2",
            "threatHuntObjectMetrics": {
                "totalObjectsScanned": 100,
                "totalAffectedObjects": 5,
                "totalUnaffectedObjects": 95,
                "totalObjectsUnscannable": 0,
                "unaffectedObjectsFromDb": 95,
                "cleanRecoverableObjectLimit": 999,
                "__typename": "ThreatHuntObjectMetricsReply"
            }
        }
    }
}

Human Readable Output

IOC Scan Data

Hunt Name Hunt Type Status IOC Details Object Metrics Scan Metrics Start Time End Time
Dummy Threat Hunt Config TURBO_THREAT_HUNT SUCCEEDED - iocKind: IOC_HASH
iocValue: dummyhashvalue0000000000000000000001
- iocKind: IOC_HASH
iocValue: dummyhashvalue0000000000000000000002		 totalObjectsScanned: 100
totalAffectedObjects: 5
totalUnaffectedObjects: 95
totalObjectsUnscannable: 0
unaffectedObjectsFromDb: 95
cleanRecoverableObjectLimit: 999		 totalMatchedSnapshots: 10
totalScannedSnapshots: 200
totalUniqueFileMatches: 3		 2025-01-01T08:00:00.000Z 2025-01-01T09:00:00.000Z

rubrik-turbo-ioc-scan

Start a new turbo threat hunt.

Base Command

rubrik-turbo-ioc-scan

Input

Argument Name Description Required
ioc The value of the indicator to scan for. Supports comma separated values.

Note: Users can retrieve the Md5, SHA1 or SHA256 by executing the “rubrik-threat-monitoring-matched-file-get” command.		 Required
scan_name Name of the new turbo threat hunt scan. Default is PAXSOAR-1.6.0. Optional
cluster_id The ID of the cluster on which to perform a scan. If not provided, all the clusters will be scanned.

Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.		 Optional
start_time Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.

For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.		 Optional
end_time Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.

For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.		 Optional
max_snapshots_per_object Maximum number of snapshots to scan per object. Optional

Context Output

Path Type Description
RubrikPolaris.TurboIOCScan.huntId String The ID of the new turbo threat hunt.
RubrikPolaris.TurboIOCScan.__typename String The type of the new turbo threat hunt.

Command example

!rubrik-turbo-ioc-scan ioc="00000000000000000001"

Context Example

{
    "RubrikPolaris": {
        "TurboIOCScan": {
            "huntId": "000000000-0000-0000-0000-000000001",
            "__typename": "StartTurboThreatHuntReply"
        }
    }
}

Human Readable Output

The new Turbo Threat Hunt started with ID: 000000000-0000-0000-0000-000000001

rubrik-advance-ioc-scan

Start a new advance threat hunt.

Base Command

rubrik-advance-ioc-scan

Input

Argument Name Description Required
object_id The Object ID of the system on which to perform the scan. Supports comma separated values.

Note: Users can get the list of object IDs by executing the “rubrik-polaris-object-list” command.		 Required
ioc_type The type of the indicator to scan.

Note: To provide multiple IOCs use the argument “advance_ioc”. Possible values are: INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE.		 Optional
ioc_value The value of the indicator to scan.

Note: To provide multiple IOCs use the argument “advance_ioc”.		 Optional
scan_name Name of the new advanced threat hunt scan. Default is PAXSOAR-1.6.0. Optional
advance_ioc Json encoded Indicators Of Compromise to scan. Json keys signify the type of IOC and the corresponding list of values are the values of the IOC’s. If provided, will ignore the ioc_type and ioc_value arguments.

Possible keys to indicate type of indicator:
INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE

Format Accepted:
{
“<ioc_type1>”: [“<ioc_value1>”, “<ioc_value2>”],
“<ioc_type2>”: “<ioc_value3>“
}

Example:
{
“INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME”: [“C:\\Users\\Malware_Executible.ps1”, “\\bin\\Malware_Executible”],
“INDICATOR_OF_COMPROMISE_TYPE_HASH”: [“e5c1b9c44be582f895eaea3d3738c5b4”, “f541b9844be897f895eaea3d3738cfb2”],
“INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE”: “rule match_everything {condition:true}”
}.		 Optional
max_matches_per_snapshot Maximum number of IOC matches allowed per snapshot. Optional
start_date Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.

For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.		 Optional
end_date Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.

For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.		 Optional
max_snapshots_per_object Maximum number of snapshots to scan per object. Optional
min_file_size Minimum size of the file in bytes that will be included in the scan. Optional
max_file_size Maximum size of the file in bytes that will be included in the scan. Optional
paths_to_include Paths to include in the scan. Supports comma separated values.

Format accepted: “path_to_include_1, path_to_include_2”.		 Optional
paths_to_exclude Paths to exclude from the scan. Supports comma separated values.

Format accepted: “path_to_exclude_1, path_to_exclude_2”.		 Optional
paths_to_exempt Paths to exempt from exclusion. Supports comma separated values.

Format accepted: “path_to_exempt_1, path_to_exempt_2”.		 Optional

Context Output

Path Type Description
RubrikPolaris.AdvanceIOCScan.huntId string The ID of the new advance threat hunt.
RubrikPolaris.AdvanceIOCScan.huntName string The name or label of the advanced threat hunt.
RubrikPolaris.AdvanceIOCScan.config.huntType string The type of threat hunt configuration.
RubrikPolaris.AdvanceIOCScan.config.clusterUuids unknown The list of cluster UUIDs included in the hunt config.
RubrikPolaris.AdvanceIOCScan.config.objectFids unknown The list of object FIDs targeted by the hunt.
RubrikPolaris.AdvanceIOCScan.config.__typename string The GraphQL typename for the HuntConfig object.
RubrikPolaris.AdvanceIOCScan.status string The status of the threat hunt execution.
RubrikPolaris.AdvanceIOCScan.__typename string The GraphQL typename for the HuntResponse object.

Command example

!rubrik-advance-ioc-scan object_id="obj-123" ioc_type="INDICATOR_OF_COMPROMISE_TYPE_HASH" ioc_value="test-ioc-value"

Context Example

{
    "RubrikPolaris": {
        "AdvanceIOCScan": {
            "huntId": "hunt-abc",
            "huntName": "Test Hunt",
            "config": {
                "huntType": "THREAT_HUNT_V2",
                "clusterUuids": ["cluster-1"],
                "objectFids": ["obj-123"],
                "__typename": "HuntConfig"
            },
            "status": "HUNT_TRIGGER_SUCCEEDED",
            "__typename": "HuntResponse"
        }
    }
}

Human Readable Output

The new advance Threat Hunt started with ID: hunt-abc

rubrik-anomaly-csv-analysis-v2

Request for the analysis and directly download the anomaly CSV analyzed file.

Base Command

rubrik-anomaly-csv-analysis-v2

Input

Argument Name Description Required
cluster_id The unique ID of the cluster.

Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.		 Required
snapshot_id The CDM snapshot ID.

Note: Use the “rubrik-radar-suspicious-file-list” command to retrieve the actual CDM ID from the Anomaly ID.
Example format to get the snapshot CDM ID from Anomaly ID: “<Cluster-ID>:::VirtualMachine:::<Snappable-ID>:::<CDM-ID>”.		 Required
object_id The VM object ID (Snappable ID).

Note: Users can retrieve the list of Snappable IDs by executing the “rubrik-polaris-vm-objects-list” command.
Example format to get the Snappable ID: “VirtualMachine:::<Snappable-ID>”.		 Required

Context Output

Path Type Description
RubrikPolaris.AnomalyCSVv2.clusterId String The ID of the cluster.
RubrikPolaris.AnomalyCSVv2.snapshotId String The ID of the snapshot.
RubrikPolaris.AnomalyCSVv2.objectId String The ID of the object.
RubrikPolaris.AnomalyCSVv2.externalId String The external ID of the CSV file.
RubrikPolaris.AnomalyCSVv2.isSuccessful Boolean Whether the CSV analysis was successful or not.
InfoFile.Name string FileName.
InfoFile.EntryID string The EntryID of the report.
InfoFile.Size number File Size.
InfoFile.Type string File type e.g. “PE”.
InfoFile.Info string Basic information of the file.

Command example

!rubrik-anomaly-csv-analysis-v2 cluster_id="00000000-0000-0000-0000-000000000000" snapshot_id="00000000-0000-0000-0000-000000000000" object_id="00000000-0000-0000-0000-000000000000-vm-000"

Context Example

{
    "InfoFile": {
        "EntryID": "10000@00000000-0000-0000-0000-000000000001",
        "Extension": "csv",
        "Info": "text/csv; charset=utf-8",
        "Name": "snapshot_00000000-0000-0000-0000-000000000000.csv",
        "Size": 1771317,
        "Type": "ASCII text, with very long lines"
    },
    "RubrikPolaris": {
        "AnomalyCSVv2": {
            "clusterId": "00000000-0000-0000-0000-000000000000",
            "externalId": "00000000-0000-0000-0000-000000000000",
            "isSuccessful": true,
            "objectId": "00000000-0000-0000-0000-000000000000-vm-000",
            "snapshotId": "00000000-0000-0000-0000-000000000000"
        }
    }
}

Human Readable Output

Successfully downloaded the analyzed CSV file

rubrik-data-security-violation-list

Retrieve the list of DSPM violations.

Base Command

rubrik-data-security-violation-list

Input

Argument Name Description Required
object_type Filter the violations based on object types. Supports comma separated values.

Note: Values not included in the options can be found in the documentation. Possible values are: AWS_NATIVE_DYNAMODB_TABLE, AWS_NATIVE_EBS_VOLUME, AWS_NATIVE_RDS_INSTANCE, AWS_NATIVE_S3_BUCKET, AZURE_MANAGED_DISK, AZURE_SQL_DATABASE_DB, AZURE_SQL_MANAGED_INSTANCE_DB, AZURE_STORAGE_ACCOUNT, AZURE_VIRTUAL_MACHINE, GCP_NATIVE_DISK, GCP_NATIVE_GCE_INSTANCE, HYPERV_VIRTUAL_MACHINE, K8S_PROTECTION_SET, K8S_VIRTUAL_MACHINE, LINUX_FILESET, NAS_FILESET, NUTANIX_VIRTUAL_MACHINE, O365_ONEDRIVE, O365_SITE, ORACLE_DATA_GUARD_GROUP, ORACLE_DATABASE, SHARE_FILESET, VOLUME_GROUP, VSPHERE_VIRTUAL_MACHINE, WINDOWS_FILESET.		 Optional
detection_start_date Filter the violations detected after this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: detection_start_date and detection_end_date both or none of them should be initialized.		 Optional
detection_end_date Filter the violations detected before this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: detection_start_date and detection_end_date both or none of them should be initialized.		 Optional
resolved_start_date Filter the violations resolved after this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: resolved_start_date and resolved_end_date both or none of them should be initialized.		 Optional
resolved_end_date Filter the violations resolved before this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: resolved_start_date and resolved_end_date both or none of them should be initialized.		 Optional
category Filter the violations by category. Supports comma separated values. Possible values are: CATEGORY_UNSPECIFIED, MISPLACED, REDUNDANT, OVEREXPOSED, UNPROTECTED. Optional
status Filter the violations by status. Supports comma separated values. Possible values are: OPEN, IN_PROGRESS, REMEDIATED, DISMISSED, CLOSED. Optional
severity Filter the violations by severity level. Supports comma separated values. Possible values are: SEVERITY_UNSPECIFIED, LOW, MEDIUM, HIGH, CRITICAL. Optional
sensitivity Filter the violations by sensitivity level. Supports comma separated values. Possible values are: HIGH, MEDIUM, LOW, NO. Optional
limit Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50. Optional
next_page_token The next page cursor to retrieve the next set of results. Optional
sort_by Specify the field to use for sorting the response. Possible values are: SEVERITY, HITS, DETECTION_TIME, UPDATE_TIME, IDENTITY_TYPE, FILES_AT_RISK, TOTAL_HITS, ACCESSIBLE_OBJECTS, ORIGIN, EVENT_TIME, NAME, TYPE. Default is DETECTION_TIME. Optional
sort_order Specify the order to sort the data in. Possible values are: ASC, DESC. Default is DESC. Optional

Context Output

Path Type Description
RubrikPolaris.DSPMViolation.policyViolationId String The unique identifier for the policy violation.
RubrikPolaris.DSPMViolation.status String The current status of the policy violation.
RubrikPolaris.DSPMViolation.__typename String The GraphQL typename for the violation object.
RubrikPolaris.DSPMViolation.createdAt Date The date and time when the policy violation was created.
RubrikPolaris.DSPMViolation.lastUpdatedAt Date The date and time when the policy violation was last updated.
RubrikPolaris.DSPMViolation.policy.policyId String The unique identifier of the policy associated with the violation.
RubrikPolaris.DSPMViolation.policy.name String The name of the policy associated with the violation.
RubrikPolaris.DSPMViolation.policy.policySeverity String The severity level assigned to the policy.
RubrikPolaris.DSPMViolation.policy.__typename String The GraphQL typename for the policy object.
RubrikPolaris.DSPMViolation.resourceId String The unique identifier of the resource associated with the violation.
RubrikPolaris.DSPMViolation.resourceType String The type of the resource associated with the violation.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.name String The name of the resource where the violation occurred.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.objectType String The object type of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.platform String The platform of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.physicalHost String The physical host where the resource resides.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.accountName String The name of the associated cloud account.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.__typename String The GraphQL typename for the cloud account info object.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.__typename String The GraphQL typename for the resource metadata details object.
RubrikPolaris.DSPMViolation.resourceMetadata.__typename String The GraphQL typename for the resource metadata object.
RubrikPolaris.DSPMViolation.details.dataCategories.id String The ID of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.name String The name of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.totalViolatedHits Integer The total violated hits of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.__typename String The type name of the data category.
RubrikPolaris.DSPMViolation.details.dataTypes.id String The ID of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.name String The name of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.totalViolatedHits Integer The total violated hits of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.__typename String The type name of the data type.
RubrikPolaris.DSPMViolation.details.violatedNoRiskSensitiveHits Number The number of no-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedLowRiskSensitiveHits Number The number of low-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedMediumRiskSensitiveHits Number The number of medium-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedHighRiskSensitiveHits Number The number of high-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.snapshotId String The ID of the snapshot associated with the violation details.
RubrikPolaris.DSPMViolation.details.__typename String The GraphQL typename for the violation details object.
RubrikPolaris.DSPMViolation.remediations.type String The type of the remediation action.
RubrikPolaris.DSPMViolation.remediations.state String The state of the remediation action.
RubrikPolaris.DSPMViolation.remediations.remediationDetails Unknown Detailed information about the remediation action.
RubrikPolaris.DSPMViolation.remediations.__typename String The GraphQL typename for the remediation object.
RubrikPolaris.DSPMViolation.remediations Unknown The list of remediations associated with the violation.
RubrikPolaris.PageToken.DSPMViolation.next_page_token String Next page token.
RubrikPolaris.PageToken.DSPMViolation.name String Name of the command.
RubrikPolaris.PageToken.DSPMViolation.has_next_page Boolean Whether the result has the next page or not.

Command example

!rubrik-data-security-violation-list status="OPEN" severity="MEDIUM" limit="50"

Context Example

{
    "RubrikPolaris": {
        "DSPMViolation": [
            {
                "policyViolationId": "00000000-0000-0000-0000-000000000001",
                "status": "POLICY_VIOLATION_STATUS_OPEN",
                "__typename": "PolicyViolation",
                "createdAt": "2026-03-06T06:30:45.000Z",
                "lastUpdatedAt": "2026-03-24T05:30:07.000Z",
                "name": "Secrets stored outside of vault",
                "violationSeverity": "MEDIUM",
                "policy": {
                    "policyId": "00000000-0000-0000-0000-000000000010",
                    "name": "Secrets stored outside of vault",
                    "policySeverity": "MEDIUM",
                    "policyCategory": "MISPLACED",
                    "description": "Detects secrets stored outside of vault",
                    "__typename": "DSPMPolicy"
                },
                "resourceId": "00000000-0000-0000-0000-000000000020",
                "resourceType": "RESOURCE_TYPE_OBJECT",
                "resourceMetadata": {
                    "metadata": {
                        "name": "DEMO-RADAR02",
                        "objectType": "VSPHERE_VIRTUAL_MACHINE",
                        "platform": "PLATFORM_DATA_CENTER",
                        "physicalHost": "rubrikdemo.com/Datacenters/Data Center/vm/Discovered virtual machine",
                        "__typename": "CommonAssetMetadata"
                    },
                    "__typename": "ResourceMetadata"
                },
                "details": {
                    "dataCategories": [
                        {
                            "__typename": "DataCategoryStats",
                            "id": "00000000-0000-0000-0000-000000000010",
                            "name": "",
                            "totalViolatedHits": 1
                        },
                        {
                            "__typename": "DataCategoryStats",
                            "id": "00000000-0000-0000-0000-000000000020",
                            "name": "",
                            "totalViolatedHits": 1
                        }
                    ],
                    "dataTypes": [
                        {
                            "__typename": "DataTypeStats",
                            "id": "00000000-0000-0000-0000-000000000010",
                            "name": "",
                            "totalViolatedHits": 1
                        },
                        {
                            "__typename": "DataTypeStats",
                            "id": "00000000-0000-0000-0000-000000000020",
                            "name": "",
                            "totalViolatedHits": 1
                        }
                    ],
                    "violatedNoRiskSensitiveHits": 37,
                    "violatedLowRiskSensitiveHits": 2,
                    "violatedMediumRiskSensitiveHits": 1,
                    "violatedHighRiskSensitiveHits": 0,
                    "snapshotId": "00000000-0000-0000-0000-000000000030",
                    "__typename": "DataGovViolationDetails"
                },
                "remediations": [
                    {
                        "type": "REMEDIATION_TYPE_EXPORT_ACTIONS_LOG_TO_CSV",
                        "state": "REMEDIATION_STATE_SUCCESS",
                        "__typename": "RemediationMetadata"
                    }
                ]
            },
            {
                "policyViolationId": "00000000-0000-0000-0000-000000000002",
                "status": "POLICY_VIOLATION_STATUS_OPEN",
                "__typename": "PolicyViolation",
                "createdAt": "2026-02-25T15:30:25.000Z",
                "lastUpdatedAt": "2026-03-23T16:30:05.000Z",
                "name": "Stale sensitive data",
                "violationSeverity": "LOW",
                "policy": {
                    "policyId": "00000000-0000-0000-0000-000000000011",
                    "name": "Stale sensitive data - not modified for over a year",
                    "policySeverity": "LOW",
                    "policyCategory": "REDUNDANT",
                    "description": "Detects stale sensitive data",
                    "__typename": "DSPMPolicy"
                },
                "resourceId": "00000000-0000-0000-0000-000000000021",
                "resourceType": "RESOURCE_TYPE_OBJECT",
                "resourceMetadata": {
                    "metadata": {
                        "name": "file-store",
                        "objectType": "AWS_NATIVE_S3_BUCKET",
                        "platform": "PLATFORM_AWS",
                        "physicalHost": "rubrik-lab/us-east-1",
                        "cloudAccountInfo": {
                            "accountName": "rubrik-lab",
                            "__typename": "CloudAccountInfo"
                        },
                        "__typename": "CommonAssetMetadata"
                    },
                    "__typename": "ResourceMetadata"
                },
                "details": {
                    "violatedNoRiskSensitiveHits": 83,
                    "violatedLowRiskSensitiveHits": 0,
                    "violatedMediumRiskSensitiveHits": 0,
                    "violatedHighRiskSensitiveHits": 7,
                    "snapshotId": "00000000-0000-0000-0000-000000000031",
                    "__typename": "DataGovViolationDetails"
                }
            }
        ]
    },
    "RubrikPolaris": {
        "PageToken": {
            "DSPMViolation": {
                "name": "rubrik-data-security-violation-list",
                "next_page_token": "hash_token",
                "has_next_page": true
            }
        }
    }
}

Human Readable Output

DSPM Violations List

ID Violation Name Severity Object Name Violation Status High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Detection On
00000000-0000-0000-0000-000000000001 Secrets stored outside of vault Medium DEMO-RADAR02 Open 0 1 2 37 2026-03-06T06:30:45.000Z
00000000-0000-0000-0000-000000000002 Stale sensitive data - not modified for over a year Low file-store Open 7 0 0 83 2026-02-25T15:30:25.000Z

Note: To retrieve the next set of results use, “next_page_token” = hash_token

rubrik-data-security-violation-get

Retrieve the details of DSPM violation based on the provided violation ID.

Base Command

rubrik-data-security-violation-get

Input

Argument Name Description Required
violation_id The ID of the DSPM violation.

Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.		 Required

Context Output

Path Type Description
RubrikPolaris.DSPMViolation.policyViolationId String The unique identifier for the policy violation.
RubrikPolaris.DSPMViolation.status String The current status of the policy violation.
RubrikPolaris.DSPMViolation.__typename String The GraphQL typename for the violation object.
RubrikPolaris.DSPMViolation.createdAt Date The date and time when the policy violation was created.
RubrikPolaris.DSPMViolation.lastUpdatedAt Date The date and time when the policy violation was last updated.
RubrikPolaris.DSPMViolation.policy.policyId String The unique identifier of the policy associated with the violation.
RubrikPolaris.DSPMViolation.policy.name String The name of the policy associated with the violation.
RubrikPolaris.DSPMViolation.policy.policySeverity String The severity level assigned to the policy.
RubrikPolaris.DSPMViolation.policy.__typename String The GraphQL typename for the policy object.
RubrikPolaris.DSPMViolation.resourceId String The unique identifier of the resource associated with the violation.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.name String The name of the resource where the violation occurred.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.objectType String The object type of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.platform String The platform of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.physicalHost String The physical host where the resource resides.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.accountName String The name of the associated cloud account.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.__typename String The GraphQL typename for the cloud account info object.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.__typename String The GraphQL typename for the resource metadata details object.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.clusterName String The name of the cluster.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.clusterUuid String The UUID of the cluster.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.__typename String The GraphQL typename for the cluster info object.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.creationTime Number The creation time of the metadata.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.lastAccessTime Number The last access time of the metadata.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.snapshotTimestamp Number The snapshot timestamp.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.isDeleted Boolean Whether the resource is deleted.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.region String The region of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.__typename String The GraphQL typename for the resource metadata object.
RubrikPolaris.DSPMViolation.details.violatedNoRiskSensitiveHits Number The number of no-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedLowRiskSensitiveHits Number The number of low-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedMediumRiskSensitiveHits Number The number of medium-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedHighRiskSensitiveHits Number The number of high-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedSensitiveHits Number The total number of violated sensitive hits.
RubrikPolaris.DSPMViolation.details.dataTypes.id String The ID of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.name String The name of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.totalViolatedHits Number The total violated hits for the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.__typename String The GraphQL typename for the data type stats.
RubrikPolaris.DSPMViolation.details.mipLabels Unknown The MIP labels associated with the details.
RubrikPolaris.DSPMViolation.details.documentTypes Unknown The document types associated with the details.
RubrikPolaris.DSPMViolation.details.dataCategories.id String The ID of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.name String The name of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.totalViolatedHits Number The total violated hits for the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.__typename String The GraphQL typename for the data category stats.
RubrikPolaris.DSPMViolation.details.snapshotId String The ID of the snapshot associated with the violation details.
RubrikPolaris.DSPMViolation.details.__typename String The GraphQL typename for the violation details object.
RubrikPolaris.DSPMViolation.policy.description String The description of the policy.
RubrikPolaris.DSPMViolation.policy.policyCategory String The category of the policy.
RubrikPolaris.DSPMViolation.policy.containsAccessFilters Boolean Whether the policy contains access filters.
RubrikPolaris.DSPMViolation.remediations.state String The state of the remediation action.
RubrikPolaris.DSPMViolation.remediations.remediationId String The ID of the remediation.
RubrikPolaris.DSPMViolation.remediations.remediationDetails Unknown Detailed information about the remediation action.
RubrikPolaris.DSPMViolation.remediations.__typename String The GraphQL typename for the remediation object.

Command example

!rubrik-data-security-violation-get violation_id="00000000-0000-0000-0000-000000000001"

Context Example

{
    "RubrikPolaris": {
        "DSPMViolation": {
            "policyViolationId": "00000000-0000-0000-0000-000000000001",
            "status": "POLICY_VIOLATION_STATUS_OPEN",
            "violationSeverity": "MEDIUM",
            "createdAt": "2026-03-06T06:30:45.000Z",
            "lastUpdatedAt": "2026-03-24T05:30:07.000Z",
            "resourceId": "00000000-0000-0000-0000-000000000002",
            "__typename": "PolicyViolation",
            "policy": {
                "policyId": "00000000-0000-0000-0000-000000000003",
                "name": "Secrets stored outside of vault",
                "description": "Storing secrets outside vaults can lead to privilege escalation and unauthorized access. Store secrets in a secure vault to limit exposure.",
                "policyCategory": "MISPLACED",
                "policySeverity": "MEDIUM",
                "containsAccessFilters": false,
                "__typename": "DSPMPolicy"
            },
            "resourceMetadata": {
                "metadata": {
                    "name": "DEMO-RADAR02",
                    "objectType": "VSPHERE_VIRTUAL_MACHINE",
                    "platform": "PLATFORM_DATA_CENTER",
                    "physicalHost": "vcsa.rubrikdemo.com/Datacenters/Data Center/vm/Discovered virtual machine",
                    "clusterInfo": {
                        "clusterName": "Cluster_C",
                        "clusterUuid": "00000000-0000-0000-0000-000000000004",
                        "__typename": "ClusterInfo"
                    },
                    "creationTime": 0,
                    "lastAccessTime": 0,
                    "snapshotTimestamp": 1774329080131,
                    "isDeleted": false,
                    "region": "",
                    "cloudAccountInfo": {
                        "accountName": "",
                        "__typename": "CloudAccountInfo"
                    },
                    "__typename": "CommonAssetMetadata"
                },
                "__typename": "ResourceMetadata"
            },
            "details": {
                "snapshotId": "00000000-0000-0000-0000-000000000005",
                "violatedSensitiveHits": 40,
                "violatedNoRiskSensitiveHits": 37,
                "violatedLowRiskSensitiveHits": 2,
                "violatedMediumRiskSensitiveHits": 1,
                "violatedHighRiskSensitiveHits": 0,
                "__typename": "DataGovViolationDetails",
                "dataTypes": [
                    {
                        "id": "00000000-0000-0000-0000-000000000006",
                        "name": "Country",
                        "totalViolatedHits": 35,
                        "__typename": "DataTypeStats"
                    },
                    {
                        "id": "00000000-0000-0000-0000-000000000007",
                        "name": "US State",
                        "totalViolatedHits": 2,
                        "__typename": "DataTypeStats"
                    }
                ],
                "dataCategories": [
                    {
                        "id": "00000000-0000-0000-0000-000000000008",
                        "name": "Geographical",
                        "totalViolatedHits": 37,
                        "__typename": "DataCategoryStats"
                    }
                ]
            },
            "remediations": [
                {
                    "remediationId": "00000000-0000-0000-0000-000000000009",
                    "state": "REMEDIATION_STATE_SUCCESS",
                    "__typename": "RemediationMetadata"
                }
            ]
        }
    }
}

Human Readable Output

DSPM Violation Data

ID Violation Name Severity Violation Status Detection Time Last Updated Policy ID Policy Description Policy Category Policy Severity Total Risk Hits High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Snapshot ID Object ID Object Name Object Type Object Location Object Platform Cluster ID Cluster Name Data Types Data Categories
00000000-0000-0000-0000-000000000001 Secrets stored outside of vault Medium Open 2026-03-06T06:30:45.000Z 2026-03-24T05:30:07.000Z 00000000-0000-0000-0000-000000000003 Storing secrets outside vaults can lead to privilege escalation and unauthorized access. Store secrets in a secure vault to limit exposure. MISPLACED Medium 40 0 1 2 37 00000000-0000-0000-0000-000000000005 00000000-0000-0000-0000-000000000002 DEMO-RADAR02 VSPHERE_VIRTUAL_MACHINE vcsa.rubrikdemo.com/Datacenters/Data Center/vm/Discovered virtual machine PLATFORM_DATA_CENTER 00000000-0000-0000-0000-000000000004 Cluster_C - id: 00000000-0000-0000-0000-000000000006
name: Country
totalViolatedHits: 35
- id: 00000000-0000-0000-0000-000000000007
name: US State
totalViolatedHits: 2		 - id: 00000000-0000-0000-0000-000000000008
name: Geographical
totalViolatedHits: 37

rubrik-data-security-violation-status-update

Updates the status of the DSPM violation.

Base Command

rubrik-data-security-violation-status-update

Input

Argument Name Description Required
violation_id The ID of the DSPM violation.

Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.		 Required
status The status to update for violation. Possible values are: OPEN, IN_PROGRESS, REMEDIATED, DISMISSED, CLOSED. Required

Context Output

Path Type Description
RubrikPolaris.DSPMViolation.policyViolationId String The ID of the violation.
RubrikPolaris.DSPMViolation.status String The status of the violation.

Command example

!rubrik-data-security-violation-status-update violation_id="00000000-0000-0000-0000-000000000001" status="IN_PROGRESS"

Context Example

{
    "RubrikPolaris": {
        "DSPMViolation": {
            "policyViolationId": "00000000-0000-0000-0000-000000000001",
            "status": "POLICY_VIOLATION_STATUS_IN_PROGRESS"
        }
    }
}

Human Readable Output

Successfully updated the DSPM violation status to In Progress

rubrik-data-security-violation-file-list

Retrieve the file information of data security violation based on the provided violation ID.

Base Command

rubrik-data-security-violation-file-list

Input

Argument Name Description Required
violation_id The ID of the DSPM violation.

Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.		 Required
snapshot_id The snapshot ID.

Note: Users can get the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.		 Required
object_id The object ID.

Note: Users can get the Object ID by executing the “rubrik-polaris-objects-list” command.		 Required
limit Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 25. Optional
next_page_token The next page cursor to retrieve the next set of results. Optional
file_name Filter files by their name. Optional
last_access_start_date Filter files with last access after this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: last_access_start_date and last_access_end_date both or none of them should be initialized.		 Optional
last_access_end_date Filter files with last access before this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: last_access_start_date and last_access_end_date both or none of them should be initialized.		 Optional
last_modified_start_date Filter files with last modified after this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: last_modified_start_date and last_modified_end_date both or none of them should be initialized.		 Optional
last_modified_end_date Filter files with last modified before this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: last_modified_start_date and last_modified_end_date both or none of them should be initialized.		 Optional
creation_start_date Filter files created after this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: creation_date_start_date and creation_date_start_date both or none of them should be initialized.		 Optional
creation_end_date Filter files created before this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: creation_date_start_date and creation_date_start_date both or none of them should be initialized.		 Optional
last_scan_start_date Filter files with last scan after this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: last_scan_start_date and last_scan_end_date both or none of them should be initialized.		 Optional
last_scan_end_date Filter files with last scan before this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: last_scan_start_date and last_scan_end_date both or none of them should be initialized.		 Optional
sensitivity Filter files by sensitivity level. Supports comma separated values. Possible values are: HIGH, MEDIUM, LOW, NO. Optional
exposure Filter files by exposure type. Supports comma separated values. Possible values are: EXPLICIT, INHERITED, NOT_OPEN, PUBLIC. Optional
access_via Filter files by access type. Possible values are: ACCESS_TYPE_UNSPECIFIED, DIRECT, GROUP, ROLE. Default is ACCESS_TYPE_UNSPECIFIED. Optional
sort_order Specify the order to sort the data in. Possible values are: ASC, DESC. Default is DESC. Optional
sort_by Specify the field to use for sorting the response. Possible values are: CLUSTER, CREATION_TIME, DAILY_CHANGE, DATA_CATEGORY, DATA_TYPE, DOCUMENT_TYPE, EXPOSED_FILES, FILES_WITH_HITS, FILES_WITH_OPEN_ACCESS_HITS, HITS, HITS_BY_SENSITIVITY, LAST_ACCESS_TIME, LAST_MODIFIED, LAST_SCAN_TIME, NAME, NATIVE_PATH, NUM_ACTIVITIES, NUM_ACTIVITIES_DELTA, OBJECT_LOCATION, OBJECT_NAME, OPEN_ACCESS_TYPE, SNAPSHOT_TIME, STALE_FILES_WITH_HITS, TOTAL_SENSITIVE_HITS. Default is HITS. Optional

Context Output

Path Type Description
Rubrik.DSPMViolationFile.nativePath String The native path of the file.
Rubrik.DSPMViolationFile.stdPath String The standardized path of the file.
Rubrik.DSPMViolationFile.filename String The name of the file.
Rubrik.DSPMViolationFile.mode String The file mode.
Rubrik.DSPMViolationFile.size Number The file size in bytes.
Rubrik.DSPMViolationFile.lastAccessTime Number The last access time of the file.
Rubrik.DSPMViolationFile.lastModifiedTime Number The last modified time of the file.
Rubrik.DSPMViolationFile.creationTime Number The creation time of the file.
Rubrik.DSPMViolationFile.lastScanTime Number The last scan time of the file.
Rubrik.DSPMViolationFile.directory String The directory of the file.
Rubrik.DSPMViolationFile.createdBy String The user who created the file.
Rubrik.DSPMViolationFile.modifiedBy String The user who last modified the file.
Rubrik.DSPMViolationFile.numDescendantFiles Number The number of descendant files.
Rubrik.DSPMViolationFile.numDescendantErrorFiles Number The number of descendant files with errors.
Rubrik.DSPMViolationFile.numDescendantSkippedExtFiles Number The number of descendant files skipped due to extension.
Rubrik.DSPMViolationFile.numDescendantSkippedSizeFiles Number The number of descendant files skipped due to size.
Rubrik.DSPMViolationFile.errorCode String The error code.
Rubrik.DSPMViolationFile.hits.totalHits Number The total number of hits.
Rubrik.DSPMViolationFile.hits.violations Number The number of violations.
Rubrik.DSPMViolationFile.hits.violationsDelta Number The change in the number of violations.
Rubrik.DSPMViolationFile.hits.totalHitsDelta Number The change in the total number of hits.
Rubrik.DSPMViolationFile.hits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.filesWithHits.totalHits Number The total number of hits in files.
Rubrik.DSPMViolationFile.filesWithHits.violations Number The number of violations in files.
Rubrik.DSPMViolationFile.filesWithHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.openAccessFilesWithHits.totalHits Number The total number of hits in open access files.
Rubrik.DSPMViolationFile.openAccessFilesWithHits.violations Number The number of violations in open access files.
Rubrik.DSPMViolationFile.openAccessFilesWithHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.staleFilesWithHits.totalHits Number The total number of hits in stale files.
Rubrik.DSPMViolationFile.staleFilesWithHits.violations Number The number of violations in stale files.
Rubrik.DSPMViolationFile.staleFilesWithHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.groupType String The type of the analyzer group.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.id String The ID of the analyzer group.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.name String The name of the analyzer group.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.totalHits Number The total number of hits.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.violations Number The number of violations.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.id String The ID of the analyzer.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.name String The name of the analyzer.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.analyzerType String The type of the analyzer.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.totalHits Number The total number of hits.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.violations Number The number of violations.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.violationsDelta Number The change in the number of violations.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.totalHitsDelta Number The change in the total number of hits.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.totalCount Number The total count of high risk files.
Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.violatedCount Number The count of high risk files with violations.
Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.totalCount Number The total count of medium risk files.
Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.violatedCount Number The count of medium risk files with violations.
Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.totalCount Number The total count of low risk files.
Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.violatedCount Number The count of low risk files with violations.
Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.noRiskFileCount Unknown The count of files with no risk.
Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.totalCount Number The total count of files.
Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.violatedCount Number The count of files with violations.
Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.totalHits Number The total number of high risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.violatedHits Number The number of violated high risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.totalHits Number The total number of medium risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.violatedHits Number The number of violated medium risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.totalHits Number The total number of low risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.violatedHits Number The number of violated low risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.totalHits Number The total number of no risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.violatedHits Number The number of violated no risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.totalHits Number The total number of high risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.violatedHits Number The number of violated high risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.totalHits Number The total number of medium risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.violatedHits Number The number of violated medium risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.totalHits Number The total number of low risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.violatedHits Number The number of violated low risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.totalHits Number The total number of no risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.violatedHits Number The number of violated no risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerResults.hits.totalHits Number The total number of hits.
Rubrik.DSPMViolationFile.analyzerResults.hits.violations Number The number of violations.
Rubrik.DSPMViolationFile.analyzerResults.hits.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerResults.analyzer.id String The ID of the analyzer.
Rubrik.DSPMViolationFile.analyzerResults.analyzer.name String The name of the analyzer.
Rubrik.DSPMViolationFile.analyzerResults.analyzer.analyzerType String The type of the analyzer.
Rubrik.DSPMViolationFile.analyzerResults.analyzer.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerResults.__typename String The GraphQL type name.
Rubrik.DSPMViolationFile.openAccessType String The open access type.
Rubrik.DSPMViolationFile.stalenessType String The staleness type.
Rubrik.DSPMViolationFile.numActivities Number The number of activities.
Rubrik.DSPMViolationFile.numActivitiesDelta Number The change in the number of activities.
Rubrik.DSPMViolationFile.exposureSummary Unknown The exposure summary.
Rubrik.DSPMViolationFile.dbEntityType String The database entity type.
Rubrik.DSPMViolationFile.mipLabelsSummary Unknown The MIP labels summary.
Rubrik.DSPMViolationFile.documentTypesSummary Unknown The document types summary.
Rubrik.DSPMViolationFile.__typename String The GraphQL type name.

Command example

!rubrik-data-security-violation-file-list violation_id="00000000-0000-0000-0000-000000000001" snapshot_id="00000000-0000-0000-0000-000000010001" object_id="00000000-0000-0000-0000-000000000002"

Context Example

{
    "RubrikPolaris": {
        "DSPMViolationFile": [
            {
                "nativePath": "/Sales Department/fileName.txt",
                "stdPath": "/Sales Department/fileName.txt",
                "filename": "fileName.txt",
                "mode": "FILE",
                "size": 67615,
                "lastAccessTime": 0,
                "lastModifiedTime": 1684957676,
                "creationTime": 0,
                "lastScanTime": 1775406966,
                "directory": "/Sales Department",
                "createdBy": "",
                "modifiedBy": "",
                "numDescendantFiles": 0,
                "numDescendantErrorFiles": 0,
                "numDescendantSkippedExtFiles": 0,
                "numDescendantSkippedSizeFiles": 0,
                "errorCode": "NOERROR",
                "hits": {
                    "totalHits": 0,
                    "violations": 3022,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "filesWithHits": {
                    "totalHits": 0,
                    "violations": 1,
                    "__typename": "Hits"
                },
                "openAccessFilesWithHits": {
                    "totalHits": 0,
                    "violations": 0,
                    "__typename": "Hits"
                },
                "staleFilesWithHits": {
                    "totalHits": 0,
                    "violations": 1,
                    "__typename": "Hits"
                },
                "analyzerGroupResults": [
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000008",
                            "name": "Personal",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000003",
                                    "name": "Italy Passport Number",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "ITIN",
                                    "analyzerType": "US_ITIN",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 0,
                            "violations": 1533,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    },
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000007",
                            "name": "Geographical",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000005",
                                    "name": "Country",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000006",
                                    "name": "County",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 0,
                            "violations": 1489,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    }
                ],
                "sensitiveFiles": {
                    "highRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "mediumRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 1,
                        "__typename": "SummaryCount"
                    },
                    "lowRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "totalFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "__typename": "SensitiveFiles"
                },
                "sensitiveHits": {
                    "highRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 1533,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 1489,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "SensitiveHits"
                },
                "analyzerRiskHits": {
                    "highRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 1533,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "AnalyzerHits"
                },
                "analyzerResults": [
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 758,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000013",
                            "name": "First Name",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    },
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 9,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000009",
                            "name": "EU Country",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    },
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 765,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000010",
                            "name": "City",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    },
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 715,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000011",
                            "name": "US State",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    },
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 775,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000012",
                            "name": "Last Name",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    }
                ],
                "openAccessType": "UNKNOWN_ACCESS",
                "stalenessType": "IS_STALE",
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "dbEntityType": "UNDEFINED_ENTITY",
                "__typename": "FileResult"
            },
            {
                "nativePath": "/Sales Department/fileName1.txt",
                "stdPath": "/Sales Department/fileName1.txt",
                "filename": "fileName1.txt",
                "mode": "FILE",
                "size": 25653,
                "lastAccessTime": 0,
                "lastModifiedTime": 1684957355,
                "creationTime": 0,
                "lastScanTime": 1775406966,
                "directory": "/Sales Department",
                "createdBy": "",
                "modifiedBy": "",
                "numDescendantFiles": 0,
                "numDescendantErrorFiles": 0,
                "numDescendantSkippedExtFiles": 0,
                "numDescendantSkippedSizeFiles": 0,
                "errorCode": "NOERROR",
                "hits": {
                    "totalHits": 0,
                    "violations": 790,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "filesWithHits": {
                    "totalHits": 0,
                    "violations": 1,
                    "__typename": "Hits"
                },
                "openAccessFilesWithHits": {
                    "totalHits": 0,
                    "violations": 0,
                    "__typename": "Hits"
                },
                "staleFilesWithHits": {
                    "totalHits": 0,
                    "violations": 1,
                    "__typename": "Hits"
                },
                "analyzerGroupResults": [
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000007",
                            "name": "Geographical",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 21,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000005",
                                    "name": "Country",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000006",
                                    "name": "County",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 0,
                            "violations": 397,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    },
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000008",
                            "name": "Personal",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000003",
                                    "name": "Italy Passport Number",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "ITIN",
                                    "analyzerType": "US_ITIN",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 0,
                            "violations": 393,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    }
                ],
                "sensitiveFiles": {
                    "highRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "mediumRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 1,
                        "__typename": "SummaryCount"
                    },
                    "lowRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "totalFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "__typename": "SensitiveFiles"
                },
                "sensitiveHits": {
                    "highRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 393,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 397,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "SensitiveHits"
                },
                "analyzerRiskHits": {
                    "highRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 393,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "AnalyzerHits"
                },
                "analyzerResults": [
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 192,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000010",
                            "name": "City",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    }
                ],
                "openAccessType": "UNKNOWN_ACCESS",
                "stalenessType": "IS_STALE",
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "dbEntityType": "UNDEFINED_ENTITY",
                "__typename": "FileResult"
            }
        ]
    },
    "RubrikPolaris": {
        "PageToken": {
            "DSPMViolationFile": {
                "name": "rubrik-data-security-violation-file-list",
                "next_page_token": "end_hash_cursor",
                "has_next_page": true
            }
        }
    }
}

Human Readable Output

DSPM Violation File List

File Path File Size in Bytes Total Risk Hits High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Last Access Time Last Modified Time Data Categories
/Sales Department/fileName.txt 67615 3022 0 1533 0 1489 1970-01-01T00:00:00Z 2023-05-24T19:47:56Z - id: 00000000-0000-0000-0000-000000000008
name: Personal
totalViolatedHits: 1533
- id: 00000000-0000-0000-0000-000000000007
name: Geographical
totalViolatedHits: 1489
/Sales Department/fileName1.txt 25653 790 0 393 0 397 1970-01-01T00:00:00Z 2023-05-24T19:42:35Z - id: 00000000-0000-0000-0000-000000000007
name: Geographical
totalViolatedHits: 397
- id: 00000000-0000-0000-0000-000000000008
name: Personal
totalViolatedHits: 393

Note: To retrieve the next set of results use, “next_page_token” = end_hash_cursor

rubrik-data-security-violation-csv-download

Download all files at risk as CSV file for the specified data security violation.

Base Command

rubrik-data-security-violation-csv-download

Input

Argument Name Description Required
violation_id The ID of the DSPM violation.

Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.		 Required
snapshot_id The snapshot ID.

Note: Users can retrieve the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.		 Required
object_id The object ID.

Note: Users can retrieve the object ID by executing the “rubrik-polaris-objects-list” command.		 Required
object_name The object Name.

Note: If not specified command will retrieve it using the “rubrik-data-security-violation-get” command.		 Optional

Context Output

Path Type Description
RubrikPolaris.DSPMViolationCSVDownload.violationId String The ID of the violation.
RubrikPolaris.DSPMViolationCSVDownload.snapshotId String The ID of the snapshot.
RubrikPolaris.DSPMViolationCSVDownload.objectId String The ID of the object.
RubrikPolaris.DSPMViolationCSVDownload.objectName String The Name of the object.
RubrikPolaris.DSPMViolationCSVDownload.externalId String The external ID of the CSV file.
RubrikPolaris.DSPMViolationCSVDownload.isSuccessful Boolean Whether the CSV analysis was successful or not.
InfoFile.Name string FileName.
InfoFile.EntryID string The EntryID of the report.
InfoFile.Size number File Size.
InfoFile.Type string File type e.g. “PE”.
InfoFile.Info string Basic information of the file.

Command example

!rubrik-data-security-violation-csv-download violation_id="00000000-0000-0000-0000-000000000001" snapshot_id="00000000-0000-0000-0000-000000010001" object_id="00000000-0000-0000-0000-000000000002"

Context Example

{
    "InfoFile": {
        "EntryID": "10000@00000000-0000-0000-0000-000000000001",
        "Extension": "csv",
        "Info": "text/csv; charset=utf-8",
        "Name": "test_object-violating-files_file_results_1775629027.csv",
        "Size": 1771317,
        "Type": "ASCII text, with very long lines"
    },
    "RubrikPolaris": {
        "DSPMViolationCSVDownload": {
            "violationId": "00000000-0000-0000-0000-000000000001",
            "objectId": "00000000-0000-0000-0000-000000000002",
            "snapshotId": "00000000-0000-0000-0000-000000010001",
            "objectName": "test_object",
            "externalId": "00000000-0000-0000-0000-000000000011",
            "isSuccessful": true
        }
    }
}

Human Readable Output

Successfully downloaded the Files at Risk CSV file

rubrik-data-security-violation-log-download

Download remediation logs as CSV file for the specified data security violation.

Base Command

rubrik-data-security-violation-log-download

Input

Argument Name Description Required
violation_id The ID of the DSPM violation.

Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.		 Required
object_id The object ID.

Note: Users can retrieve the object ID by executing the “rubrik-polaris-objects-list” command.		 Required
object_name The object Name.

Note: If not specified command will retrieve it using the “rubrik-data-security-violation-get” command.		 Optional

Context Output

Path Type Description
RubrikPolaris.DSPMViolationRemediationLogDownload.violationId String The ID of the violation.
RubrikPolaris.DSPMViolationRemediationLogDownload.objectId String The ID of the object.
RubrikPolaris.DSPMViolationRemediationLogDownload.remediationId String The ID of the remediation.
RubrikPolaris.DSPMViolationRemediationLogDownload.objectName String The Name of the object.
RubrikPolaris.DSPMViolationRemediationLogDownload.externalId String The external ID of the file.
RubrikPolaris.DSPMViolationRemediationLogDownload.isSuccessful Boolean Whether the command was successful or not.
InfoFile.Name string FileName.
InfoFile.EntryID string The EntryID of the report.
InfoFile.Size number File Size.
InfoFile.Type string File type e.g. “PE”.
InfoFile.Info string Basic information of the file.

Command example

!rubrik-data-security-violation-log-download violation_id="00000000-0000-0000-0000-000000000001" object_id="00000000-0000-0000-0000-000000000002"

Context Example

{
    "InfoFile": {
        "EntryID": "10000@00000000-0000-0000-0000-000000000001",
        "Extension": "csv",
        "Info": "text/csv; charset=utf-8",
        "Name": "test_object actions log.csv",
        "Size": 1771317,
        "Type": "ASCII text, with very long lines"
    },
    "RubrikPolaris": {
        "DSPMViolationRemediationLogDownload": {
            "violationId": "00000000-0000-0000-0000-000000000001",
            "objectId": "00000000-0000-0000-0000-000000000002",
            "remediationId": "00000000-0000-0000-0000-000000010001",
            "externalId": "00000000-0000-0000-0000-000000000011",
            "objectName": "test_object",
            "isSuccessful": true
        }
    }
}

Human Readable Output

Successfully downloaded the Remediation Log file

rubrik-identity-resilience-violation-list

Retrieves the list of Identity Resilience (IR) violations.

Base Command

rubrik-identity-resilience-violation-list

Input

Argument Name Description Required
policy_type Filter the violations by policy type. Supports comma separated values. Possible values are: IDENTITY, IDP, IDENTITY_EVENT, CROWDSTRIKE, MICROSOFT_DEFENDER. Optional
detection_start_date Filter the violations detected after this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: detection_start_date and detection_end_date both or none of them should be initialized.		 Optional
detection_end_date Filter the violations detected before this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: detection_start_date and detection_end_date both or none of them should be initialized.		 Optional
resolved_start_date Filter the violations resolved after this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: resolved_start_date and resolved_end_date both or none of them should be initialized.		 Optional
resolved_end_date Filter the violations resolved before this date.

Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.

Note: resolved_start_date and resolved_end_date both or none of them should be initialized.		 Optional
category Filter the violations by category. Supports comma separated values. Possible values are: CATEGORY_UNSPECIFIED, AUTHENTICATION_AND_SECRET_MANAGEMENT, IDENTITY_HYGIENE, EXCESSIVE_IDENTITY_RIGHTS, IDENTITY_PROVIDER_SECURITY, PRIVILEGED_ACCOUNT_RISK, IDENTITY_RISK, INFRASTRUCTURE_SECURITY, CONFIGURATION_SECURITY, MEMBERSHIP_CHANGE, GPO_CHANGE. Optional
status Filter the violations by status. Supports comma separated values. Possible values are: OPEN, IN_PROGRESS, REMEDIATED, DISMISSED, CLOSED. Optional
severity Filter the violations by severity level. Supports comma separated values. Possible values are: SEVERITY_UNSPECIFIED, LOW, MEDIUM, HIGH, CRITICAL. Optional
identity_provider Filter the violations by identity provider type. Supports comma separated values. Possible values are: IDP_UNSPECIFIED, ON_PREM_AD, ENTRA_ID, AWS, LOCAL_AD, SHAREPOINT, SYSTEM, OKTA. Optional
identity_tag Filter the violations by identity tag. Supports comma separated values. Possible values are: IDENTITY_TAG_UNSPECIFIED, PRIVILEGED, AT_RISK, SENSITIVE. Optional
limit Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50. Optional
next_page_token The next page cursor to retrieve the next set of results. Optional
sort_by Specify the field to use for sorting the response. Possible values are: SEVERITY, HITS, DETECTION_TIME, UPDATE_TIME, IDENTITY_TYPE, TOTAL_HITS, EVENT_TIME, NAME, TYPE. Default is DETECTION_TIME. Optional
sort_order Specify the order to sort the data in. Possible values are: ASC, DESC. Default is DESC. Optional

Context Output

Path Type Description
RubrikPolaris.IRViolation.policyViolationId String The unique identifier for the policy violation.
RubrikPolaris.IRViolation.name String The name of the policy violation.
RubrikPolaris.IRViolation.violationSeverity String The severity level of the policy violation.
RubrikPolaris.IRViolation.status String The current status of the policy violation.
RubrikPolaris.IRViolation.createdAt Date The date and time when the policy violation was created.
RubrikPolaris.IRViolation.lastUpdatedAt Date The date and time when the policy violation was last updated.
RubrikPolaris.IRViolation.resourceId String The unique identifier of the resource associated with the violation.
RubrikPolaris.IRViolation.resourceType String The type of the resource associated with the violation.
RubrikPolaris.IRViolation.policy.policyId String The unique identifier of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.name String The name of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.description String The description of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.policySeverity String The severity level assigned to the policy.
RubrikPolaris.IRViolation.policy.policyCategory String The category of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.policyType String The type of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.frameworks String The compliance frameworks associated with the policy.
RubrikPolaris.IRViolation.policy.manualRemediationProcess String The manual remediation process recommended for the policy violation.
RubrikPolaris.IRViolation.details.domainUniqueId String The unique identifier of the domain associated with the violation details.
RubrikPolaris.IRViolation.details.detectionTime Date The time at which the threat was detected.
RubrikPolaris.IRViolation.details.startTime Date The start time of the alert event.
RubrikPolaris.IRViolation.details.endTime Date The end time of the alert event.
RubrikPolaris.IRViolation.details.mitreTactic String The MITRE ATT&CK tactic associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.displayName String The display name of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.domainName String The domain name of the resource associated with the violation.
RubrikPolaris.IRViolation.resourceMetadata.metadata.domainUniqueId String The unique identifier of the domain of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.idpType String The identity provider type of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.principalType String The principal type of the identity resource (e.g. USER, COMPUTER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.privilegeType String The privilege type of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.userPrincipalName String The user principal name of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.status String The status of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.title String The job title of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.source String The source of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.identityTags String The list of tags associated with the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.uniqueId String The unique identifier of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.nativeType String The native type of the identity resource (e.g. User).
RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainName String The root domain name of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainId String The unique identifier of the root domain of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityId String The unique identifier of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityName String The name of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityType String The type of the actor identity involved in the alert (e.g. USER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorPrivilegeType String The privilege type of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorState String The state of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.entityName String The name of the entity associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.entityId String The unique identifier of the entity associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityUniqueIdentifier String The unique identifier of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityName String The name of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentitySource String The source domain of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityStatus String The status of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityType String The type of the target identity involved in the alert (e.g. COMPUTER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdpType String The identity provider type of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetPrivilegeType String The privilege type of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.eventTime Date The time at which the identity event occurred.
RubrikPolaris.PageToken.IRViolation.next_page_token String The next page token.
RubrikPolaris.PageToken.IRViolation.name String The name of the command.
RubrikPolaris.PageToken.IRViolation.has_next_page Boolean Whether the result has the next page or not.

Command example

!rubrik-identity-resilience-violation-list limit=2

Context Example

{
    "RubrikPolaris": {
        "IRViolation": [
            {
                "policyViolationId": "00000000-0000-0000-0000-000000000001",
                "status": "POLICY_VIOLATION_STATUS_OPEN",
                "violationSeverity": "HIGH",
                "createdAt": "2026-03-25T09:29:55.000Z",
                "lastUpdatedAt": "2026-03-25T13:29:54.000Z",
                "resourceId": "00000000-0000-0000-0000-000000000101",
                "resourceType": "RESOURCE_TYPE_IDENTITY",
                "policy": {
                    "policyId": "00000000-0000-0000-0000-000000000201",
                    "name": "Excessive admin privileges",
                    "description": "Users with excessive admin privileges pose a risk of privilege escalation.",
                    "policySeverity": "HIGH",
                    "policyCategory": "IDENTITY_HYGIENE",
                    "policyType": "POLICY_TYPE_IDENTITY",
                    "frameworks": [
                        "MITRE ATT&CK: TA0006",
                        "CIS Controls: 14.2, 14.6",
                        "NIST CSF: PR.AC-1, PR.PT-3",
                        "NIST SP 800-53: AC-3, AC-6, IA-5",
                        "Regulations: GDPR, HIPAA, PCI DSS, SOC 2, CMMC"
                    ],
                    "manualRemediationProcess": "Disable delegation for privileged identities. For users, it's recommended to assign them to the \"Protected Users\" group. Alternatively, you can enable the setting \"This account is sensitive and can't be delegated\". For computers and service accounts, disable delegation by disabling the setting \"Trust this computer/user for delegation to any service\". If delegation is required, convert to constrained delegation that limits which services an identity can delegate to.",
                    "__typename": "IRPolicy"
                },
                "details": {
                    "domainUniqueId": "00000000-0000-0000-0000-000000000301",
                    "__typename": "IdentityViolationDetails"
                },
                "resourceMetadata": {
                    "metadata": {
                        "displayName": "John Doe",
                        "domainName": "rubrikdemo.com",
                        "idpType": "ENTRA_ID",
                        "principalType": "USER",
                        "privilegeType": "PRIVILEGED",
                        "userPrincipalName": "demo@rubrik.com",
                        "status": "ACTIVE",
                        "source": "ON_PREM_AD",
                        "identityTags": [
                            "PRIVILEGED"
                        ],
                        "uniqueId": "00000000-0000-0000-0000-000000000401",
                        "nativeType": "User",
                        "__typename": "IdentityMetadata"
                    },
                    "__typename": "ResourceMetadata"
                },
                "__typename": "PolicyViolation"
            },
            {
                "policyViolationId": "00000000-0000-0000-0000-000000000003",
                "status": "POLICY_VIOLATION_STATUS_OPEN",
                "name": "",
                "violationSeverity": "MEDIUM",
                "createdAt": "2026-03-25T16:45:30.000Z",
                "lastUpdatedAt": "2026-03-25T18:30:15.000Z",
                "resourceId": "00000000-0000-0000-0000-000000000103",
                "resourceType": "RESOURCE_TYPE_IDP",
                "policy": {
                    "policyId": "00000000-0000-0000-0000-000000000203",
                    "name": "Overly permissive IDP configuration",
                    "description": "Identity provider with overly permissive configuration.",
                    "policySeverity": "MEDIUM",
                    "policyCategory": "IDENTITY_PROVIDER_SECURITY",
                    "policyType": "POLICY_TYPE_IDP",
                    "frameworks": [
                        "MITRE ATT&CK: TA0006",
                        "CIS Controls: 6.7; NIST CSF: PR.AC-6",
                        "NIST SP 800-53: IA-5",
                        "Regulations: GDPR, HIPAA, PCI DSS, SOC 2, CMMC"
                    ],
                    "manualRemediationProcess": "Deploy a Conditional Access policy that enforces MFA for all users.",
                    "__typename": "IRPolicy"
                },
                "details": {
                    "domainUniqueId": "00000000-0000-0000-0000-000000000303",
                    "__typename": "IdpViolationDetails"
                },
                "resourceMetadata": {
                    "metadata": {
                        "domainName": "rubrikdemo.com",
                        "domainUniqueId": "00000000-0000-0000-0000-000000000303",
                        "idpType": "OKTA",
                        "rootDomainName": "rubrikdemo.com",
                        "rootDomainId": "00000000-0000-0000-0000-000000000501",
                        "__typename": "IdpMetadata"
                    },
                    "__typename": "ResourceMetadata"
                },
                "__typename": "PolicyViolation"
            }
        ],
        "PageToken": {
            "IRViolation": {
                "name": "rubrik-identity-resilience-violation-list",
                "next_page_token": "hash_token_ir",
                "has_next_page": true
            }
        }
    }
}

Human Readable Output

IR Violations List

ID Policy Name Display Name Domain Status Severity Policy Type Category Root Domain Detected On
00000000-0000-0000-0000-000000000001 Excessive admin privileges John Doe rubrikdemo.com Open High Identity Identity Hygiene   2026-03-25T09:29:55.000Z
00000000-0000-0000-0000-000000000003 Overly permissive IDP configuration   rubrikdemo.com Open Medium Idp Identity Provider Security rubrikdemo.com 2026-03-25T16:45:30.000Z

Note: To retrieve the next set of results use, “next_page_token” = hash_token_ir

rubrik-identity-resilience-violation-get

Retrieves the details of the Identity Resilience (IR) violation based on the provided violation ID.

Base Command

rubrik-identity-resilience-violation-get

Input

Argument Name Description Required
violation_id The ID of the IR violation.

Note: Users can get the violation ID by executing the “rubrik-identity-resilience-violation-list” command.		 Required
policy_type The policy type of the IR violation. Possible values are: IDENTITY, IDP, IDENTITY_EVENT, CROWDSTRIKE, MICROSOFT_DEFENDER. Optional

Context Output

Path Type Description
RubrikPolaris.IRViolation.policyViolationId String The unique identifier for the policy violation.
RubrikPolaris.IRViolation.name String The name of the policy violation.
RubrikPolaris.IRViolation.violationSeverity String The severity level of the policy violation.
RubrikPolaris.IRViolation.status String The current status of the policy violation.
RubrikPolaris.IRViolation.createdAt Date The date and time when the policy violation was created.
RubrikPolaris.IRViolation.lastUpdatedAt Date The date and time when the policy violation was last updated.
RubrikPolaris.IRViolation.resourceId String The unique identifier of the resource associated with the violation.
RubrikPolaris.IRViolation.resourceType String The type of the resource associated with the violation.
RubrikPolaris.IRViolation.policy.policyId String The unique identifier of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.name String The name of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.description String The description of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.policySeverity String The severity level assigned to the policy.
RubrikPolaris.IRViolation.policy.policyCategory String The category of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.policyType String The type of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.frameworks String The compliance frameworks associated with the policy.
RubrikPolaris.IRViolation.policy.manualRemediationProcess String The manual remediation process recommended for the policy violation.
RubrikPolaris.IRViolation.details.domainUniqueId String The unique identifier of the domain associated with the violation details.
RubrikPolaris.IRViolation.details.detectionTime Date The time at which the threat was detected.
RubrikPolaris.IRViolation.details.startTime Date The start time of the alert event.
RubrikPolaris.IRViolation.details.endTime Date The end time of the alert event.
RubrikPolaris.IRViolation.details.mitreTactic String The MITRE ATT&CK tactic associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.displayName String The display name of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.domainName String The domain name of the resource associated with the violation.
RubrikPolaris.IRViolation.resourceMetadata.metadata.domainUniqueId String The unique identifier of the domain of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.idpType String The identity provider type of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.principalType String The principal type of the identity resource (e.g. USER, COMPUTER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.privilegeType String The privilege type of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.userPrincipalName String The user principal name of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.status String The status of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.title String The job title of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.source String The source of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.identityTags String The list of tags associated with the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.uniqueId String The unique identifier of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.nativeType String The native type of the identity resource (e.g. User).
RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainName String The root domain name of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainId String The unique identifier of the root domain of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityId String The unique identifier of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityName String The name of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityType String The type of the actor identity involved in the alert (e.g. USER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorPrivilegeType String The privilege type of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorState String The state of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.entityName String The name of the entity associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.entityId String The unique identifier of the entity associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityUniqueIdentifier String The unique identifier of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityName String The name of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentitySource String The source domain of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityStatus String The status of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityType String The type of the target identity involved in the alert (e.g. COMPUTER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdpType String The identity provider type of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetPrivilegeType String The privilege type of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.eventTime Date The time at which the identity event occurred.
RubrikPolaris.IRViolation.sensitiveHits.highRiskHits.violatedHits Number The number of high risk sensitive hits violated by the identity.
RubrikPolaris.IRViolation.sensitiveHits.mediumRiskHits.violatedHits Number The number of medium risk sensitive hits violated by the identity.
RubrikPolaris.IRViolation.sensitiveHits.lowRiskHits.violatedHits Number The number of low risk sensitive hits violated by the identity.
RubrikPolaris.IRViolation.sensitiveHits.noRiskHits.violatedHits Number The number of no risk sensitive hits violated by the identity.
RubrikPolaris.IRViolation.sensitiveHits.totalHits.violatedHits Number The total number of sensitive hits violated by the identity.
RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryName String The name of the data category associated with the sensitive hits.
RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryHits.dataCategoryId String The unique identifier of the data category.
RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryHits.totalViolatedHits Number The total number of violated hits for the data category.

Command example

!rubrik-identity-resilience-violation-get violation_id="00000000-0000-0000-0000-000000000001" policy_type="IDENTITY"

Context Example

{
    "RubrikPolaris": {
        "IRViolation": {
            "policyViolationId": "00000000-0000-0000-0000-000000000001",
            "status": "POLICY_VIOLATION_STATUS_OPEN",
            "violationSeverity": "HIGH",
            "createdAt": "2026-03-25T09:29:55.000Z",
            "lastUpdatedAt": "2026-03-25T13:29:54.000Z",
            "resourceId": "00000000-0000-0000-0000-000000000101",
            "resourceType": "RESOURCE_TYPE_IDENTITY",
            "__typename": "PolicyViolation",
            "policy": {
                "policyId": "00000000-0000-0000-0000-000000000201",
                "name": "Excessive admin privileges",
                "description": "Users with excessive admin privileges pose a risk of privilege escalation.",
                "policyCategory": "IDENTITY_HYGIENE",
                "policySeverity": "HIGH",
                "policyType": "POLICY_TYPE_IDENTITY",
                "frameworks": [
                    "NIST",
                    "CIS"
                ],
                "manualRemediationProcess": "Review and revoke excess admin roles.",
                "__typename": "IRPolicy"
            },
            "details": {
                "domainUniqueId": "00000000-0000-0000-0000-000000000301",
                "mitreTactic": "Privilege Escalation",
                "__typename": "IdentityViolationDetails"
            },
            "resourceMetadata": {
                "metadata": {
                    "displayName": "John Doe",
                    "domainName": "rubrikdemo.com",
                    "idpType": "ENTRA_ID",
                    "principalType": "USER",
                    "privilegeType": "PRIVILEGED",
                    "userPrincipalName": "demo@rubrik.com",
                    "status": "ACTIVE",
                    "title": "Engineer",
                    "source": "ON_PREM_AD",
                    "nativeType": "User",
                    "__typename": "IdentityMetadata"
                },
                "__typename": "ResourceMetadata"
            },
            "identityTags": [
                "PRIVILEGED"
            ],
            "sensitiveHits": {
                "highRiskHits": {
                    "violatedHits": 5,
                    "__typename": "SensitiveHits"
                },
                "mediumRiskHits": {
                    "violatedHits": 3,
                    "__typename": "SensitiveHits"
                },
                "lowRiskHits": {
                    "violatedHits": 2,
                    "__typename": "SensitiveHits"
                },
                "noRiskHits": {
                    "violatedHits": 10,
                    "__typename": "SensitiveHits"
                },
                "totalHits": {
                    "violatedHits": 20,
                    "__typename": "SensitiveHits"
                },
                "__typename": "SensitiveHitsInfo"
            },
            "dataCategoryResults": [
                {
                    "dataCategoryName": "Financial",
                    "dataCategoryHits": {
                        "dataCategoryId": "00000000-0000-0000-0000-000000000601",
                        "totalViolatedHits": 8,
                        "__typename": "DataCategoryHits"
                    },
                    "__typename": "DataCategoryResult"
                }
            ]
        }
    }
}

Human Readable Output

IR Violation Information

ID Violation Name Severity Violation Status Detection Time Last Updated Policy ID Policy Name Policy Type Policy Description Policy Category Policy Severity Frameworks Manual Remediation Process Identity Status Resource ID Resource Type Title Display Name Domain Name Source Identity Provider Principal Type Privilege Type User Principal Name Identity Tags Native Type Domain Unique ID MITRE Tactic Total Risk Hits High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Data Categories
00000000-0000-0000-0000-000000000001 Excessive admin privileges High Open 2026-03-25T09:29:55.000Z 2026-03-25T13:29:54.000Z 00000000-0000-0000-0000-000000000201 Excessive admin privileges Identity Users with excessive admin privileges pose a risk of privilege escalation. IDENTITY_HYGIENE High NIST,
CIS		 Review and revoke excess admin roles. ACTIVE 00000000-0000-0000-0000-000000000101 Identity Engineer John Doe rubrikdemo.com ON_PREM_AD ENTRA_ID USER PRIVILEGED demo@rubrik.com PRIVILEGED User 00000000-0000-0000-0000-000000000301 Privilege Escalation 20 5 3 2 10 - id: 00000000-0000-0000-0000-000000000601
name: Financial
totalViolatedHits: 8

rubrik-identity-resilience-violation-status-update

Updates the status of the Identity Resilience (IR) violation.

Base Command

rubrik-identity-resilience-violation-status-update

Input

Argument Name Description Required
violation_id The ID of the IR violation.

Note: Users can get the violation ID by executing the “rubrik-identity-resilience-violation-list” command.		 Required
status The status to update for the violation. Possible values are: OPEN, IN_PROGRESS, REMEDIATED, DISMISSED, CLOSED. Required

Context Output

Path Type Description
RubrikPolaris.IRViolation.policyViolationId String The ID of the violation.
RubrikPolaris.IRViolation.status String The status of the violation.

Command example

!rubrik-identity-resilience-violation-status-update violation_id="00000000-0000-0000-0000-000000000001" status="IN_PROGRESS"

Context Example

{
    "RubrikPolaris": {
        "IRViolation": {
            "policyViolationId": "00000000-0000-0000-0000-000000000001",
            "status": "POLICY_VIOLATION_STATUS_IN_PROGRESS"
        }
    }
}

Human Readable Output

Successfully updated the Identity Resilience violation status to In Progress

rubrik-sensitive-data-object-get

Retrieve the details of the object based on the provided object ID and snapshot ID.

Base Command

rubrik-sensitive-data-object-get

Input

Argument Name Description Required
object_id The ID of the object (snappable FID).

Note: Users can get the object ID by executing the “rubrik-polaris-object-list” command.		 Required
snapshot_id The Snapshot ID of the object.

Note: Users can get the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.		 Required
include_whitelisted_results The boolean indicates to include the whitelisted results. Possible values are: True, False. Default is False. Optional

Context Output

Path Type Description
RubrikPolaris.SensitiveDataObject.id String The ID of the sensitive data object.
RubrikPolaris.SensitiveDataObject.snapshotFid String The FID of the snapshot associated with the object.
RubrikPolaris.SensitiveDataObject.snapshotTimestamp Number The timestamp of the snapshot.
RubrikPolaris.SensitiveDataObject.shareType String The share type of the object.
RubrikPolaris.SensitiveDataObject.riskLevel String The risk level of the object.
RubrikPolaris.SensitiveDataObject.osType String The OS type of the object.
RubrikPolaris.SensitiveDataObject.isUserAccessEnabledObject Boolean Whether user access is enabled for the object.
RubrikPolaris.SensitiveDataObject.__typename String The GraphQL type name of the sensitive data object.
RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.snapshotTime Number The time of the latest snapshot result.
RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.snapshotFid String The FID of the latest snapshot result.
RubrikPolaris.SensitiveDataObject.objectStatus.policyStatuses.status String The status of the policy for the object.
RubrikPolaris.SensitiveDataObject.objectStatus.__typename String The GraphQL type name of the object status.
RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.__typename String The GraphQL type name of the latest snapshot result.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.totalHits Number The total number of sensitive data hits in the object.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.violations Number The total number of violations in the object.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.violationsDelta Number The change in violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.totalHitsDelta Number The change in total hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.__typename String The GraphQL type name of the root file result.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.__typename String The GraphQL type name of the root file result hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.groupType String The type of the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.id String The ID of the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.name String The name of the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.totalHits Number The total hits for the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.violations Number The violations for the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.violationsDelta Number The change in violations for the analyzer group since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.totalHitsDelta Number The change in total hits for the analyzer group since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.__typename String The GraphQL type name of the analyzer group result.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.__typename String The GraphQL type name of the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.__typename String The GraphQL type name of the analyzer group hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.analyzer.id String The ID of the analyzer.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.analyzer.name String The name of the analyzer.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.totalHits Number The total hits for the analyzer.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.violations Number The violations for the analyzer.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.violationsDelta Number The change in violations for the analyzer since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.totalHitsDelta Number The change in total hits for the analyzer since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.__typename String The GraphQL type name of the analyzer result hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.totalHits Number The total number of files with sensitive data hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.violations Number The number of files with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.violationsDelta Number The change in files with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.totalHitsDelta Number The change in files with hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.__typename String The GraphQL type name of the files with hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.totalHits Number The total number of open-access files.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.violations Number The number of open-access files with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.violationsDelta Number The change in open-access files with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.totalHitsDelta Number The change in open-access files hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.__typename String The GraphQL type name of the open access files.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.totalHits Number The total number of open-access folders.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.violations Number The number of open-access folders with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.violationsDelta Number The change in open-access folders with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.totalHitsDelta Number The change in open-access folders hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.__typename String The GraphQL type name of the open access folders.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.totalHits Number The total number of open-access files with sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.violations Number The number of open-access files with hits and violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.violationsDelta Number The change in open-access files with hits violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.totalHitsDelta Number The change in open-access files with hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.__typename String The GraphQL type name of the open access files with hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.totalHits Number The total number of stale files.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.violations Number The number of stale files with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.violationsDelta Number The change in stale files with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.totalHitsDelta Number The change in stale files hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.__typename String The GraphQL type name of the stale files.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.totalHits Number The total number of stale files with sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.violations Number The number of stale files with hits and violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.violationsDelta Number The change in stale files with hits violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.totalHitsDelta Number The change in stale files with hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.__typename String The GraphQL type name of the stale files with hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.totalHits Number The total number of open-access stale files.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.violations Number The number of open-access stale files with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.violationsDelta Number The change in open-access stale files with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.totalHitsDelta Number The change in open-access stale files hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.__typename String The GraphQL type name of the open access stale files.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.totalHits Number The total high risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.violatedHits Number The violated high risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.__typename String The GraphQL type name of the high risk hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.totalHits Number The total medium risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.violatedHits Number The violated medium risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.__typename String The GraphQL type name of the medium risk hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.totalHits Number The total low risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.violatedHits Number The violated low risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.__typename String The GraphQL type name of the low risk hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.totalHits Number The total no-risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.violatedHits Number The violated no-risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.__typename String The GraphQL type name of the no-risk hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.totalHits Number The total sensitive hits across all risk levels.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.violatedHits Number The total violated sensitive hits across all risk levels.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.__typename String The GraphQL type name of the total sensitive hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.__typename String The GraphQL type name of the sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.numActivities Number The number of activities associated with the file result.
RubrikPolaris.SensitiveDataObject.rootFileResult.numActivitiesDelta Number The change in number of activities since last scan.
RubrikPolaris.SensitiveDataObject.snappable.id String The ID of the snappable object.
RubrikPolaris.SensitiveDataObject.snappable.name String The name of the snappable object.
RubrikPolaris.SensitiveDataObject.snappable.objectType String The type of the snappable object.
RubrikPolaris.SensitiveDataObject.snappable.slaAssignment String The SLA assignment of the snappable object.
RubrikPolaris.SensitiveDataObject.snappable.logicalPath.fid String The FID of the logical path node.
RubrikPolaris.SensitiveDataObject.snappable.logicalPath.name String The name of the logical path node.
RubrikPolaris.SensitiveDataObject.snappable.logicalPath.objectType String The object type of the logical path node.
RubrikPolaris.SensitiveDataObject.snappable.logicalPath.__typename String The GraphQL type name of the logical path node.
RubrikPolaris.SensitiveDataObject.snappable.physicalPath.fid String The FID of the physical path node.
RubrikPolaris.SensitiveDataObject.snappable.physicalPath.name String The name of the physical path node.
RubrikPolaris.SensitiveDataObject.snappable.physicalPath.objectType String The object type of the physical path node.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.id String The ID of the effective SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.name String The name of the effective SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.isRetentionLockedSla Boolean Whether the SLA domain has retention lock enabled.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.retentionLockMode String The retention lock mode of the SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.description String The description of the effective SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.__typename String The GraphQL type name of the effective SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.rscNativeObjectPendingSla.id String The ID of the pending SLA for the native object.
RubrikPolaris.SensitiveDataObject.snappable.rscNativeObjectPendingSla.name String The name of the pending SLA for the native object.
RubrikPolaris.SensitiveDataObject.snappable.__typename String The GraphQL type name of the snappable object.
RubrikPolaris.SensitiveDataObject.policySummaries.id String The ID of the classification policy.
RubrikPolaris.SensitiveDataObject.policySummaries.name String The name of the classification policy.
RubrikPolaris.SensitiveDataObject.policySummaries.colorEnum String The color enum of the classification policy.
RubrikPolaris.SensitiveDataObject.policySummaries.__typename String The GraphQL type name of the classification policy summary.

Context Example

{
    "RubrikPolaris": {
        "SensitiveDataObject": {
            "id": "00000000-0000-0000-0000-000000000001",
            "snapshotFid": "00000000-0000-0000-0000-000000000001",
            "snapshotTimestamp": 1782272126524,
            "shareType": "UNKNOWN_SHARE_TYPE",
            "riskLevel": "HIGH_RISK",
            "objectStatus": {
                "policyStatuses": [
                    {
                        "status": "UP_TO_DATE",
                        "__typename": "PolicyStatus"
                    },
                    {
                        "status": "UP_TO_DATE",
                        "__typename": "PolicyStatus"
                    }
                ],
                "latestSnapshotResult": {
                    "snapshotTime": 1782444911010,
                    "snapshotFid": "00000000-0000-0000-0000-000000000002",
                    "__typename": "SnapshotResult"
                },
                "__typename": "ObjectStatus"
            },
            "rootFileResult": {
                "hits": {
                    "totalHits": 40,
                    "violations": 40,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "analyzerGroupResults": [
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000003",
                            "name": "GLBA",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 2,
                                    "violations": 2,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "Bank Account Number",
                                    "analyzerType": "US_BANK_ACCT",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 2,
                            "violations": 2,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    },
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000005",
                            "name": "Financial",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 1,
                                    "violations": 1,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000006",
                                    "name": "ABA Routing Number",
                                    "analyzerType": "ABA_ROUTING_NUMBER",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 2,
                                    "violations": 2,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "Bank Account Number",
                                    "analyzerType": "US_BANK_ACCT",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 3,
                            "violations": 3,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    },
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000007",
                            "name": "U.S. Financials",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 1,
                                    "violations": 1,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000006",
                                    "name": "ABA Routing Number",
                                    "analyzerType": "ABA_ROUTING_NUMBER",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 2,
                                    "violations": 2,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "Bank Account Number",
                                    "analyzerType": "US_BANK_ACCT",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 3,
                            "violations": 3,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    }
                ],
                "filesWithHits": {
                    "totalHits": 11,
                    "violations": 11,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "openAccessFilesWithHits": {
                    "totalHits": 0,
                    "violations": 0,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "staleFilesWithHits": {
                    "totalHits": 8,
                    "violations": 8,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "analyzerResults": [
                    {
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000004",
                            "name": "Bank Account Number"
                        },
                        "hits": {
                            "totalHits": 2,
                            "violations": 2,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        }
                    },
                    {
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000006",
                            "name": "ABA Routing Number"
                        },
                        "hits": {
                            "totalHits": 1,
                            "violations": 1,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        }
                    }
                ],
                "sensitiveHits": {
                    "highRiskHits": {
                        "totalHits": 20,
                        "violatedHits": 20,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 10,
                        "violatedHits": 10,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 5,
                        "violatedHits": 5,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 5,
                        "violatedHits": 5,
                        "__typename": "SummaryHits"
                    },
                    "totalHits": {
                        "totalHits": 40,
                        "violatedHits": 40,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "SensitiveHits"
                },
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "__typename": "FileResult"
            },
            "snappable": {
                "id": "00000000-0000-0000-0000-000000000008",
                "name": "ran test",
                "objectType": "O365Site",
                "slaAssignment": "Direct",
                "logicalPath": [
                    {
                        "fid": "00000000-0000-0000-0000-000000000009",
                        "name": "Rubrik Inc",
                        "objectType": "O365Org",
                        "__typename": "PathNode"
                    },
                    {
                        "fid": "00000000-0000-0000-0000-000000000010",
                        "name": "rubrik-tme-lab",
                        "objectType": "AwsNativeAccount",
                        "__typename": "PathNode"
                    }
                ],
                "effectiveSlaDomain": {
                    "id": "00000000-0000-0000-0000-000000000001",
                    "name": "Silver",
                    "isRetentionLockedSla": false,
                    "retentionLockMode": "NO_MODE",
                    "__typename": "GlobalSlaReply",
                    "description": "Rubrik default Silver level SLA Domain policy"
                },
                "__typename": "O365Site"
            },
            "__typename": "PolicyObj",
            "osType": "NONE",
            "isUserAccessEnabledObject": true,
            "policySummaries": [
                {
                    "id": "00000000-0000-0000-0000-000000000003",
                    "name": "GLBA",
                    "colorEnum": "COLOR_003",
                    "__typename": "ClassificationPolicySummary"
                },
                {
                    "id": "00000000-0000-0000-0000-000000000005",
                    "name": "Financial",
                    "colorEnum": "COLOR_013",
                    "__typename": "ClassificationPolicySummary"
                },
                {
                    "id": "00000000-0000-0000-0000-000000000007",
                    "name": "Financials",
                    "colorEnum": "COLOR_005",
                    "__typename": "ClassificationPolicySummary"
                }
            ]
        }
    }
}

Human Readable Output

Sensitive Data Object

Object ID Object Name Object Type Risk Level OS Type Account Name Snapshot ID Snapshot Timestamp SLA Name Daily Hits Change Total Risk Hits High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Total Files with Hits Stale Files with Hits Open Access Files with Hits Data Categories Data Types
00000000-0000-0000-0000-000000000001 ran test O365Site High NONE rubrik-tme-lab 00000000-0000-0000-0000-000000000001 2026-06-19T12:55:26Z Silver 0 40 20 10 5 5 11 8 0 - name: GLBA
totalViolatedHits: 2
- name: Financial
totalViolatedHits: 3
- name: U.S. Financials
totalViolatedHits: 3		 - name: Bank Account Number
totalViolatedHits: 2
- name: ABA Routing Number
totalViolatedHits: 1

rubrik-sensitive-data-object-file-get

Retrieve the file information for the provided file path in the object.

Base Command

rubrik-sensitive-data-object-file-get

Input

Argument Name Description Required
object_id The ID of the object (snappable FID).

Note: Users can get the object ID by executing the “rubrik-polaris-object-list” command.		 Required
snapshot_id The Snapshot ID of the object.

Note: Users can get the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.		 Required
file_path The full path of the file for which to retrieve information. Required
resolve_sids Whether to resolve SIDs to display names in the file response. Possible values are: True, False. Default is True. Optional

Context Output

Path Type Description
RubrikPolaris.SensitiveDataObjectFile.objectId String The unique identifier of the snappable object.
RubrikPolaris.SensitiveDataObjectFile.stdPath String The standard file path of the sensitive file.
RubrikPolaris.SensitiveDataObjectFile.secInfo.path String The full path of the sensitive file from the security descriptor.
RubrikPolaris.SensitiveDataObjectFile.secInfo.owner String The SID of the owner of the file.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.cn String The display name of the principal with file permissions.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalId String The SID or identifier of the principal with file permissions.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalOrigin String The origin of the principal.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.idpType String The identity provider type for the principal.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalType String The type of the principal.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.resolutionType String The resolution type of the principal SID.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.access String The access level granted to the principal.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.flags String The permission flags.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.accessMethodDetails.accessMethod String The access method used.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.createdBy.value String The value of the principal who created the file.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.creationTime Number The creation time of the file as a Unix timestamp.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastAccessTime Number The last access time of the file as a Unix timestamp.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastModifiedBy.value String The value of the principal who last modified the file.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastModifiedTime Number The last modified time of the file as a Unix timestamp.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastScanTime Number The last scan time of the file as a Unix timestamp.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.path String The full path of the file as recorded in the metadata.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.size Number The size of the file in bytes.
RubrikPolaris.SensitiveDataObjectFile.exposureSummary.exposureType String The exposure type of the file.
RubrikPolaris.SensitiveDataObjectFile.exposureSummary.fileCount.totalCount Number The total count of files in the exposure summary.
RubrikPolaris.SensitiveDataObjectFile.exposureSummary.fileCount.violatedCount Number The number of files with violations in the exposure summary.

Command Example

!rubrik-sensitive-data-object-file-get object_id="00000000-0000-0000-0000-000000000001" snapshot_id="00000000-0000-0000-0000-000000000002" file_path="/C:/DummyPath/DummyFile.xlsx"

Context Example

{
    "objectId": "00000000-0000-0000-0000-000000000001",
    "stdPath": "/C:/DummyPath/DummyFile.xlsx",
    "secInfo": [
        {
            "path": "/C:/DummyPath/DummyFile.xlsx",
            "owner": "S-1-5-21-0000000000-000000000-0000000000-0001",
            "permissions": [
                {
                    "cn": "John Doe",
                    "principalId": "S-1-5-21-0000000000-000000000-0000000000-0002",
                    "principalOrigin": "ORIGIN_INTERNAL",
                    "idpType": "ON_PREM_AD",
                    "principalType": "UNKNOWN",
                    "resolutionType": "RESOLVED_AD",
                    "access": "Full control",
                    "flags": [
                        "INHERITED"
                    ],
                    "accessMethodDetails": {
                        "accessMethod": "WINDOWS_ACL",
                        "__typename": "DatagovAccessMethodDetailsType"
                    },
                    "__typename": "SDDLPermission"
                },
                {
                    "cn": "Local System",
                    "principalId": "S-1-5-18",
                    "principalOrigin": "ORIGIN_INTERNAL",
                    "idpType": "ON_PREM_AD",
                    "principalType": "UNKNOWN",
                    "resolutionType": "WELL_KNOWN",
                    "access": "Full control",
                    "flags": [
                        "INHERITED"
                    ],
                    "accessMethodDetails": {
                        "accessMethod": "WINDOWS_ACL",
                        "__typename": "DatagovAccessMethodDetailsType"
                    },
                    "__typename": "SDDLPermission"
                },
                {
                    "cn": "Administrators",
                    "principalId": "S-1-5-32-000",
                    "principalOrigin": "ORIGIN_INTERNAL",
                    "idpType": "ON_PREM_AD",
                    "principalType": "UNKNOWN",
                    "resolutionType": "WELL_KNOWN",
                    "access": "Full control",
                    "flags": [
                        "INHERITED"
                    ],
                    "accessMethodDetails": {
                        "accessMethod": "WINDOWS_ACL",
                        "__typename": "DatagovAccessMethodDetailsType"
                    },
                    "__typename": "SDDLPermission"
                },
                {
                    "cn": "Users",
                    "principalId": "S-1-5-32-001",
                    "principalOrigin": "ORIGIN_INTERNAL",
                    "idpType": "ON_PREM_AD",
                    "principalType": "UNKNOWN",
                    "resolutionType": "WELL_KNOWN",
                    "access": "Read & execute",
                    "flags": [
                        "INHERITED"
                    ],
                    "accessMethodDetails": {
                        "accessMethod": "WINDOWS_ACL",
                        "__typename": "DatagovAccessMethodDetailsType"
                    },
                    "__typename": "SDDLPermission"
                }
            ],
            "__typename": "PathSecInfo"
        }
    ],
    "__typename": "SensitiveFileDetailsReply",
    "fileMetadata": {
        "createdBy": {
            "value": "admin@example.com",
            "__typename": "FilePrincipalIdentity"
        },
        "creationTime": 1768473000,
        "lastAccessTime": 1781945100,
        "lastModifiedBy": {
            "value": "admin@example.com",
            "__typename": "FilePrincipalIdentity"
        },
        "lastModifiedTime": 1773151200,
        "lastScanTime": 1782388800,
        "path": "/C:/DummyPath/DummyFile.xlsx",
        "size": 1665816,
        "__typename": "SensitiveFileMetadata"
    },
    "exposureSummary": [
        {
            "exposureType": "NOT_OPEN",
            "fileCount": {
                "totalCount": 1,
                "violatedCount": 0,
                "__typename": "SummaryCount"
            },
            "__typename": "ExposureSummary"
        }
    ]
}

Human Readable Output

File Information

File Path File Size in Bytes Owner Created By Last Modified By Create Time Last Modified Time Last Access Time Exposure Type File Count Permissions
/C:/DummyPath/DummyFile.xlsx 1665816 S-1-5-21-0000000000-000000000-0000000000-0001 admin@example.com admin@example.com 2026-01-15T10:30:00Z 2026-03-10T14:00:00Z 2026-06-20T08:45:00Z NOT_OPEN 1 - id: S-1-5-21-0000000000-000000000-0000000000-0002
name: John Doe
accessMethod: WINDOWS_ACL
access: Full control
- id: S-1-5-18
name: Local System
accessMethod: WINDOWS_ACL
access: Full control
- id: S-1-5-32-000
name: Administrators
accessMethod: WINDOWS_ACL
access: Full control
- id: S-1-5-32-001
name: Users
accessMethod: WINDOWS_ACL
access: Read & execute

Configuration parameters

  • service_account_json — Service Account JSON
  • url — Rubrik Account (e.g. ${rubrikAccount}.my.rubrik.com)
  • email — Email
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • rsc_fetch_types — RSC Fetch Types
  • event_types — Event types to fetch as incidents
  • event_severities — Event severities to fetch as incidents
  • threat_monitoring_match_types — Threat Monitoring Match Types
  • threat_monitoring_object_types — Threat Monitoring Object Types
  • first_fetch — First fetch time
  • incidentFetchInterval — Incidents Fetch Interval
  • max_fetch — Fetch Limit (Maximum of 1000)
  • radar_critical_severity_mapping — Event Critical Severity Level Mapping
  • radar_warning_severity_mapping — Event Warning Severity Level Mapping
  • threat_monitoring_severity_mapping — Threat Monitoring Object Severity Level Mapping
  • dspm_violation_status — DSPM Violation Statuses
  • dspm_violation_sensitivity — DSPM Violation Sensitivity Levels
  • dspm_violation_severity — DSPM Violation Severity Levels
  • dspm_violation_category — DSPM Violation Categories
  • dspm_violation_object_type — DSPM Violation Object Types
  • ir_violation_policy_type — IR Violation Policy Types
  • ir_violation_status — IR Violation Statuses
  • ir_violation_severity — IR Violation Severity Levels
  • ir_violation_category — IR Violation Categories
  • ir_violation_identity_provider — IR Violation Identity Providers
  • ir_violation_identity_tag — IR Violation Identity Tags
  • sensitive_data_object_sensitivity — Sensitive Data Object Sensitivity Levels
  • sensitive_data_object_type — Sensitive Data Object Types
  • integration_reliability — Source Reliability
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (61)

  • domain

    Retrieve the sensitive information available for the given domain(s).

  • ip

    Retrieve the sensitive information available for the given IP address(es).

  • rubrik-advance-ioc-scan

    Start a new advance threat hunt.

  • rubrik-anomaly-csv-analysis-v2

    Request for the analysis and directly download the anomaly CSV analyzed file.

  • rubrik-cdm-cluster-connection-state

    Find the CDM Connection State of a CDM Cluster.

  • rubrik-cdm-cluster-location

    Find the CDM GeoLocation of a CDM Cluster.

  • rubrik-data-security-violation-csv-download

    Download all files at risk as CSV file for the specified data security violation.

  • rubrik-data-security-violation-file-list

    Retrieve the file information of data security violation based on the provided violation ID.

  • rubrik-data-security-violation-get

    Retrieve the details of DSPM violation based on the provided violation ID.

  • rubrik-data-security-violation-list

    Retrieve the list of DSPM violations.

  • rubrik-data-security-violation-log-download

    Download remediation logs as CSV file for the specified data security violation.

  • rubrik-data-security-violation-status-update

    Updates the status of the DSPM violation.

  • rubrik-event-list

    Retrieve the list of events.

  • rubrik-gps-async-result

    Retrieve the result of an asynchronous request. This command will retrieve the result of requests made by commands "rubrik-gps-snapshot-files-download", "rubrik-gps-vm-livemount", "rubrik-gps-vm-export", "rubrik-gps-vm-snapshot-create" and "rubrik-gps-vm-recover-files".

  • rubrik-gps-cluster-list

    Retrieve the list of the available rubrik clusters.

  • rubrik-gps-sla-domain-list

    Enumerates the available SLA Domains to apply to the on-demand snapshot as a retention policy.

  • rubrik-gps-snapshot-files-download

    Request to download the snapshot file from the backup. Note: To know about the file information and which file can be downloaded, use the "rubrik-gps-snapshot-files-list" command. To know about the status of the downloadable files, use the "rubrik-gps-async-result" command.

  • rubrik-gps-snapshot-files-list

    Retrieve the list of the available files that can be downloaded. Note: To initiate the file download request use the "rubrik-gps-snapshot-files-download" command.

  • rubrik-gps-vm-datastore-list

    Retrieve the list of the available datastores on a Vsphere Host.

  • rubrik-gps-vm-export

    Request to initiate an export of a snapshot of a virtual machine. Note: To know about the exported VM's status, use the "rubrik-gps-async-result" command.

  • rubrik-gps-vm-host-list

    Retrieve the list of available Vsphere Hosts.

  • rubrik-gps-vm-livemount

    Performs a live mount of a virtual machine snapshot. Note: To know about the live mount status, use the "rubrik-gps-async-result" command.

  • rubrik-gps-vm-recover-files

    Recovers files from a snapshot backup, back into a system. Note: To know about the recovery status, use the "rubrik-gps-async-result" command.

  • rubrik-gps-vm-snapshot-create

    Triggers an on-demand snapshot of a system. Note: To know about the status of the on-demand snapshot creation, use the "rubrik-gps-async-result" command.

  • rubrik-identity-resilience-violation-get

    Retrieves the details of the Identity Resilience (IR) violation based on the provided violation ID.

  • rubrik-identity-resilience-violation-list

    Retrieves the list of Identity Resilience (IR) violations.

  • rubrik-identity-resilience-violation-status-update

    Updates the status of the Identity Resilience (IR) violation.

  • rubrik-ioc-scan-list-v2

    List details of the Turbo and Advance Threat Hunt.

  • rubrik-ioc-scan-results-v2

    Retrieve details of the Turbo and Advance Threat Hunt.

  • rubrik-polaris-object-list

    Retrieve the list of Rubrik objects, based on the provided filters.

  • rubrik-polaris-object-search

    Search for Rubrik discovered objects of any type, return zero or more matches.

  • rubrik-polaris-object-snapshot-list

    Retrieve Rubrik snapshot(s) of an object, based on the provided object ID.

  • rubrik-polaris-vm-object-metadata-get

    Retrieve details for a Vsphere object based on the provided object ID.

  • rubrik-polaris-vm-object-snapshot-list

    Search for a Rubrik snapshot of an object based on the provided snapshot ID, exact timestamp, or specific value like earliest/latest, or closest before/after a timestamp.

  • rubrik-polaris-vm-objects-list

    Retrieve a list of all the objects of the Vsphere Vm known to the Rubrik.

  • rubrik-radar-analysis-status Deprecated

    Check the Radar Event for updates.

  • rubrik-radar-anomaly-csv-analysis

    Request for the analysis and retrieve the download link or directly download file for the Radar CSV analyzed file.

  • rubrik-radar-anomaly-status-update

    Updates the status of the Anomaly detection. Note: Run the "rubrik-radar-suspicious-file-list" command first to check the resolution status of the Anomaly Detection snapshot before executing this command.

  • rubrik-radar-ioc-scan

    Triggers an IOC scan of a system. Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command and to list the running/completed IOC scans on a cluster use the "rubrik-radar-ioc-scan-list" command.

  • rubrik-radar-ioc-scan-list

    Lists the running/completed IOC scans on a cluster. Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command. To initiate a scan use the "rubrik-radar-ioc-scan" command.

  • rubrik-radar-ioc-scan-results

    Retrieves the results of IOC scan of a system. Note: To initiate a scan use the "rubrik-radar-ioc-scan" command and to list the running/completed scans on a cluster use the "rubrik-radar-ioc-scan-list" command.

  • rubrik-radar-suspicious-file-list

    Retrieve the suspicious list of files for a snapshot ID with detected file anomalies.

  • rubrik-sensitive-data-object-file-get

    Retrieve the file information for the provided file path in the object.

  • rubrik-sensitive-data-object-get

    Retrieve the details of the object based on the provided object ID and snapshot ID.

  • rubrik-sonar-csv-download

    Request to download the Sonar CSV Snapshot results file. Note: To know the ID and status of the download, use the "rubrik-user-downloads-list" command. To download the file, use the "rubrik-sonar-csv-result-download" command.

  • rubrik-sonar-csv-result-download

    Retrieve the download link for the requested Sonar CSV Snapshot file.

  • rubrik-sonar-file-context-list

    Retrieve the context of the file, folder, or file share for the provided object and the file details.

  • rubrik-sonar-ondemand-scan

    Trigger an on-demand scan of a system. Supports "Vsphere VM" object type only. Note: To know the scan status use the "rubrik-sonar-ondemand-scan-status" command. To download the completed request use the "rubrik-sonar-ondemand-scan-result" command.

  • rubrik-sonar-ondemand-scan-result

    Retrieve the download link for the requested scanned file.

  • rubrik-sonar-ondemand-scan-status

    Retrieve the status of a scanned system. Note: To download the completed request use the "rubrik-sonar-ondemand-scan-result" command.

  • rubrik-sonar-policies-list

    Retrieve the list of all the available Sonar policies.

  • rubrik-sonar-policy-analyzer-groups-list

    List the analyzer group policies.

  • rubrik-sonar-sensitive-hits

    Find data classification hits on an object.

  • rubrik-sonar-user-access-get

    Retrieve the user access information based on the provided user ID.

  • rubrik-sonar-user-access-list

    Retrieve the user access information.

  • rubrik-threat-monitoring-matched-file-get

    Get the matched file for the Threat Monitoring object.

  • rubrik-threat-monitoring-matched-file-list

    List the matched files for the Threat Monitoring object.

  • rubrik-threat-monitoring-matched-object-get

    Get the matched object for Threat Monitoring.

  • rubrik-threat-monitoring-matched-object-list

    List the matched objects for Threat Monitoring.

  • rubrik-turbo-ioc-scan

    Start a new turbo threat hunt.

  • rubrik-user-downloads-list

    Retrieve the user downloads. This would return the current and past download history. Note: To download the requested Sonar CSV Snapshot results file use the "rubrik-sonar-csv-result-download" command.

Source

RubrikPolaris.py RubrikPolaris_test.py RubrikPolaris.yml RubrikPolaris_description.md
Download History Raw 
display: Rubrik Security Cloud
name: RubrikPolaris
category: Data Enrichment & Threat Intelligence
provider: Rubrik
commonfields:
  id: RubrikPolaris
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Service Account JSON
  name: service_account_json
  type: 4
  required: false
  section: Connect
- display: Rubrik Account (e.g. ${rubrikAccount}.my.rubrik.com)
  name: url
  type: 0
  required: false
  section: Connect
- display: Email
  name: email
  type: 9
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- defaultvalue: Event,Threat Monitoring Object,DSPM Violation,IR Violation,Sensitive Data Object
  display: RSC Fetch Types
  additionalinfo: "Select RSC types to fetch as incidents.\n\nNote: Supports the listed options only. If not provided, it will fetch all listed options."
  name: rsc_fetch_types
  options:
  - Event
  - Threat Monitoring Object
  - DSPM Violation
  - IR Violation
  - Sensitive Data Object
  type: 16
  required: false
  section: Collect
- defaultvalue: ANOMALY,THREAT_MONITORING
  display: Event types to fetch as incidents
  additionalinfo: "Event types to fetch as incidents.\nNote: Supports the listed options only. If not provided, it will fetch events for all listed options. Applies only when RSC fetch type is set to \"Event\"."
  name: event_types
  options:
  - ANOMALY
  - THREAT_MONITORING
  type: 16
  required: false
  section: Collect
- defaultvalue: SEVERITY_CRITICAL
  display: Event severities to fetch as incidents
  additionalinfo: "Event severities to fetch as incidents.\nNote: Supports the listed options only. If not provided, it will fetch events for critical severity level. Applies only when RSC fetch type is set to \"Event\"."
  name: event_severities
  options:
  - SEVERITY_CRITICAL
  - SEVERITY_WARNING
  - SEVERITY_INFO
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select Threat Monitoring Match Types to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"Threat Monitoring object\"."
  display: Threat Monitoring Match Types
  name: threat_monitoring_match_types
  options:
  - INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE
  - INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME
  - INDICATOR_OF_COMPROMISE_TYPE_HASH
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select Threat Monitoring Object Types to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"Threat Monitoring object\"."
  display: Threat Monitoring Object Types
  name: threat_monitoring_object_types
  options:
  - ShareFileset
  - NutanixVirtualMachine
  - VolumeGroup
  - HypervVirtualMachine
  - LinuxFileset
  - WindowsFileset
  - VmwareVirtualMachine
  type: 16
  required: false
  section: Collect
- additionalinfo: The time interval for the first fetch (retroactive). Examples of supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates.
  defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  section: Collect
  type: 19
- additionalinfo: "Maximum number of incidents to fetch every time. The maximum value is 1000.\n\nNote: If multiple fetch types (Events, Threat Monitoring objects, DSPM Violations, IR Violations, Sensitive Data Objects) are selected, the limit is distributed optimally among them to fetch all types."
  defaultvalue: '20'
  display: Fetch Limit (Maximum of 1000)
  name: max_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: When an event of Critical severity is detected and fetched, this setting indicates what severity will get assigned within XSOAR.
  defaultvalue: XSOAR HIGH
  display: Event Critical Severity Level Mapping
  name: radar_critical_severity_mapping
  options:
  - XSOAR CRITICAL
  - XSOAR HIGH
  - XSOAR MEDIUM
  - XSOAR LOW
  type: 15
  required: false
  section: Collect
- additionalinfo: When an event of Warning severity is detected and fetched, this setting indicates what severity will get assigned within XSOAR.
  defaultvalue: XSOAR LOW
  display: Event Warning Severity Level Mapping
  name: radar_warning_severity_mapping
  options:
  - XSOAR CRITICAL
  - XSOAR HIGH
  - XSOAR MEDIUM
  - XSOAR LOW
  type: 15
  required: false
  section: Collect
- additionalinfo: When a threat monitoring object is fetched, this setting indicates what severity will get assigned within XSOAR.
  defaultvalue: XSOAR HIGH
  display: Threat Monitoring Object Severity Level Mapping
  name: threat_monitoring_severity_mapping
  options:
  - XSOAR CRITICAL
  - XSOAR HIGH
  - XSOAR MEDIUM
  - XSOAR LOW
  type: 15
  required: false
  section: Collect
- additionalinfo: "Select DSPM violation statuses to fetch as incidents. Default is OPEN and IN_PROGRESS.\n\nNote: Applies only when RSC fetch type is set to \"DSPM Violation\"."
  display: DSPM Violation Statuses
  name: dspm_violation_status
  options:
  - OPEN
  - IN_PROGRESS
  - REMEDIATED
  - DISMISSED
  - CLOSED
  defaultvalue: "OPEN,IN_PROGRESS"
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select DSPM violation sensitivity levels to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"DSPM Violation\"."
  display: DSPM Violation Sensitivity Levels
  name: dspm_violation_sensitivity
  options:
  - HIGH
  - MEDIUM
  - LOW
  - NO
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select DSPM violation severity levels to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"DSPM Violation\"."
  display: DSPM Violation Severity Levels
  name: dspm_violation_severity
  options:
  - CRITICAL
  - HIGH
  - MEDIUM
  - LOW
  - SEVERITY_UNSPECIFIED
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select DSPM violation categories to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"DSPM Violation\"."
  display: DSPM Violation Categories
  name: dspm_violation_category
  options:
  - CATEGORY_UNSPECIFIED
  - MISPLACED
  - REDUNDANT
  - OVEREXPOSED
  - UNPROTECTED
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select DSPM violation object types to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"DSPM Violation\". Values not included in the options can be found in the documentation."
  display: DSPM Violation Object Types
  name: dspm_violation_object_type
  options:
  - AWS_NATIVE_DYNAMODB_TABLE
  - AWS_NATIVE_EBS_VOLUME
  - AWS_NATIVE_RDS_INSTANCE
  - AWS_NATIVE_S3_BUCKET
  - AZURE_MANAGED_DISK
  - AZURE_SQL_DATABASE_DB
  - AZURE_SQL_MANAGED_INSTANCE_DB
  - AZURE_STORAGE_ACCOUNT
  - AZURE_VIRTUAL_MACHINE
  - GCP_NATIVE_DISK
  - GCP_NATIVE_GCE_INSTANCE
  - HYPERV_VIRTUAL_MACHINE
  - K8S_PROTECTION_SET
  - K8S_VIRTUAL_MACHINE
  - LINUX_FILESET
  - NAS_FILESET
  - NUTANIX_VIRTUAL_MACHINE
  - O365_ONEDRIVE
  - O365_SITE
  - ORACLE_DATA_GUARD_GROUP
  - ORACLE_DATABASE
  - SHARE_FILESET
  - VOLUME_GROUP
  - VSPHERE_VIRTUAL_MACHINE
  - WINDOWS_FILESET
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select IR violation policy types to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"IR Violation\"."
  display: IR Violation Policy Types
  name: ir_violation_policy_type
  options:
  - IDENTITY
  - IDP
  - IDENTITY_EVENT
  - CROWDSTRIKE
  - MICROSOFT_DEFENDER
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select IR violation statuses to fetch as incidents. Default is OPEN and IN_PROGRESS.\n\nNote: Applies only when RSC fetch type is set to \"IR Violation\"."
  display: IR Violation Statuses
  name: ir_violation_status
  options:
  - OPEN
  - IN_PROGRESS
  - REMEDIATED
  - DISMISSED
  - CLOSED
  defaultvalue: "OPEN,IN_PROGRESS"
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select IR violation severity levels to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"IR Violation\"."
  display: IR Violation Severity Levels
  name: ir_violation_severity
  options:
  - CRITICAL
  - HIGH
  - MEDIUM
  - LOW
  - SEVERITY_UNSPECIFIED
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select IR violation categories to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"IR Violation\"."
  display: IR Violation Categories
  name: ir_violation_category
  options:
  - CATEGORY_UNSPECIFIED
  - AUTHENTICATION_AND_SECRET_MANAGEMENT
  - IDENTITY_HYGIENE
  - EXCESSIVE_IDENTITY_RIGHTS
  - IDENTITY_PROVIDER_SECURITY
  - PRIVILEGED_ACCOUNT_RISK
  - IDENTITY_RISK
  - INFRASTRUCTURE_SECURITY
  - CONFIGURATION_SECURITY
  - MEMBERSHIP_CHANGE
  - GPO_CHANGE
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select IR violation identity providers to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"IR Violation\"."
  display: IR Violation Identity Providers
  name: ir_violation_identity_provider
  options:
  - IDP_UNSPECIFIED
  - ON_PREM_AD
  - ENTRA_ID
  - AWS
  - LOCAL_AD
  - SHAREPOINT
  - SYSTEM
  - OKTA
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select IR violation identity tags to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"IR Violation\"."
  display: IR Violation Identity Tags
  name: ir_violation_identity_tag
  options:
  - IDENTITY_TAG_UNSPECIFIED
  - PRIVILEGED
  - AT_RISK
  - SENSITIVE
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select Sensitive Data Object sensitivity levels to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"Sensitive Data Object\"."
  display: Sensitive Data Object Sensitivity Levels
  name: sensitive_data_object_sensitivity
  options:
  - HIGH
  - MEDIUM
  - LOW
  - NO
  type: 16
  required: false
  section: Collect
- additionalinfo: "Select Sensitive Data Object types to fetch as incidents. Default is all.\n\nNote: Applies only when RSC fetch type is set to \"Sensitive Data Object\". Values not included in the options can be found in the documentation."
  display: Sensitive Data Object Types
  name: sensitive_data_object_type
  options:
  - VmwareVirtualMachine
  - LinuxFileset
  - ShareFileset
  - WindowsFileset
  - NutanixVirtualMachine
  - HypervVirtualMachine
  - VolumeGroup
  - NAS_FILESET
  - OLVM_VIRTUAL_MACHINE
  - AzureNativeVm
  - AzureNativeManagedDisk
  - AZURE_STORAGE_ACCOUNT
  - AZURE_SQL_DATABASE_DB
  - AZURE_SQL_MANAGED_INSTANCE_DB
  - O365Onedrive
  - O365Site
  - AWS_NATIVE_S3_BUCKET
  - AwsNativeEbsVolume
  - AwsNativeRdsInstance
  - AWS_NATIVE_DYNAMODB_TABLE
  - OracleDatabase
  - ORACLE_DATA_GUARD_GROUP
  - K8S_VIRTUAL_MACHINE
  - K8S_PROTECTION_SET
  - GcpNativeGCEInstance
  - GcpNativeDisk
  type: 16
  required: false
  section: Collect
- name: integration_reliability
  display: Source Reliability
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
  section: Collect
- additionalinfo: Whether to use XSOAR's system proxy settings to connect to the API.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: Whether to allow connections without verifying SSL certificates validity.
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
description: The Rubrik Security Cloud integration will fetch the Rubrik Anomaly Event and is rich with commands to perform the on-demand scans, backups, recoveries and many more features to manage and protect the organizational data.
script:
  commands:
  - arguments:
    - description: "The ID of the Polaris Event Series. When used in combination with \"Rubrik Radar Anomaly\" incidents, this value will automatically be looked up using the incident context. Otherwise it is a required value.\n\nNote: Users can retrieve the list of the activity series IDs by executing the \"rubrik-event-list\" command."
      name: activitySeriesId
      required: true
    - description: "The ID of the CDM cluster. When used in combination with \"Rubrik Radar Anomaly\" incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: clusterId
      required: true
    deprecated: true
    description: Check the Radar Event for updates.
    name: rubrik-radar-analysis-status
    outputs:
    - contextPath: Rubrik.Radar.EventComplete
      description: Flag that indicates whether Radar has finished analysing the object.
      type: Boolean
    - contextPath: Rubrik.Radar.Message
      description: The text, ID, and timestamp of each message in the Activity Series.
      type: Unknown
    - contextPath: Rubrik.Radar.ActivitySeriesId
      description: The ID of the Rubrik Polaris Activity Series.
      type: String
    - contextPath: Rubrik.Radar.ClusterId
      description: The ID of the cluster.
      type: String
  - arguments:
    - description: |-
        The name of the Rubrik object to check for sensitive hits.  When used in combination with "Rubrik Radar Anomaly" incidents, this value will automatically be looked up using the incident context. Otherwise it is a required value.

        Note: Users can get the list of the object names by executing the "rubrik-polaris-object-list" or "rubrik-polaris-object-search" command.
        .
      name: objectName
    - defaultValue: 7
      description: |-
        The number of days in the past to look for sensitive hits. If no value is provided, then today's data will be returned and, if there is no data for today then the argument will default to 7 days.
        .
      name: searchTimePeriod
    description: Find data classification hits on an object.
    name: rubrik-sonar-sensitive-hits
    outputs:
    - contextPath: Rubrik.Sonar.totalHits
      description: The total number of data classification hits found on the provided object.
      type: String
    - contextPath: Rubrik.Sonar.id
      description: ID of the sensitive hits object.
      type: String
    - contextPath: Rubrik.Sonar.policy_hits
      description: Information of the policy analyzer group of the sensitive hits object.
      type: Unknown
    - contextPath: Rubrik.Sonar.filesWithHits
      description: The total number of files with hits of the object.
      type: Number
    - contextPath: Rubrik.Sonar.openAccessFiles
      description: The total number of open access files of the object.
      type: Number
    - contextPath: Rubrik.Sonar.openAccessFilesWithHits
      description: The total number of open access files with hits of the object.
      type: Number
    - contextPath: Rubrik.Sonar.openAccessFolders
      description: The total number of open access folders of the object.
      type: Number
    - contextPath: Rubrik.Sonar.staleFiles
      description: The total number of stale files of the object.
      type: Number
    - contextPath: Rubrik.Sonar.staleFilesWithHits
      description: The total number of stale files with hits of the object.
      type: Number
    - contextPath: Rubrik.Sonar.openAccessStaleFiles
      description: The total number of open access stale files of the object.
      type: Number
    - contextPath: Rubrik.Radar.Message
      description: The text, ID, and timestamp of each message in the Activity Series.
      type: Unknown
    - contextPath: Rubrik.Radar.ActivitySeriesId
      description: The ID of the Rubrik Polaris Activity Series.
      type: String
  - arguments:
    - description: "The ID of the CDM cluster. When used in combination with \"Rubrik Radar Anomaly\" incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: clusterId
      required: true
    description: Find the CDM GeoLocation of a CDM Cluster.
    name: rubrik-cdm-cluster-location
    outputs:
    - contextPath: Rubrik.CDM.Cluster.Location
      description: The GeoLocation of the Rubrik CDM Cluster.
      type: String
    - contextPath: Rubrik.CDM.ClusterId
      description: The ID of the cluster.
      type: String
  - arguments:
    - description: "The ID of the CDM cluster. When used in combination with \"Rubrik Radar Anomaly\" incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: clusterId
      required: true
    description: Find the CDM Connection State of a CDM Cluster.
    name: rubrik-cdm-cluster-connection-state
    outputs:
    - contextPath: Rubrik.CDM.Cluster.ConnectionState
      description: The Connection State of the Rubrik CDM Cluster.
      type: String
    - contextPath: Rubrik.CDM.ClusterId
      description: The ID of the cluster.
      type: String
  - arguments:
    - defaultValue: 50
      description: Number of results to retrieve in the response. Maximum size allowed is 1000.
      name: limit
    - description: 'The name of the object to search for.'
      name: object_name
      required: true
    - defaultValue: ID
      description: "Specify the field to use for sorting the response.\n\nNote: Supported values are \"ID\" and \"NAME\" only. For any other values, the obtained result is sorted or not is not confirmed."
      name: sort_by
    - auto: PREDEFINED
      defaultValue: ASC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    description: Search for Rubrik discovered objects of any type, return zero or more matches.
    name: rubrik-polaris-object-search
    outputs:
    - contextPath: RubrikPolaris.GlobalSearchObject.id
      description: The ID of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.name
      description: The name of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.objectType
      description: The type of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.physicalPath.fid
      description: The FID of the physical path of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.physicalPath.name
      description: The name of the physical path where the object relies.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.physicalPath.objectType
      description: The object type of the physical path where the object relies.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.azureRegion
      description: The azure region of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.awsRegion
      description: The aws region of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.emailAddress
      description: The email address of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.isRelic
      description: Whether the object is relic (historical) or not.
      type: Boolean
    - contextPath: RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.id
      description: The effective SLA domain ID of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.name
      description: The effective SLA domain name of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.description
      description: The effective SLA domain description of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.fid
      description: The FID of the object's effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.cluster.id
      description: The cluster ID of the object's effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.cluster.name
      description: The cluster name of the object's effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.physicalChildConnection.count
      description: The count of physical child connection of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.id
      description: The ID of physical child connection of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.name
      description: The name of the physical child connection of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.replicatedObjects.cluster.id
      description: The cluster ID of the replicated objects of physical child connection of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.replicatedObjects.cluster.name
      description: The cluster name of the replicated objects of physical child connection of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.cluster.id
      description: The cluster ID related to the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.cluster.name
      description: The name of the cluster related to the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.primaryClusterLocation.id
      description: The primary cluster location ID of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.gcpZone
      description: The gcp zone of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.gcpRegion
      description: The gcp region of the object.
      type: String
    - contextPath: RubrikPolaris.GlobalSearchObject.gcpNativeProject.name
      description: The gcp native project name of the object.
      type: String
    - contextPath: RubrikPolaris.PageToken.GlobalSearchObject.next_page_token
      description: Next page token.
      type: String
    - contextPath: RubrikPolaris.PageToken.GlobalSearchObject.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.GlobalSearchObject.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
  - description: Retrieve the list of all the available Sonar policies.
    name: rubrik-sonar-policies-list
    outputs:
    - contextPath: RubrikPolaris.SonarPolicy.id
      description: Unique ID of the policy.
      type: String
    - contextPath: RubrikPolaris.SonarPolicy.name
      description: Name of the policy.
      type: String
    - contextPath: RubrikPolaris.SonarPolicy.description
      description: Descriptive name of the policy.
      type: String
    - contextPath: RubrikPolaris.SonarPolicy.creator.email
      description: Email of the user who created the policy.
      type: String
    - contextPath: RubrikPolaris.SonarPolicy.totalObjects
      description: Number of total objects present in the policy.
      type: Number
    - contextPath: RubrikPolaris.SonarPolicy.numAnalyzers
      description: Number of analyzers present in the policy.
      type: Number
    - contextPath: RubrikPolaris.SonarPolicy.objectStatuses.id
      description: ID of the object present in the policy.
      type: String
    - contextPath: RubrikPolaris.SonarPolicy.objectStatuses.latestSnapshotResult.snapshotFid
      description: Snapshot ID of the object present in the policy.
      type: String
    - contextPath: RubrikPolaris.SonarPolicy.objectStatuses.policyStatuses.policyId
      description: Policy ID.
      type: String
    - contextPath: RubrikPolaris.SonarPolicy.objectStatuses.policyStatuses.status
      description: Policy status.
      type: String
  - description: List the analyzer group policies.
    name: rubrik-sonar-policy-analyzer-groups-list
    outputs:
    - contextPath: RubrikPolaris.SonarAnalyzerGroup.id
      description: The analyzer group ID.
      type: String
    - contextPath: RubrikPolaris.SonarAnalyzerGroup.name
      description: The name of the analyzer group.
      type: String
    - contextPath: RubrikPolaris.SonarAnalyzerGroup.groupType
      description: The analyzer group type.
      type: String
    - contextPath: RubrikPolaris.SonarAnalyzerGroup.analyzers.id
      description: The ID of the analyzers belong to the group.
      type: String
    - contextPath: RubrikPolaris.SonarAnalyzerGroup.analyzers.name
      description: The name of the analyzers belong to the group.
      type: String
    - contextPath: RubrikPolaris.SonarAnalyzerGroup.analyzers.analyzerType
      description: The type of the analyzers belong to the group.
      type: String
  - arguments:
    - description: "The ID of the object to get details.\n\nNote: Users can get the list of the object IDs by executing the \"rubrik-polaris-vm-objects-list\" command."
      name: object_id
      required: true
    description: Retrieve details for a Vsphere object based on the provided object ID.
    name: rubrik-polaris-vm-object-metadata-get
    outputs:
    - contextPath: RubrikPolaris.VSphereVm.id
      description: Unique ID of the object.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.authorizedOperations
      description: List of operations performed by the object.
      type: Unknown
    - contextPath: RubrikPolaris.VSphereVm.metadata.name
      description: The name of the object.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.isRelic
      description: Whether the object is relic or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.id
      description: ID of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.name
      description: Name of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.cluster.id
      description: ID of the cluster of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.cluster.name
      description: Name of the cluster of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.fid
      description: SLA Source object FID.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.name
      description: SLA source object name.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.objectType
      description: SLA source object type.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.protectionDate
      description: Protection date of the object.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.reportSnappable.id
      description: The ID of the snappable for a particular report related to an object. Snappable supports backups or filesets of physical machines using the rubrik connector.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.reportSnappable.logicalBytes
      description: Logical bytes of snappable report.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.metadata.reportSnappable.physicalBytes
      description: The physical byte of the snappable for a particular report related to an object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.metadata.reportSnappable.archiveStorage
      description: The archived storage of the snappable for a particular report related to an object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.id
      description: Unique ID of the cluster which is the datastore for the recovered virtual machine.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.name
      description: Cluster name of the VM to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.status
      description: Cluster status of the VM to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.version
      description: Cluster version of the VM to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.lastConnectionTime
      description: Last time when the vm was connected to the cluster.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.defaultAddress
      description: Default address where the cluster is stored.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.id
      description: Node ID of the node connection related to cluster.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.status
      description: Node status of the node connection related to cluster.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.ipAddress
      description: IP address of the node connection related to cluster.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.state.connectedState
      description: Connected state of the cluster.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.state.clusterRemovalState
      description: State of the cluster if it is registered for removal or not.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.passesConnectivityCheck
      description: Whether the cluster passes connectivity check or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.globalManagerConnectivityStatus.urls.url
      description: URL of Global Manager Connectivity Status.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.globalManagerConnectivityStatus.urls.isReachable
      description: Whether the url in global Manager Connectivity Status is reachable or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.cluster.connectivityLastUpdated
      description: Date time when the connectivity status of the cluster is lastly updated.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.primaryClusterLocation.id
      description: The location ID of the primary cluster to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.primaryClusterLocation.name
      description: The location name of the primary cluster to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.arrayIntegrationEnabled
      description: Whether the array integration is enabled or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.snapshotConsistencyMandate
      description: "Data consistency in recovery points is the snapshot consistency mandate. It is broadly classified into 3 categories: inconsistent, crash-consistent, app-consistent."
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.agentStatus.agentStatus
      description: The status of an agent related to an object. In Rubrik agents are connectors also known as Rubrik Backup Service.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.logicalPath.fid
      description: The logical path ID of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.logicalPath.objectType
      description: The logical object type of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.logicalPath.name
      description: The logical name of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.physicalPath.fid
      description: The physical path of where the VM resides.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.physicalPath.objectType
      description: The physical path object type of the VM.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.physicalPath.name
      description: The physical Name of the VM.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.vsphereTagPath.fid
      description: FID of Vsphere tag.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.vsphereTagPath.objectType
      description: Object type of Vsphere tag.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.vphereTagPath.name
      description: Name of Vsphere tag.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.oldestSnapshot.id
      description: The ID of the oldest snapshot.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.oldestSnapshot.date
      description: The date when the oldest snapshot was generated.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.oldestSnapshot.isIndexed
      description: Whether the oldest snapshot is indexed or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.totalSnapshots.count
      description: Total snapshot counts.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.metadata.replicatedObjects.id
      description: The ID of the object which is replicated in the VM.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.replicatedObjects.primaryClusterLocation.id
      description: The primary cluster location ID where the replicated object resides.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.replicatedObjects.primaryClusterLocation.name
      description: The primary cluster location name where the replicated object resides.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.replicatedObjects.cluster.name
      description: The cluster name where the replicated object resides.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.replicatedObjects.cluster.id
      description: The cluster ID where the replicated object resides.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.id
      description: ID of the newest archived snapshot.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.date
      description: The date when the newest archived snapshot was generated.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.isIndexed
      description: Whether the newest archived snapshot is indexed or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.archivalLocations.id
      description: ID of the archival location of the newest archived snapshot.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.archivalLocations.name
      description: Name of the archival location of the newest archival snapshot.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.id
      description: The ID of the newest replicated snapshot.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.date
      description: The date when the newest replicated snapshot was generated.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.isIndexed
      description: Whether the newest replicated snapshot is indexed or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.replicationLocations.id
      description: The ID of the replication locations of the newest replicated snapshot.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.replicationLocations.name
      description: The name of the replication locations of the newest replicated snapshot.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestSnapshot.id
      description: The ID of the newest snapshot.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestSnapshot.date
      description: The date when the newest snapshot was generated.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.metadata.newestSnapshot.isIndexed
      description: Whether the newest snapshot is indexed or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.onDemandSnapshotCount
      description: Count of how many on demand snapshot created in a VM.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.metadata.vmwareToolsInstalled
      description: Whether the Vmware tools are installed or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.metadata.cdmLink
      description: The Cloud Data Management link to navigate to the VM on cloud.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: "Filter based on whether VM objects are moved to relic/archive or not.\n\nPossible values are: \"True\", \"False\"."
      name: is_relic
      predefined:
      - "True"
      - "False"
    - auto: PREDEFINED
      description: "Filter based on whether VM objects are replicated or not.\n\nPossible values are: \"True\", \"False\"."
      name: is_replicated
      predefined:
      - "True"
      - "False"
    - defaultValue: 50
      description: Number of results to retrieve in the response. Maximum size allowed is 1000.
      name: limit
    - defaultValue: ID
      description: "Specify the field to use for sorting the response.\n\nNote: Supported values are \"ID\" and \"NAME\" only. For any other values, the obtained result is sorted or not is not confirmed."
      name: sort_by
    - auto: PREDEFINED
      defaultValue: ASC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    description: Retrieve a list of all the objects of the Vsphere Vm known to the Rubrik.
    name: rubrik-polaris-vm-objects-list
    outputs:
    - contextPath: RubrikPolaris.VSphereVm.id
      description: Unique ID of the object.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.name
      description: Name of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.objectType
      description: Object type of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.replicatedObjectCount
      description: Number of objects replicated in the node in which the object relies.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.cluster.id
      description: ID of the cluster which is the datastore for the recovered virtual machine.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.cluster.name
      description: Cluster name of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.cluster.version
      description: Cluster version of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.cluster.status
      description: Cluster status of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaDomain.id
      description: ID of the SLA domain which is simply a set of policies that define at what frequencies backups should be performed of the protected objects within Rubrik and for how long they should be either locally or a replication partner or on the archival location.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaDomain.name
      description: Descriptive name of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaDomain.description
      description: Description of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaDomain.fid
      description: FID of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaDomain.cluster.id
      description: ID of the cluster related to the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaDomain.cluster.name
      description: Name of the cluster related to the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaSourceObject.fid
      description: SLA source object FID.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaSourceObject.name
      description: SLA source object name.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.effectiveSlaSourceObject.objectType
      description: SLA source object type.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.slaAssignment
      description: A SLA rule when referred at assignment is SLA assignment.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.isRelic
      description: Whether the object is relic or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.authorizedOperations
      description: List of operations that can be performed on the object.
      type: Unknown
    - contextPath: RubrikPolaris.VSphereVm.primaryClusterLocation.id
      description: The location ID of the primary cluster to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.primaryClusterLocation.name
      description: The location name of the primary cluster to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.logicalPath.fid
      description: The logical path ID of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.logicalPath.name
      description: The logical path name of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.logicalPath.objectType
      description: The logical object type of the node to which the object belongs.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.snapshotDistribution.id
      description: Rubrik uses a snapshot for powerful data protection. Snapshot distribution ID is the ID of the snapshot distribution node related to a particular object.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.snapshotDistribution.onDemandCount
      description: The demand count of distribution of snapshot related to an object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.snapshotDistribution.retrievedCount
      description: The retrieved count of distribution of snapshot related to an object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.snapshotDistribution.scheduledCount
      description: The scheduled count of distribution of snapshot related to an object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.snapshotDistribution.totalCount
      description: The total count of distribution of snapshot related to an object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.reportSnappable.id
      description: The ID of the snappable for a particular report related to an object. Snapple supports backups or filesets of physical machines using the rubrik connector.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.reportSnappable.archieveStorage
      description: The archived storage of the snappable for a particular report related to an object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.reportSnappable.physicalBytes
      description: The physical byte of the snappable for a particular report related to an object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.vmwareToolsInstalled
      description: Whether the vm tools are installed or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.agentStatus.agentStatus
      description: The status of an agent related to an object. The Rubrik agents are connectors also known as Rubrik Backup Service.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.agentStatus.disconnectReason
      description: Displays the reason if the agent disconnects.
      type: String
    - contextPath: RubrikPolaris.PageToken.VSphereVm.next_page_token
      description: Next page token.
      type: String
    - contextPath: RubrikPolaris.PageToken.VSphereVm.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.VSphereVm.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
  - arguments:
    - description: |-
        Name of the scan. If not provided, it defaults to "<today's date> Classification".
        .
      name: scan_name
    - description: "List of sonar policies to scan.\n\nNote: Users can get the list of analyzer groups by executing the \"rubrik-sonar-policy-analyzer-groups-list\" command. \n\nFormat Accepted: \n[\n        {\n            \"id\": \"543dd5e0-c72c-50e2-a3d9-1688343f472c\",\n            \"name\": \"HIPAA\",\n            \"groupType\": \"HIPAA\",\n            \"analyzers\": [\n                {\n                    \"id\": \"9da675b3-944b-5da3-a2da-ed149d300075\",\n                    \"name\": \"US/UK Passport\",\n                    \"analyzerType\": \"PASSPORT\"\n                },\n                {\n                    \"id\": \"18665533-c28c-5a40-b747-4b6508fecdfa\",\n                    \"name\": \"US NPI\",\n                    \"analyzerType\": \"US_HEALTHCARE_NPI\"\n                }\n            ]\n      }\n]."
      name: sonar_policy_analyzer_groups
      required: true
    - description: "List of VM object IDs to scan.\n\nNote: Users can get the list of VM object IDs by executing the \"rubrik-polaris-vm-objects-list\" command."
      name: objects_to_scan
      required: true
    description: "Trigger an on-demand scan of a system. Supports \"Vsphere VM\" object type only.\n\nNote: To know the scan status use the \"rubrik-sonar-ondemand-scan-status\" command. To download the completed request use the \"rubrik-sonar-ondemand-scan-result\" command."
    name: rubrik-sonar-ondemand-scan
    outputs:
    - contextPath: RubrikPolaris.SonarOndemandScan.crawlId
      description: Unique crawl ID.
      type: String
  - arguments:
    - description: "ID for which scanning status is to be obtained.\n\nNote: Users can get the crawl ID by executing the \"rubrik-sonar-ondemand-scan\" command."
      name: crawl_id
      required: true
    description: "Retrieve the status of a scanned system.\n\nNote: To download the completed request use the \"rubrik-sonar-ondemand-scan-result\" command."
    name: rubrik-sonar-ondemand-scan-status
    outputs:
    - contextPath: RubrikPolaris.SonarOndemandScan.crawlId
      description: Crawl ID of the scan for which the rubrik-sonar-ondemand-scan command is hit.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.error
      description: Error description if any.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.snappable.id
      description: Snappable ID of the scanned object.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.snappable.name
      description: Snappable Name of the scanned object.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.snappable.objectType
      description: Snappable object type of the scanned object.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.snapshotTime
      description: Time when the snapshot is taken.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.status
      description: Status of the scanning or scanned object.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.progress
      description: Count of objects that are in progress.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.totalHits
      description: Number of total hits obtained from an object that is scanned.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.groupType
      description: Group type of the analyzer.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.id
      description: Group ID of the analyzer.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.name
      description: Group Name of the analyzer.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.totalHits
      description: Number of total hits obtained from an analyzer that is scanned.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.violations
      description: Number of violations obtained from an analyzer that is scanned.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.permittedHits
      description: Number of permitted hits obtained from an analyzer that is scanned.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.analyzer.id
      description: ID of the analyzer that is scanned.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analzerGroupResults.analyzerResults.analyzer.name
      description: Name of the analyzer that is scanned.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.analyzer.analyzerType
      description: Type of the analyzer that is scanned.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.totalHits
      description: Number of total hits obtained from an analyzer group.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.violations
      description: Number of violations obtained from an analyzer group.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.permittedHits
      description: Number of permitted hits obtained from an analyzer group.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.violationsDelta
      description: Number of violation delta obtained from an analyzer group.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.totalHitsDelta
      description: Number of total hits delta obtained from an analyzer group.
      type: Number
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.cluster.id
      description: Cluster ID in which the object is getting scanned.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.cluster.name
      description: Cluster name in which the object is getting scanned.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Status.cluster.type
      description: Cluster type in which the object is getting scanned.
      type: String
  - arguments:
    - description: "The object ID for which the snapshots are to be searched.\n\nNote: Users can get the list of the object IDs by executing the \"rubrik-polaris-vm-objects-list\" command."
      name: object_id
      required: true
    - auto: PREDEFINED
      defaultValue: Day
      description: "Grouping the snapshots on the basis of the selected value.\n\nPossible values are: \"Month\", \"Day\", \"Year\", \"Week\", \"Hour\", \"Quarter\"."
      name: snapshot_group_by
      predefined:
      - Month
      - Day
      - Year
      - Week
      - Hour
      - Quarter
    - auto: PREDEFINED
      defaultValue: DAY
      description: "Grouping the missed snapshots on the basis of the selected value.\n\nPossible values are: \"MONTH\", \"DAY\", \"YEAR\", \"WEEK\", \"HOUR\", \"QUARTER\"."
      name: missed_snapshot_group_by
      predefined:
      - MONTH
      - DAY
      - YEAR
      - WEEK
      - HOUR
      - QUARTER
    - description: "The start date to get snapshots from.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc."
      name: start_date
      required: true
    - description: "The end date to get snapshots until.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc."
      name: end_date
      required: true
    - description: "The timezone offset from UTC changes to match the configured time zone. Use this argument to filter the data according to the provided timezone offset.\n\nFormats accepted: 1, 1.5, 2, 2.5, 5.5, etc."
      name: timezone_offset
      required: true
    - auto: PREDEFINED
      defaultValue: "True"
      description: "Whether the cluster is connected or not.\n\nPossible values are: \"True\", \"False\"."
      name: cluster_connected
      predefined:
      - "True"
      - "False"
    description: "Search for a Rubrik snapshot of an object based on the provided snapshot ID, exact timestamp, or specific value like earliest/latest, or closest before/after a timestamp."
    name: rubrik-polaris-vm-object-snapshot-list
    outputs:
    - contextPath: RubrikPolaris.VSphereVm.id
      description: Unique ID of the object.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.unit
      description: Unit of snapshot group by connection nodes.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.start
      description: Start date of snapshot group by connection nodes.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.end
      description: End date of snapshot group by connection nodes.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.count
      description: Count of snapshot connections related to the object.
      type: Number
    - contextPath: RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.id
      description: ID of snapshot connection related to the object.
      type: String
    - contextPath: RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.isIndexed
      description: Whether the node is indexed or not.
      type: Boolean
    - contextPath: RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.isUnindexable
      description: Whether the node is unindexable or not.
      type: Boolean
  - arguments:
    - description: "ID for which file needs to be downloaded.\n\nNote: Users can get the crawl_id by executing the \"rubrik-sonar-ondemand-scan\" command."
      name: crawl_id
      required: true
    - auto: PREDEFINED
      description: |-
        The type of the file that needs to be downloaded.

        Possible values are: "ANY", "HITS", "STALE", "OPEN_ACCESS", "STALE_HITS", "OPEN_ACCESS_HITS".
      name: file_type
      predefined:
      - ANY
      - HITS
      - STALE
      - OPEN_ACCESS
      - STALE_HITS
      - OPEN_ACCESS_HITS
      required: true
    description: Retrieve the download link for the requested scanned file.
    name: rubrik-sonar-ondemand-scan-result
    outputs:
    - contextPath: RubrikPolaris.SonarOndemandScan.crawlId
      description: Crawl ID of the file that needs to be downloaded.
      type: String
    - contextPath: RubrikPolaris.SonarOndemandScan.Result.downloadLink
      description: Link to download the file when scan status is complete.
      type: String
  - arguments:
    - description: "The unique ID of the cluster.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: cluster_id
      required: true
    - description: "The CDM snapshot ID.\n\nNote: Users can retrieve the list of snapshot IDs by executing the \"rubrik-polaris-vm-object-snapshot-list\" command.\nUse the \"rubrik-radar-suspicious-file-list\" command to retrieve the actual CDM ID from the Anomaly ID.\nExample format to get the snapshot CDM ID from Anomaly ID: \"<Cluster-ID>:::VirtualMachine:::<Snappable-ID>:::<CDM-ID>\"."
      name: snapshot_id
      required: true
    - description: "The VM object ID (Snappable ID).\n\nNote: Users can retrieve the list of Snappable IDs by executing the \"rubrik-polaris-vm-objects-list\" command.\nExample format to get the Snappable ID: \"VirtualMachine:::<Snappable-ID>\"."
      name: object_id
      required: true
    - auto: PREDEFINED
      defaultValue: "False"
      description: If set to True, the command downloads the anomaly analysis CSV file directly on XSOAR server.
      name: download_file
      predefined:
      - "True"
      - "False"
    description: Request for the analysis and retrieve the download link or directly download file for the Radar CSV analyzed file.
    name: rubrik-radar-anomaly-csv-analysis
    outputs:
    - contextPath: RubrikPolaris.RadarAnomalyCSV.clusterId
      description: Cluster ID of the CSV.
      type: String
    - contextPath: RubrikPolaris.RadarAnomalyCSV.snapshotId
      description: Snapshot ID of the CSV.
      type: String
    - contextPath: RubrikPolaris.RadarAnomalyCSV.objectId
      description: Object ID of the CSV.
      type: String
    - contextPath: RubrikPolaris.RadarAnomalyCSV.investigationCsvDownloadLink.downloadLink
      description: The download link of the CSV analysis.
      type: String
    - contextPath: File.Size
      description: File size in bytes.
      type: String
    - contextPath: File.SHA1
      description: SHA1 hash of file.
      type: String
    - contextPath: File.SHA256
      description: SHA256 hash of file.
      type: String
    - contextPath: File.SHA512
      description: SHA512 hash of file.
      type: String
    - contextPath: File.Name
      description: File name.
      type: String
    - contextPath: File.SSDeep
      description: SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: Unknown
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  - arguments:
    - description: "ID of the snapshot.\n\nNote: Users can retrieve the list of snapshot IDs by executing the \"rubrik-polaris-vm-object-snapshot-list\"  command."
      name: snapshot_id
      required: true
    - description: "Object ID.\n\nNote: Users can retrieve the list of object IDs by executing \"rubrik-polaris-vm-objects-list\" command."
      name: object_id
      required: true
    - auto: PREDEFINED
      description: "The type of the file that needs to be downloaded.\n\nPossible values are: \"ANY\", \"HITS\", \"STALE\", \"OPEN_ACCESS\", \"STALE_HITS\", \"OPEN_ACCESS_HITS\"."
      name: file_type
      predefined:
      - ANY
      - HITS
      - STALE
      - OPEN_ACCESS
      - STALE_HITS
      - OPEN_ACCESS_HITS
    description: "Request to download the Sonar CSV Snapshot results file.\n\nNote: To know the ID and status of the download, use the \"rubrik-user-downloads-list\" command. To download the file, use the \"rubrik-sonar-csv-result-download\" command."
    name: rubrik-sonar-csv-download
    outputs:
    - contextPath: RubrikPolaris.SonarCSVDownload.snapshotId
      description: Snapshot ID of the CSV requested to download.
      type: String
    - contextPath: RubrikPolaris.SonarCSVDownload.objectId
      description: Object ID of the CSV requested to download.
      type: String
    - contextPath: RubrikPolaris.SonarCSVDownload.downloadSnapshotResultsCsv.isSuccessful
      description: The status of the download.
      type: Boolean
  - arguments:
    - description: "The Snapshot ID of the file that needs to be downloaded.\n\nNote: Users can retrieve the list of the snapshot IDs by executing the \"rubrik-polaris-vm-object-snapshot-list\" command."
      name: snapshot_id
      required: true
    - description: "The path of the folder to list the sub-files. If not provided the root directory files will be returned.\n\nFormat accepted : \"/<directory name>/<sub directory name or file name>\"\n\nExample: \"/C:\", \"/C:/Users\"."
      name: path
    - description: "Provide a keyword to search in the file names.\n\nExample: \"admin\"."
      name: search_prefix
    - defaultValue: 50
      description: Number of results to retrieve in the response. Maximum size allowed is 1000.
      name: limit
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    description: "Retrieve the list of the available files that can be downloaded.\n\nNote: To initiate the file download request use the \"rubrik-gps-snapshot-files-download\" command."
    name: rubrik-gps-snapshot-files-list
    outputs:
    - contextPath: RubrikPolaris.GPSSnapshotFile.snapshotId
      description: Snapshot ID provided as an argument to retrieve the files.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFile.node.absolutePath
      description: The absolute path of the file.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFile.node.displayPath
      description: The display path of the file.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFile.node.path
      description: The path of the file.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFile.node.filename
      description: The name of the file.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFile.node.fileMode
      description: The mode of the file.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFile.node.size
      description: The size of the file.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFile.node.lastModified
      description: The last modified time of the file.
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSSnapshotFile.next_page_token
      description: Next page token.
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSSnapshotFile.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSSnapshotFile.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
  - arguments:
    - description: Name given to the VM that runs the snapshot. If not provided the name will be "<Snapshot VM Name> <MM/DD of snapshot creation> <hh/mm of snapshot creation> <Num>".
      name: vm_name
    - description: "The VM object ID whose snapshot needs to be exported.\n\nNote: Users can get the list of object IDs by executing the \"rubrik-polaris-vm-objects-list\" command."
      name: object_id
      required: true
    - description: "The ID of the snapshot that is to be exported.\n\nNote: Users can get the list of snapshot IDs by executing the \"rubrik-polaris-vm-object-snapshot-list\" command."
      name: snapshot_id
      required: true
    - description: "The ID of the datastore which will be used by the new VM.\n\nNote: Users can get the list of  datastore IDs by executing the \"rubrik-gps-vm-datastore-list\" command."
      name: datastore_id
      required: true
    - description: "The ID of the Vsphere ESXi host on which the new VM will be made. Either host_id or host_compute_cluster_id must be provided.\\n\nNote: Users can get the list of host IDs by executing the \"rubrik-gps-vm-host-list\" command."
      name: host_id
    - description: "The ID of the VSphere Compute Cluster of a host. Either host_id or host_compute_cluster_id must be provided. \n\nNote: Users can get the list of Compute Cluster IDs by executing the \"rubrik-gps-vm-host-list\" command. The ID must belong to the VSphereComputeCluster objectType."
      name: host_compute_cluster_id
    - auto: PREDEFINED
      description: |-
        Whether to turn on the new VM or not.

        Possible values are: "True", "False".
      name: power_on
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: |-
        Whether the mac addresses of network devices of the new VM be removed or not.

        Possible values are: "True", "False".
      name: keep_mac_addresses
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: |-
        Whether the network devices on the original VM be kept or not.

        Possible values are: "True", "False".
      name: remove_network_devices
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: |-
        Whether to keep vSphere tags associated with the original VM or not.

        Possible values are: "True", "False".
      name: recover_tags
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: |-
        Whether to disable networking on the new VM or not.

        Possible values are: "True", "False".
      name: disable_network
      predefined:
      - 'True'
      - 'False'
    description: "Request to initiate an export of a snapshot of a virtual machine.\n\nNote: To know about the exported VM's status, use the \"rubrik-gps-async-result\" command."
    name: rubrik-gps-vm-export
    outputs:
    - contextPath: RubrikPolaris.GPSVMSnapshotExport.id
      description: Snapshot export request ID.
      type: String
  - description: "Retrieve the user downloads. This would return the current and past download history.\n\nNote: To download the requested Sonar CSV Snapshot results file use the \"rubrik-sonar-csv-result-download\" command."
    name: rubrik-user-downloads-list
    outputs:
    - contextPath: RubrikPolaris.UserDownload.id
      description: The ID of the download.
      type: Number
    - contextPath: RubrikPolaris.UserDownload.name
      description: The name of the download.
      type: String
    - contextPath: RubrikPolaris.UserDownload.status
      description: The status of the download.
      type: String
    - contextPath: RubrikPolaris.UserDownload.progress
      description: The progress of the download.
      type: Number
    - contextPath: RubrikPolaris.UserDownload.identifier
      description: The identifier of the download or the type of download requested.
      type: String
    - contextPath: RubrikPolaris.UserDownload.createTime
      description: The creation time of the download.
      type: String
    - contextPath: RubrikPolaris.UserDownload.completeTime
      description: The completion time of the download.
      type: String
  - arguments:
    - description: Name of the SLA Domain to search for.
      name: name
    - description: "Cluster, the SLA domain is managed by.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: cluster_id
    - auto: PREDEFINED
      description: "Filters SLA domain based on the provided object types. Supports comma separated values. \n\nPossible values are: \"FILESET_OBJECT_TYPE\", \"VSPHERE_OBJECT_TYPE\"."
      isArray: true
      name: object_type
    - auto: PREDEFINED
      defaultValue: 'True'
      description: "Whether to show Cluster SLAs and not Global SLAs. \"False\" value will result in showing only Global SLAs. \n\nPossible values are: \"True\", \"False\"."
      name: show_cluster_slas_only
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: NAME
      description: "Specify the field to use for sorting the response.\n\nPossible values are: \"NAME\", \"PROTECTED_OBJECT_COUNT\"."
      name: sort_by
      predefined:
      - NAME
      - PROTECTED_OBJECT_COUNT
    - auto: PREDEFINED
      defaultValue: ASC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    description: Enumerates the available SLA Domains to apply to the on-demand snapshot as a retention policy.
    name: rubrik-gps-sla-domain-list
    outputs:
    - contextPath: RubrikPolaris.GPSSLADomain.name
      description: Name of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.id
      description: ID of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.description
      description: Description of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.protectedObjectCount
      description: Number of objects under the SLA Domain.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.baseFrequency.duration
      description: Base snapshot frequency duration.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.baseFrequency.unit
      description: Base snapshot frequency unit (HOURS, DAYS etc).
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.archivalSpec.archivalLocationName
      description: Location where the archives are stored.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.id
      description: ID of the archival target.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.name
      description: Name of the archival target.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.groupType
      description: Group type of the archival target.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.targetType
      description: Target type of the archival target.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpec.replicationType
      description: 'Enum value representing the type of replication. Values: UNKNOWN_REPLICATION_TYPE, UNIDIRECTIONAL_REPLICATION_TO_CLUSTER, REPLICATION_TO_CLOUD_REGION, REPLICATION_TO_CLOUD_LOCATION.'
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.unidirectionalSpec.replicationTargetName
      description: Cloud replication target name.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudRegionSpec.replicationTargetRegion
      description: Cloud replication target region.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudRegionSpec.cloudProvider
      description: 'Cloud replication service provider. Values:  AWS, AZURE.'
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudLocationSpec.targetMapping.id
      description: ID of the cloud target where replication takes place.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudLocationSpec.targetMapping.name
      description: Name of the cloud target where replication takes place.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.cluster.id
      description: ID of the cluster where replication takes place.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.cluster.name
      description: Name of the cluster where replication takes place.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.accountId
      description: Account ID on AWS where the replication happens.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.accountName
      description: Account name on AWS where the replication happens.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.region
      description: Account region on AWS where the replication happens.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.azureTarget.region
      description: Account region on Azure where the replication happens.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.retentionDuration.duration
      description: Replication retention duration.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.retentionDuration.unit
      description: Replication retention duration unit.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.targetMapping.id
      description: ID of the object target where replication takes place.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.replicationSpecsV2.targetMapping.name
      description: Name of the object target where replication takes place.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.localRetentionLimit.duration
      description: Local retention limit duration.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.localRetentionLimit.unit
      description: Local retention limit duration unit.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.frequency
      description: Snapshot frequency every minute.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.retention
      description: Snapshot retention value per minute snapshots.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.retentionUnit
      description: Snapshot retention time unit per minute snapshots.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.frequency
      description: Snapshot hourly frequency.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.retention
      description: Snapshot retention value per hour snapshots.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.retentionUnit
      description: Snapshot retention time unit per hour snapshots.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.frequency
      description: Snapshot daily frequency.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.retention
      description: Snapshot retention value per day snapshots.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.retentionUnit
      description: Snapshot retention unit per day snapshots.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.frequency
      description: Snapshot weekly frequency.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.retention
      description: Snapshot retention value per week snapshots.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.retentionUnit
      description: Snapshot retention unit per week snapshots.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.dayOfWeek
      description: Starting day of the weekly snapshot.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.frequency
      description: Snapshot monthly frequency.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.retention
      description: Snapshot retention value per month snapshots.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.retentionUnit
      description: Snapshot retention unit per month snapshots.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.dayOfMonth
      description: Starting day of the month snapshot.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.frequency
      description: Snapshot quarterly frequency.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.retention
      description: Snapshot retention value per quarter snapshots.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.retentionUnit
      description: Snapshot retention unit per quarter snapshots.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.dayOfQuarter
      description: Starting day of the quarterly snapshot.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.quarterStartMonth
      description: Starting month of the quarterly snapshot.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.frequency
      description: Snapshot yearly frequency.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.retention
      description: Snapshot retention value per year snapshots.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.retentionUnit
      description: Snapshot retention unit per year snapshots.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.dayOfYear
      description: Starting day of the yearly snapshot.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.yearStartMonth
      description: Starting month of the yearly snapshot.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.awsRdsConfig.logRetention.duration
      description: Duration of retentioning AWS Relational database logs.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.awsRdsConfig.logRetention.unit
      description: Unit of duration of retentioning AWS Relational database logs.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.incrementalFrequency.duration
      description: Duration of retentioning SAP HANA incremental backups.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.incrementalFrequency.unit
      description: Unit of duration of retentioning SAP HANA incremental backups.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.differentialFrequency.duration
      description: Duration of retentioning SAP HANA differential backups.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.differentialFrequency.unit
      description: Unit of duration of retentioning SAP HANA differential backups.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.logRetention.duration
      description: Duration of retensioning SAP HANA Database logs.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.logRetention.unit
      description: Unit of duration of retentioning SAP HANA Database logs.
      type: String
    - contextPath: RubrikPolaris.GPSSLADomain.objectSpecificConfigs.vmwareVmConfig.logRetentionSeconds
      description: Seconds of retentioning VMWare virtual machine logs.
      type: Number
    - contextPath: RubrikPolaris.GPSSLADomain.objectTypes
      description: List of object types associated with this SLA Domain.
      type: Unknown
  - arguments:
    - description: "The ID of the download, requested using \"rubrik-sonar-csv-download\" command.\n\nNote: Users can retrieve the list of downloads containing ID by executing the \"rubrik-user-downloads-list\" command."
      name: download_id
      required: true
    description: Retrieve the download link for the requested Sonar CSV Snapshot file.
    name: rubrik-sonar-csv-result-download
    outputs:
    - contextPath: RubrikPolaris.SonarCSVDownload.downloadId
      description: The download ID of the download request.
      type: String
    - contextPath: RubrikPolaris.SonarCSVDownload.getDownloadUrl.url
      description: The link of the file that needs to be downloaded.
      type: String
  - arguments:
    - description: "The ID of the object whose snapshot is to be created. \n\nNote: Users can get the list of object IDs by executing the \"rubrik-polaris-vm-objects-list\" command."
      name: object_id
      required: true
    - description: "The ID of the SLA domain retention policy to be applied on the object.\n\nNote: Users can get the list of SLA Domain IDs by executing the \"rubrik-gps-sla-domain-list\" command."
      name: sla_domain_id
    description: "Triggers an on-demand snapshot of a system.\n\nNote: To know about the status of the on-demand snapshot creation, use the \"rubrik-gps-async-result\" command."
    name: rubrik-gps-vm-snapshot-create
    outputs:
    - contextPath: RubrikPolaris.GPSOndemandSnapshot.id
      description: ID of the requested snapshot.
      type: String
    - contextPath: RubrikPolaris.GPSOndemandSnapshot.status
      description: Status of the requested snapshot.
      type: String
  - arguments:
    - description: "The Snapshot ID of the file that needs to be downloaded.\n\nNote: Users can retrieve the list of the snapshot IDs by executing the \"rubrik-polaris-vm-object-snapshot-list\" command."
      name: snapshot_id
      required: true
    - description: "The absolute path of the file to be downloaded. A list of files can be downloaded as a zip folder. Multiple file paths can be separated with comma(,).\n\nNote: Users can retrieve the list of the files with absolute path by executing the \"rubrik-gps-snapshot-files-list\" command.\n\nFormat accepted: \"/<directory name>/<sub directory name or file name>\"\n\nExample: \"/C:/PerfLogs/Admin\", \"/C:/Windows/Microsoft.NET\"."
      name: file_path
      isArray: true
      required: true
    - description: "The type of object for which the file to be downloaded.\n\nPossible values are: \"WindowsFileset\", \"LinuxFileset\", \"VolumeGroup\", \"VmwareVm\"."
      defaultValue: 'VmwareVm'
      name: object_type
      predefined:
      - 'WindowsFileset'
      - 'LinuxFileset'
      - 'VolumeGroup'
      - 'VmwareVm'
    description: "Request to download the snapshot file from the backup.\n\nNote: To know about the file information and which file can be downloaded, use the \"rubrik-gps-snapshot-files-list\" command. To know about the status of the downloadable files, use the \"rubrik-gps-async-result\" command."
    name: rubrik-gps-snapshot-files-download
    outputs:
    - contextPath: RubrikPolaris.GPSSnapshotFileDownload.id
      description: The ID of the download.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFileDownload.status
      description: Status of the download.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFileDownload.links.href
      description: Link of the download.
      type: String
    - contextPath: RubrikPolaris.GPSSnapshotFileDownload.links.rel
      description: Relationship of the download.
      type: String
  - arguments:
    - description: The snappable ID.
      name: snappable_id
      required: true
    - auto: PREDEFINED
      defaultValue: 'True'
      description: |-
        Whether to recover tags.

        Possible values are: "True", "False".
      name: should_recover_tags
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'True'
      description: |-
        Whether to power on.

        Possible values are: "True", "False".
      name: power_on
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'False'
      description: |-
        Whether to keep MAC addresses.

        Possible values are: "True", "False".
      name: keep_mac_addresses
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'False'
      description: |-
        Whether to remove network interfaces from the VM.

        Possible values are: "True", "False".
      name: remove_network_devices
      predefined:
      - 'True'
      - 'False'
    - description: |-
        ID of the ESXi host to mount the new VM on.

        Note: Users can get the list of host IDs by executing the "rubrik-gps-vm-host-list" command.
      name: host_id
    - description: ID of the compute cluster where the new VM will be mounted.
      name: cluster_id
    - description: ID of the resource pool where the new VM will be mounted.
      name: resource_pool_id
    - description: |-
        ID of the snapshot to recover.

        Note: Users can get the snapshot ID by executing the "rubrik-polaris-vm-object-snapshot-list" command.
      name: snapshot_fid
    - description: Name of the new VM. If not provided the name will be "<Snapshot VM Name> <MM/DD of snapshot creation> <hh/mm of snapshot creation> <Num>".
      name: vm_name
    - description: |-
        List of network bindings for vNIC of the VM.

        e.g. [
              {
                "backingNetworkInfo": {
                  "moid": <string>,
                  "name": <string>
                },
                "networkDeviceInfo": {
                  "key": <int>,
                  "name": <string>
                }
              }
            ].
      name: vnic_bindings
    - description: |-
        Point in time to recover to, e.g.: "2023-03-04T05:06:07.890".
      name: recovery_point
    description: "Performs a live mount of a virtual machine snapshot.\n\nNote: To know about the live mount status, use the \"rubrik-gps-async-result\" command."
    name: rubrik-gps-vm-livemount
    outputs:
    - contextPath: RubrikPolaris.GPSVMLiveMount.id
      description: ID of the Live mount request.
      type: String
  - arguments:
    - description: The name of the host to search for.
      name: name
    - description: "To list hosts from the specific cluster.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: cluster_id
    - defaultValue: 50
      description: Number of results to retrieve in the response. Maximum size allowed is 1000.
      name: limit
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    - defaultValue: ID
      description: "Specify the field to use for sorting the response.\n\nNote: Supported values are \"ID\" and \"NAME\" only. For any other values, the obtained result is sorted or not is not confirmed."
      name: sort_by
    - auto: PREDEFINED
      defaultValue: ASC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    description: "Retrieve the list of available Vsphere Hosts."
    name: rubrik-gps-vm-host-list
    outputs:
    - contextPath: RubrikPolaris.GPSVMHost.id
      description: ID of the Vsphere host.
      type: String
    - contextPath: RubrikPolaris.GPSVMHost.name
      description: Name of the Vsphere host.
      type: String
    - contextPath: RubrikPolaris.GPSVMHost.physicalPath.fid
      description: ID of a physical path of a node.
      type: String
    - contextPath: RubrikPolaris.GPSVMHost.physicalPath.name
      description: Name of a physical path of a node.
      type: String
    - contextPath: RubrikPolaris.GPSVMHost.physicalPath.objectType
      description: "Type of a physical path of a node, for example, VSphereComputeCluster, VSphereDatacenter etc."
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSVMHost.next_page_token
      description: Next page token.
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSVMHost.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSVMHost.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
  - arguments:
    - description: The name of the datastore to search for.
      name: name
    - description: "The ID of a Vsphere host whose datastores are to be listed.\n\nNote: Users can get the list of host IDs by executing the \"rubrik-gps-vm-host-list\" command."
      name: host_id
      required: true
    - defaultValue: 50
      description: Number of results to retrieve in the response. Maximum size allowed is 1000.
      name: limit
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    - defaultValue: ID
      description: "Specify the field to use for sorting the response.\n\nNote: Supported values are \"ID\" and \"NAME\" only. For any other values, the obtained result is sorted or not is not confirmed."
      name: sort_by
    - auto: PREDEFINED
      defaultValue: ASC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    description: "Retrieve the list of the available datastores on a Vsphere Host."
    name: rubrik-gps-vm-datastore-list
    outputs:
    - contextPath: RubrikPolaris.GPSVMHost.id
      description: ID of the Vsphere host.
      type: String
    - contextPath: RubrikPolaris.GPSVMHost.Datastore.id
      description: ID of the Vsphere datastore.
      type: String
    - contextPath: RubrikPolaris.GPSVMHost.Datastore.name
      description: Name of the Vsphere datastore.
      type: String
    - contextPath: RubrikPolaris.GPSVMHost.Datastore.capacity
      description: Datastore capacity in bytes.
      type: Number
    - contextPath: RubrikPolaris.GPSVMHost.Datastore.isLocal
      description: Whether the datastore is local or remote.
      type: Boolean
    - contextPath: RubrikPolaris.GPSVMHost.Datastore.freeSpace
      description: Free space on the datastore in bytes.
      type: Number
    - contextPath: RubrikPolaris.GPSVMHost.Datastore.datastoreType
      description: Type of datastore, for example, "NFS",  "VMFS" etc.
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSVMHost.Datastore.next_page_token
      description: Next page token.
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSVMHost.Datastore.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.GPSVMHost.Datastore.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
  - arguments:
    - description: "Filter the events based on the provided activity statuses. Supports comma separated values.\n\nPossible values are: \"UNKNOWN_EVENT_STATUS\", \"TASK_FAILURE\", \"PARTIAL_SUCCESS\", \"TASK_SUCCESS\", \"INFO\", \"FAILURE\", \"RUNNING\", \"QUEUED\", \"WARNING\", \"CANCELED\", \"SUCCESS\"."
      name: activity_status
    - description: "Filter the events based on provided activity types. Supports comma separated values.\n\nPossible values are: \"SYNC\", \"LOCAL_RECOVERY\", \"TEST_FAILOVER\", \"ANOMALY\", \"RANSOMWARE_INVESTIGATION_ANALYSIS\", \"ARCHIVE\", \"VOLUME_GROUP\", \"VCENTER\", \"INDEX\", \"CLOUD_NATIVE_VIRTUAL_MACHINE\", \"STORM_RESOURCE\", \"HOST_EVENT\", \"RECOVERY\", \"CONVERSION\", \"CLOUD_NATIVE_VM\", \"EMBEDDED_EVENT\", \"MAINTENANCE\", \"FAILOVER\", \"AUTH_DOMAIN\", \"LEGAL_HOLD\", \"VCD\", \"INSTANTIATE\", \"CONFIGURATION\", \"FILESET\", \"DISCOVERY\", \"SYSTEM\", \"HDFS\", \"CLASSIFICATION\", \"STORAGE_ARRAY\", \"STORAGE\", \"BACKUP\", \"HARDWARE\", \"HYPERV_SERVER\", \"HYPERV_SCVMM\", \"DIAGNOSTIC\", \"UNKNOWN_EVENT_TYPE\", \"UPGRADE\", \"NUTANIX_CLUSTER\", \"REPLICATION\", \"AWS_EVENT\", \"SUPPORT\", \"CLOUD_NATIVE_SOURCE\", \"DOWNLOAD\", \"CONNECTION\", \"RESOURCE_OPERATIONS\"."
      name: activity_type
    - description: "Filter the events based on provided severities. Supports comma separated values.\n\nPossible values are: \"SEVERITY_CRITICAL\", \"SEVERITY_WARNING\", \"SEVERITY_INFO\"."
      name: severity
    - description: "Filter out events based on object name.\n\nNote: Users can get the object names by executing the \"rubrik-polaris-vm-objects-list\" or \"rubrik-polaris-object-search\" command."
      name: object_name
    - description: "Filter the events based on provided object types. Supports comma separated values.\n\nPossible values are: \"SHARE_FILESET\", \"NUTANIX_VM\", \"STORAGE_ARRAY_VOLUME_GROUP\", \"HYPERV_VM\", \"LINUX_FILESET\", \"WINDOWS_FILESET\", \"VMWARE_VM\".\n\nAdditional values can be found in the documentation."
      name: object_type
    - description: "Filter the events based on provided cluster IDs. Supports comma separated values.\n\nNote: Users can get the list of cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: cluster_id
    - description: "The start date to fetch updated events from.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc."
      name: start_date
    - description: "The end date to fetch updated events until.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc."
      name: end_date
    - defaultValue: 50
      description: Number of results to retrieve in the response. Maximum size allowed is 1000.
      name: limit
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    - auto: PREDEFINED
      defaultValue: LAST_UPDATED
      description: "Specify the field to use for sorting the response.\n\nNote: Possible values are: \"LAST_UPDATED\", \"LOCATION\", \"OBJECT_TYPE\", \"CLUSTER_NAME\", \"OBJECT_NAME\", \"START_TIME\", \"ACTIVITY_TYPE\", \"SEVERITY\", \"ACTIVITY_STATUS\"."
      name: sort_by
      predefined:
      - LAST_UPDATED
      - LOCATION
      - OBJECT_TYPE
      - CLUSTER_NAME
      - OBJECT_NAME
      - START_TIME
      - ACTIVITY_TYPE
      - SEVERITY
      - ACTIVITY_STATUS
    - auto: PREDEFINED
      defaultValue: DESC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    description: "Retrieve the list of events."
    name: rubrik-event-list
    outputs:
    - contextPath: RubrikPolaris.Event.id
      description: ID of the event.
      type: Number
    - contextPath: RubrikPolaris.Event.startTime
      description: Start time of the event.
      type: String
    - contextPath: RubrikPolaris.Event.fid
      description: FID of the event.
      type: String
    - contextPath: RubrikPolaris.Event.activitySeriesId
      description: Activity Series ID of the event.
      type: String
    - contextPath: RubrikPolaris.Event.lastUpdated
      description: Date time when the event was last updated.
      type: String
    - contextPath: RubrikPolaris.Event.lastActivityType
      description: Last Activity Type of the event.
      type: String
    - contextPath: RubrikPolaris.Event.lastActivityStatus
      description: Last Activity Status of the event.
      type: String
    - contextPath: RubrikPolaris.Event.location
      description: Location of the event.
      type: String
    - contextPath: RubrikPolaris.Event.objectId
      description: ID of the object.
      type: String
    - contextPath: RubrikPolaris.Event.objectName
      description: Name of the object.
      type: String
    - contextPath: RubrikPolaris.Event.objectType
      description: Type of the object.
      type: String
    - contextPath: RubrikPolaris.Event.severity
      description: Severity of the event.
      type: String
    - contextPath: RubrikPolaris.Event.progress
      description: Progress of the event.
      type: String
    - contextPath: RubrikPolaris.Event.cluster.id
      description: The ID of the cluster.
      type: String
    - contextPath: RubrikPolaris.Event.cluster.name
      description: The name of the cluster.
      type: String
    - contextPath: RubrikPolaris.Event.activityConnection.nodes.id
      description: ID of the activity connection.
      type: String
    - contextPath: RubrikPolaris.Event.activityConnection.nodes.message
      description: Message of the activity connection.
      type: String
    - contextPath: RubrikPolaris.Event.activityConnection.nodes.severity
      description: Severity of the activity connection.
      type: String
    - contextPath: RubrikPolaris.Event.activityConnection.nodes.time
      description: Date time when the activity connection was last updated.
      type: String
    - contextPath: RubrikPolaris.PageToken.Event.next_page_token
      description: Next page token.
      type: String
    - contextPath: RubrikPolaris.PageToken.Event.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.Event.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
  - arguments:
    - description: "Filter the objects based on the provided object types. Supports comma separated values.\n\nPossible values are: \"ShareFileset\", \"NutanixVirtualMachine\", \"VolumeGroup\", \"HypervVirtualMachine\", \"LinuxFileset\", \"WindowsFileset\", \"VmwareVirtualMachine\".\n\nAdditional values can be found in the documentation."
      name: type_filter
      required: true
    - description: "Filter the objects based on the provided cluster IDs. Supports comma separated values.\n\nNote: Users can get the list of cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: cluster_id
    - defaultValue: 50
      description: Number of results to retrieve in the response. Maximum size allowed is 1000.
      name: limit
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    - defaultValue: ID
      description: "Specify the field to use for sorting the response.\n\nNote: Supported values are \"ID\" and \"NAME\" only. For any other values, the obtained result is sorted or not is not confirmed."
      name: sort_by
    - auto: PREDEFINED
      defaultValue: ASC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    description: "Retrieve the list of Rubrik objects, based on the provided filters."
    name: rubrik-polaris-object-list
    outputs:
    - contextPath: RubrikPolaris.Object.id
      description: ID of the object.
      type: String
    - contextPath: RubrikPolaris.Object.effectiveSlaDomain.name
      description: Name of the SLA domain of the object.
      type: String
    - contextPath: RubrikPolaris.Object.effectiveSlaDomain.id
      description: ID of the SLA domain of the object.
      type: String
    - contextPath: RubrikPolaris.Object.effectiveSlaDomain.description
      description: Description of the SLA domain of the object.
      type: String
    - contextPath: RubrikPolaris.Object.effectiveSlaDomain.cluster.id
      description: Cluster ID of effective SLA domain of the object.
      type: String
    - contextPath: RubrikPolaris.Object.effectiveSlaDomain.cluster.name
      description: Cluster name of effective SLA domain of the object.
      type: String
    - contextPath: RubrikPolaris.Object.effectiveSlaDomain.fid
      description: FID of effective SLA domain of the object.
      type: String
    - contextPath: RubrikPolaris.Object.isPassthrough
      description: Whether the object is passthrough or not.
      type: Boolean
    - contextPath: RubrikPolaris.Object.cluster.id
      description: Cluster ID of the object.
      type: String
    - contextPath: RubrikPolaris.Object.cluster.name
      description: Cluster name of the object.
      type: String
    - contextPath: RubrikPolaris.Object.primaryClusterLocation.id
      description: ID of the primary cluster location of the object.
      type: String
    - contextPath: RubrikPolaris.Object.logicalPath.name
      description: Name of the logical path of the object.
      type: String
    - contextPath: RubrikPolaris.Object.logicalPath.objectType
      description: Object Type of the logical path of the object.
      type: String
    - contextPath: RubrikPolaris.Object.physicalPath.name
      description: Name of the physical path of the object.
      type: String
    - contextPath: RubrikPolaris.Object.physicalPath.objectType
      description: Object Type of the physical path of the object.
      type: String
    - contextPath: RubrikPolaris.Object.name
      description: Name of the object.
      type: String
    - contextPath: RubrikPolaris.Object.objectType
      description: Type of the object.
      type: String
    - contextPath: RubrikPolaris.PageToken.Object.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.Object.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.Object.next_page_token
      description: Next page token.
      type: String
  - arguments:
    - description: "The object ID for which the snapshots are to be searched.\n\nNote: Users can get the list of the object IDs by executing the \"rubrik-polaris-object-list\" command."
      name: object_id
      required: true
    - description: "The start date to get snapshots from.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.\n\nNote: start_date and end_date both or none must be initialized."
      name: start_date
    - description: "The end date to get snapshots until.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.\n\nNote: start_date and end_date both or none must be initialized."
      name: end_date
    - defaultValue: 50
      description: Number of results to retrieve in the response. Maximum size allowed is 1000.
      name: limit
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    - description: "List of snapshot types to filter snapshots. Supports comma separated values.\n\nPossible values are: \"SCHEDULED\", \"ON_DEMAND\", \"DOWNLOADED\"."
      name: snapshot_type
    - auto: PREDEFINED
      defaultValue: ASC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    description: "Retrieve Rubrik snapshot(s) of an object, based on the provided object ID."
    name: rubrik-polaris-object-snapshot-list
    outputs:
    - contextPath: RubrikPolaris.Object.id
      description: ID of the object.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.id
      description: ID of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.date
      description: Date of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.isArchivalCopy
      description: Whether the snapshot is an archival copy or not.
      type: Boolean
    - contextPath: RubrikPolaris.Object.Snapshot.isReplica
      description: Whether the snapshot is a replica or not.
      type: Boolean
    - contextPath: RubrikPolaris.Object.Snapshot.isOnDemandSnapshot
      description: Whether the snapshot is on demand or not.
      type: Boolean
    - contextPath: RubrikPolaris.Object.Snapshot.isDownloadedSnapshot
      description: Whether the snapshot is downloaded or not.
      type: Boolean
    - contextPath: RubrikPolaris.Object.Snapshot.cluster.id
      description: Cluster ID of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.cluster.name
      description: Cluster name of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.cluster.version
      description: Cluster version of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.cluster.status
      description: Cluster status of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.slaDomain.name
      description: Name of the SLA domain of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.slaDomain.fid
      description: FID of the SLA domain of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.slaDomain.cluster.id
      description: Cluster ID of the SLA domain of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.slaDomain.cluster.name
      description: Cluster name of the SLA domain of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.slaDomain.id
      description: ID of the SLA domain of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.name
      description: Archival name of snapshot retention of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.isExpirationDateCalculated
      description: Whether archival expiration date of snapshot retention of the snapshot is calculated or not.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.expirationTime
      description: Archival expiration time of snapshot retention of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.name
      description: Name of snapshot retention of the snapshot.
      type: String
    - contextPath: RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.isExpirationDateCalculated
      description: Whether the expiration date is calculated or not.
      type: Boolean
    - contextPath: RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.expirationTime
      description: Expiration time of snapshot retention of the snapshot.
      type: String
    - contextPath: RubrikPolaris.PageToken.Object.Snapshot.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.Object.Snapshot.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.Object.Snapshot.next_page_token
      description: Next Page Token.
      type: String
  - arguments:
    - description: |-
        ID of the cluster on which to perform a scan.

        Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.
      name: cluster_id
      required: true
    - description: |-
        Object ID of the system on which to perform the scan. Supports comma separated values.

        Note: Users can get the list of object IDs by executing the "rubrik-polaris-vm-objects-list" command.
      isArray: true
      name: object_id
      required: true
    - defaultValue: PAXSOAR-1.1.0
      description: Name of the scan.
      name: scan_name
    - auto: PREDEFINED
      description: |-
        The type of the indicator to scan for.

        Possible values are: "INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME", "INDICATOR_OF_COMPROMISE_TYPE_HASH", "INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE".

        Note: To provide multiple IOCs use the argument "advance_ioc".
      name: ioc_type
      predefined:
      - INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME
      - INDICATOR_OF_COMPROMISE_TYPE_HASH
      - INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE
    - description: |-
        Value of the indicator to scan for.

        Note: To provide multiple IOCs use the argument "advance_ioc".
      name: ioc_value
    - description: "Json encoded Indicators Of Compromise to scan. Json keys signify the type of IOC and the corresponding list of values are the values of the IOC's. If provided, will ignore the ioc_type and ioc_value arguments.\n\nPossible keys to indicate type of indicator: \nINDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE\n\nFormat Accepted:\n{\n\"<ioc_type1>\": [\"<ioc_value1>\", \"<ioc_value2>\"],\n\"<ioc_type2>\": \"<ioc_value2>\"\n}\n\nExample:\n{\n\"INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME\": [\"C:\\Users\\Malware_Executible.ps1\", \"\\bin\\Malware_Executible\"],\n\"INDICATOR_OF_COMPROMISE_TYPE_HASH\": [\"e5c1b9c44be582f895eaea3d3738c5b4\", \"f541b9844be897f895eaea3d3738cfb2\"],\n\"INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE\": \"rule match_everything {condition:true}\"\n}."
      name: advance_ioc
    - description: |-
        Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded.

        Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.

        Examples of more supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates.
      name: start_date
    - description: |-
        Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded.

        Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.

        Examples of more supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates.
      name: end_date
    - description: Maximum number of snapshots to scan per object.
      name: max_snapshots_per_object
    - description: Maximum size of the file in bytes that will be included in the scan. The maximum allowed size is 15000000 bytes.
      defaultValue: 5000000
      name: max_file_size
    - description: |-
        Provide comma separated snapshot IDs on which to perform a scan separated by colon for each object ID (in the same order). Supports comma separated values.

        Format accepted:
        object_1_snapshot_id_1, object_1_snapshot_id_2: object_2_snapshot_id_1

        Example:
        B405e8c0-1fcd-401c-a6f6-42f758aad6df, e179eb47-534b-4624-b155-f33d188902e2: 1e1681bf-4479-4339-a4bb-59901598caa5

        Note: Users can retrieve the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command.

        Note: Do not provide "snapshot_start_date", "snapshot_end_date" and, "max_snapshots_per_object" arguments if snapshot ID is provided.
      isArray: true
      name: snapshot_id
    - description: |-
        Paths to include in the scan. Supports comma separated values.

        Format accepted:
        path_to_include_1, path_to_include_2.
      isArray: true
      name: paths_to_include
    - description: |-
        Paths to exclude from the scan. Supports comma separated values.

        Format accepted:
        path_to_exclude_1, path_to_exclude_2.
      isArray: true
      name: paths_to_exclude
    - description: |-
        Paths to exempt from exclusion. Supports comma separated values.

        Format accepted:
        path_to_exempt_1, path_to_exempt_2.
      isArray: true
      name: paths_to_exempt
    - description: |-
        The type of hash values of the matched files to return in the result. Supports comma separated values.

        Possible values are: "HASH_TYPE_M_D5", "HASH_TYPE_SH_A1", "HASH_TYPE_SH_A256".
      isArray: true
      name: requested_hash_types
    description: |-
      Triggers an IOC scan of a system.

      Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command and to list the running/completed IOC scans on a cluster use the "rubrik-radar-ioc-scan-list" command.
    name: rubrik-radar-ioc-scan
    outputs:
    - contextPath: RubrikPolaris.RadarIOCScan.id
      description: ID of the IOC scan.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.status
      description: Status of the IOC scan trigger request.
      type: String
  - arguments:
    - description: |-
        ID of the IOC scan whose results are to be retrieved.

        Note: Users can get the scan ID by executing the "rubrik-radar-ioc-scan" command.
      name: scan_id
      required: true
    - description: |-
        ID of the cluster on which the scan was performed.

        Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.
      name: cluster_id
      required: true
    description: |-
      Retrieves the results of IOC scan of a system.

      Note: To initiate a scan use the "rubrik-radar-ioc-scan" command and to list the running/completed scans on a cluster use the "rubrik-radar-ioc-scan-list" command.
    name: rubrik-radar-ioc-scan-results
    outputs:
    - contextPath: RubrikPolaris.RadarIOCScan.id
      description: ID of the IOC scan.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.status
      description: Overall status of the scan.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.indicatorsOfCompromise.iocType
      description: Type of IOC that was scanned.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.indicatorsOfCompromise.iocValue
      description: Value of the IOC that was scanned.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.objectId
      description: ID of the system that was scanned.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.status
      description: 'Status of the scan on the snapshot. Values: MALWARE_SCAN_IN_SNAPSHOT_STATUS_PENDING, MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED, MALWARE_SCAN_IN_SNAPSHOT_STATUS_ERROR.'
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.snapshotDate
      description: The date-time at which the snapshot was taken.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.snapshotId
      description: ID of the snapshot that was scanned.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.numFiles
      description: Number of files encountered during scan.
      type: Number
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.numFilesScanned
      description: Number of files that were scanned on that snapshot.
      type: Number
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.totalFilesScannedSizeBytes
      description: The total file size of the files scanned.
      type: Number
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.indicatorIndex
      description: Index of indicator in inputs for the scan.
      type: Number
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.aclDetails
      description: JSON encoded file access control list (ACL) information.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.creationTime
      description: File creation date-time.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.modificationTime
      description: File modification date-time.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.path
      description: File path that matched the malware Indicator Of Compromise.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.yaraMatchDetails.name
      description: The name of the matching YARA rule.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.yaraMatchDetails.tags
      description: Optional YARA tags. Described in https://yara.readthedocs.io/en/latest/writingrules.html#rule-tags.
      type: Unknown
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.requestedHashDetails.hashType
      description: Hash algorithm type.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.requestedHashDetails.hashValue
      description: Hash value of the content at path.
      type: String
  - arguments:
    - description: "ID of the request.\n\nNote: Users can get the request ID by executing any of the commands that make a request. Possible commands are mentioned in the command description."
      name: request_id
      required: true
    - description: "ID of the cluster on which request was made.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: cluster_id
      required: true
    - description: "IP address of the cluster node to access the download link. Only required to retrieve the results of the command \"rubrik-gps-snapshot-files-download\".\n\nNote: Users can retrieve the list of the IP addresses by executing the \"rubrik-gps-cluster-list\" command."
      name: cluster_ip_address
    description: "Retrieve the result of an asynchronous request. This command will retrieve the result of requests made by commands \"rubrik-gps-snapshot-files-download\", \"rubrik-gps-vm-livemount\", \"rubrik-gps-vm-export\", \"rubrik-gps-vm-snapshot-create\" and \"rubrik-gps-vm-recover-files\"."
    name: rubrik-gps-async-result
    outputs:
    - contextPath: RubrikPolaris.GPSAsyncResult.id
      description: The ID of the request.
      type: String
    - contextPath: RubrikPolaris.GPSAsyncResult.status
      description: Status of the request.
      type: String
    - contextPath: RubrikPolaris.GPSAsyncResult.nodeId
      description: ID of the node.
      type: String
    - contextPath: RubrikPolaris.GPSAsyncResult.progress
      description: Progress of the request in range 0 to 100.
      type: Number
    - contextPath: RubrikPolaris.GPSAsyncResult.error.message
      description: JSON stringified message object when an error occurs.
      type: String
    - contextPath: RubrikPolaris.GPSAsyncResult.links.href
      description: Link to a resource.
      type: String
    - contextPath: RubrikPolaris.GPSAsyncResult.links.rel
      description: Type of the resource pointed by the link.
      type: String
  - arguments:
    - description: "Filter out clusters based on their type. Supports comma separated values.\n\nPossible values are: \"Cloud\", \"Robo\", \"ExoCompute\", \"OnPrem\", \"Polaris\", \"Unknown\"."
      name: type
    - description: "Filter out clusters based on name. Supports comma separated values."
      name: name
    - defaultValue: ClusterName
      description: "Specify the field to use for sorting the response.\n\nPossible values are: \"ClusterName\", \"ClusterType\", \"RegisteredAt\".\nAdditional values can be found in the documentation."
      name: sort_by
    - auto: PREDEFINED
      defaultValue: ASC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    description: "Retrieve the list of the available rubrik clusters."
    name: rubrik-gps-cluster-list
    outputs:
    - contextPath: RubrikPolaris.GPSCluster.id
      description: ID of the cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.name
      description: Name of the cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.type
      description: Type of the cluster. Values are Cloud, Robo, ExoCompute, OnPrem, Unknown, Polaris.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.status
      description: Status of the cluster. Values are Connected, Disconnected, Initializing.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.version
      description: Version of the cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.defaultAddress
      description: Default address assigned to the cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.cdmUpgradeInfo.clusterStatus.message
      description: Message about the cluster upgrade/current condition.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.cdmUpgradeInfo.clusterStatus.status
      description: Upgrade/current status of the cluster. It provides information like -- upgrading, upgrade scheduled, stable, downloading packages, pre-checks running and many more.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.cdmUpgradeInfo.overallProgress
      description: Progress (in percentage) of an upgrade, if running.
      type: Number
    - contextPath: RubrikPolaris.GPSCluster.cdmUpgradeInfo.scheduleUpgradeAt
      description: Shows the date-time of a scheduled upgrade.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.cdmUpgradeInfo.downloadedVersion
      description: The version that was downloaded but not yet installed.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.cdmUpgradeInfo.version
      description: The current version of the cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.productType
      description: The product type. Values are CDM, DATOS, POLARIS.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.estimatedRunway
      description: Estimated number of days remaining before additional data storage space is required on the cluster.
      type: Number
    - contextPath: RubrikPolaris.GPSCluster.snapshotCount
      description: The total number of snapshots that are taken of different objects in the cluster.
      type: Number
    - contextPath: RubrikPolaris.GPSCluster.geoLocation.address
      description: Geological address of the cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.lastConnectionTime
      description: Time when the cluster was last polled.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.metric.totalCapacity
      description: Total storage capacity of the cluster in Bytes.
      type: Number
    - contextPath: RubrikPolaris.GPSCluster.metric.availableCapacity
      description: Available storage capacity of the cluster in Bytes.
      type: Number
    - contextPath: RubrikPolaris.GPSCluster.snappableConnection.count
      description: The number of objects in the cluster whose snapshots can be taken.
      type: Number
    - contextPath: RubrikPolaris.GPSCluster.state.connectedState
      description: Status of the cluster. Values are Connected, Disconnected, Initializing.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.state.clusterRemovalState
      description: State of the cluster when it is being removed from the platform. Values are DATA_DELETING, WAITING_FOR_DATA_DELETION, UNREGISTERED, FAILED, DISCONNECTING, REGISTERED.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.id
      description: ID of a node in a cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.status
      description: Status of a node in a cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.ipAddress
      description: IP Address of a node in a cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.passesConnectivityCheck
      description: Whether the cluster passes the connectivity check.
      type: Boolean
    - contextPath: RubrikPolaris.GPSCluster.globalManagerConnectivityStatus.urls.url
      description: URL of a global manager of the cluster.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.globalManagerConnectivityStatus.urls.isReachable
      description: Whether the global manager is reachable.
      type: Boolean
    - contextPath: RubrikPolaris.GPSCluster.connectivityLastUpdated
      description: The date-time of when the cluster was last polled for connectivity.
      type: String
    - contextPath: RubrikPolaris.GPSCluster.lambdaFeatureHistory.wasRadarEverEnabled
      description: Whether Polaris Radar was ever enabled on the cluster.
      type: Boolean
    - contextPath: RubrikPolaris.GPSCluster.lambdaFeatureHistory.wasSonarEverEnabled
      description: Whether Polaris Sonar was ever enabled on the cluster.
      type: Boolean
  - arguments:
    - description: |-
        ID of the cluster whose IOC scans are to be listed.

        Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.
      name: cluster_id
      required: true
    description: |-
      Lists the running/completed IOC scans on a cluster.

      Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command. To initiate a scan use the "rubrik-radar-ioc-scan" command.
    name: rubrik-radar-ioc-scan-list
    outputs:
    - contextPath: RubrikPolaris.RadarIOCScan.id
      description: ID of the IOC scan.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.startTime
      description: Start time of the scan.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.endTime
      description: End time of the scan.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.snapshots.id
      description: Object ID of the system.
      type: String
    - contextPath: RubrikPolaris.RadarIOCScan.snapshots.snapshots
      description: List of snapshot IDs that are included in the scan.
      type: Unknown
  - arguments:
    - description: |-
        ID of the snapshot from which to recover files.

        Note: Users can get the snapshot ID by executing the "rubrik-polaris-vm-object-snapshot-list" command.
      name: snapshot_id
      required: true
    - description: |-
        ID of the cluster where the snapshot resides.

        Note: Users can get the cluster ID by executing the "rubrik-gps-cluster-list" command.
      name: cluster_id
      required: true
    - description: |-
        Comma separated paths of files and directories that will be recovered from the snapshot.

        Note: Users can get the list of paths in a snapshot by executing the "rubrik-gps-snapshot-files-list" command.
      isArray: true
      name: paths_to_recover
      required: true
    - description: Path on the destination object on which recovery will be done.
      name: restore_path
      required: true
    - description: |-
        ID of the object where the files will be restored into. If not provided, Rubrik will use the snapshots object.

        Note: Users can get the object ID by executing the "rubrik-polaris-vm-objects-list" command.
      name: destination_object_id
    description: |-
      Recovers files from a snapshot backup, back into a system.

      Note: To know about the recovery status, use the "rubrik-gps-async-result" command.
    name: rubrik-gps-vm-recover-files
    outputs:
    - contextPath: RubrikPolaris.GPSVMRecoverFiles.id
      description: Recover files request ID.
      type: String
  - arguments:
    - description: 'The name of the user to search for.'
      name: user_name
    - description: 'The email or the UPN of the user to search for.'
      name: user_email
    - defaultValue: 7 days
      description: "Specify the search time period to look for user access.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z."
      name: search_time_period
    - auto: PREDEFINED
      isArray: true
      description: "The comma-separated list of risk levels.\n\nSupported values are: UNKNOWN_RISK, HIGH_RISK, MEDIUM_RISK, LOW_RISK, NO_RISK.\n\nNote: For any other values, whether the obtained result is filtered or not, is not confirmed."
      name: risk_levels
      predefined:
      - UNKNOWN_RISK
      - HIGH_RISK
      - MEDIUM_RISK
      - LOW_RISK
      - NO_RISK
    - description: 'Specify the group ID to filter with.'
      name: group_id
    - auto: PREDEFINED
      defaultValue: "False"
      description: "The boolean indicates to include the whitelisted results.\n\nPossible values are: \"True\", \"False\"."
      name: include_whitelisted_results
      predefined:
      - "True"
      - "False"
    - auto: PREDEFINED
      defaultValue: USERS_WITH_SENSITIVE_ACCESS
      description: "Specify the principal summary category to filter with.\n\nSupported values are: PRINCIPAL_SUMMARY_CATEGORY_UNSPECIFIED, USERS_WITH_SENSITIVE_ACCESS, NEW_USERS_WITH_SENSITIVE_ACCESS, USERS_WITH_RISK_LEVEL_INCREASE.\n\nNote: For any other values, whether the obtained result is filtered or not, is not confirmed."
      name: principal_summary_category
      predefined:
      - PRINCIPAL_SUMMARY_CATEGORY_UNSPECIFIED
      - USERS_WITH_SENSITIVE_ACCESS
      - NEW_USERS_WITH_SENSITIVE_ACCESS
      - USERS_WITH_RISK_LEVEL_INCREASE
    - defaultValue: 50
      description: Number of results to retrieve in the response. The maximum allowed size is 1000.
      name: limit
    - defaultValue: 1
      description: "Specify the page number to get the particular page of results in the response.\n\nNote: This argument is only applicable when provided with the \"user_email\" argument."
      name: page_number
    - auto: PREDEFINED
      defaultValue: RISK_LEVEL
      description: "Specify the field to use for sorting the response.\n\nSupported values are: RISK_LEVEL, RISK_SENSITIVE_FILES, RISK_SENSITIVE_HITS, TOTAL_SENSITIVE_HITS, TOTAL_SENSITIVE_FILES, SID, TOTAL_SENSITIVE_OBJECTS.\n\nNote: For any other values, whether the obtained result is filtered or not, is not confirmed."
      name: sort_by
      predefined:
      - RISK_LEVEL
      - RISK_SENSITIVE_FILES
      - RISK_SENSITIVE_HITS
      - TOTAL_SENSITIVE_HITS
      - TOTAL_SENSITIVE_FILES
      - SID
      - TOTAL_SENSITIVE_OBJECTS
    - auto: PREDEFINED
      defaultValue: DESC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    description: Retrieve the user access information.
    name: rubrik-sonar-user-access-list
    outputs:
    - contextPath: RubrikPolaris.UserAccess.principalId
      description: The ID of the user.
      type: String
    - contextPath: RubrikPolaris.UserAccess.fullName
      description: The full name of the user.
      type: String
    - contextPath: RubrikPolaris.UserAccess.upn
      description: The user principal name.
      type: String
    - contextPath: RubrikPolaris.UserAccess.riskLevel
      description: The risk level of the user.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.totalCount
      description: The total number of high-risk files.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.violatedCount
      description: The number of high-risk files that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.__typename
      description: The high-risk file count field type.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.totalCount
      description: Total number of medium-risk files.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.violatedCount
      description: The number of medium-risk files that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.__typename
      description: The type of the medium risk file count field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.totalCount
      description: The total number of low-risk files.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.violatedCount
      description: The number of low-risk files that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.__typename
      description: The type of the low-risk file count field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.__typename
      description: The type of the sensitive files field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.totalSensitiveHits.totalHits
      description: The total number of sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.totalSensitiveHits.violatedHits
      description: The number of sensitive hits that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.totalSensitiveHits.__typename
      description: The type of the total sensitive hits field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveObjectCount.totalCount
      description: The total number of sensitive objects.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveObjectCount.violatedCount
      description: The Number of sensitive objects that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveObjectCount.__typename
      description: The type of the sensitive object count field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.numDescendants
      description: The number of descendant users associated with this user.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.domainName
      description: The domain name associated with this user.
      type: String
    - contextPath: RubrikPolaris.UserAccess.__typename
      description: The type of the User Access field.
      type: String
    - contextPath: RubrikPolaris.PageToken.UserAccess.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.UserAccess.startCursor
      description: The start cursor for the current page.
      type: String
    - contextPath: RubrikPolaris.PageToken.UserAccess.endCursor
      description: The end cursor for the current page.
      type: String
    - contextPath: RubrikPolaris.PageToken.UserAccess.hasNextPage
      description: Whether the result has the next page or not.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.UserAccess.hasPreviousPage
      description: Whether the result has the previous page or not.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.UserAccess.next_upn_page_number
      description: The next UPN page number.
      type: String
    - contextPath: RubrikPolaris.PageToken.UserAccess.has_next_upn_page
      description: Whether the result has the next UPN page or not.
      type: Boolean
  - arguments:
    - description: "Specify the user_id to retrieve the user access information.\n\nNote: Users can get the list of the user IDs by executing the \"rubrik-sonar-user-access-list\" command."
      name: user_id
      required: true
    - defaultValue: 7 days
      description: "Specify the search time period to look for user access.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z."
      name: search_time_period
    - defaultValue: 7
      description: "Specify the number of days in the past to collect delta for the sensitive hits."
      name: historical_delta_days
    - auto: PREDEFINED
      defaultValue: "False"
      description: "The boolean indicates to include the whitelisted results.\n\nPossible values are: \"True\", \"False\"."
      name: include_whitelisted_results
      predefined:
      - "True"
      - "False"
    description: Retrieve the user access information based on the provided user ID.
    name: rubrik-sonar-user-access-get
    outputs:
    - contextPath: RubrikPolaris.UserAccess.principalId
      description: The ID of the user.
      type: String
    - contextPath: RubrikPolaris.UserAccess.fullName
      description: The full name of the user.
      type: String
    - contextPath: RubrikPolaris.UserAccess.upn
      description: The user principal name.
      type: String
    - contextPath: RubrikPolaris.UserAccess.riskLevel
      description: The risk level of the user.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.__typename
      description: The type of object representing the policy hits summary.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.policyId
      description: The unique identifier of the policy associated with the hits summary.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.policyName
      description: The human-readable name of the policy associated with the hits summary.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.__typename
      description: The type of object representing the analyzer hits for a specific SID.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.__typename
      description: The type of object representing high-risk hits for the analyzer.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.totalHits
      description: The total number of high-risk hits detected by the analyzer.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.violatedHits
      description: The number of high-risk hits that violated security policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.__typename
      description: The type of object representing low-risk hits for the analyzer.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.totalHits
      description: The total number of low-risk hits detected by the analyzer.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.violatedHits
      description: The number of low-risk hits that violated security policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.__typename
      description: The type of object representing medium-risk hits for the analyzer.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.totalHits
      description: The total number of medium-risk hits detected by the analyzer.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.violatedHits
      description: The number of medium-risk hits that violated security policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.__typename
      description: The type of object representing the total number of hits for the analyzer.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.totalHits
      description: The total number of hits detected by the analyzer (all risk levels combined).
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.violatedHits
      description: The number of hits detected by the analyzer that violated security policies (all risk levels combined).
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.__typename
      description: The type of object representing the difference in analyzer hits between the current and previous periods.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.__typename
      description: The type of object representing the difference in high-risk hits for the analyzer between the current and previous periods.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.totalHits
      description: The difference in the total number of high-risk hits detected by the analyzer between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.violatedHits
      description: The difference in the number of high-risk hits that violated security policies between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.__typename
      description: The type of object representing the difference in low-risk hits for the analyzer between the current and previous periods.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.totalHits
      description: The difference in the total number of low-risk hits detected by the analyzer between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.violatedHits
      description: The difference in the number of low-risk hits that violated security policies between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.__typename
      description: The type of object representing the difference in medium-risk hits for the analyzer between the current and previous periods.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.totalHits
      description: The difference in the total number of medium-risk hits detected by the analyzer between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.violatedHits
      description: The difference in the number of medium-risk hits that violated security policies between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.__typename
      description: The type of object representing the total difference in hits for the analyzer between the current and previous periods (all risk levels combined).
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.totalHits
      description: The total difference in the number of hits detected by the analyzer between the current and previous periods (all risk levels combined).
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.violatedHits
      description: The difference in the number of hits detected by the analyzer that violated security policies between the current and previous periods (all risk levels combined).
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.__typename
      description: The type of object representing the difference in risk hits between the current and previous periods.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.__typename
      description: The type of object representing the difference in high-risk hits between the current and previous periods.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.totalHits
      description: The difference in the total number of high-risk hits detected between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.violatedHits
      description: The difference in the number of high-risk hits that violated security policies between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.__typename
      description: The type of object representing the difference in low-risk hits between the current and previous periods.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.totalHits
      description: The difference in the total number of low-risk hits detected between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.violatedHits
      description: The difference in the number of low-risk hits that violated security policies between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.__typename
      description: The type of object representing the difference in medium-risk hits between the current and previous periods.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.totalHits
      description: The difference in the total number of medium-risk hits detected between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.violatedHits
      description: The difference in the number of medium-risk hits that violated security policies between the current and previous periods.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.__typename
      description: The type of object representing the total difference in risk hits between the current and previous periods (all risk levels combined).
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.totalHits
      description: The total difference in the number of risk hits detected between the current and previous periods (all risk levels combined).
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.violatedHits
      description: The difference in the number of risk hits detected that violated security policies between the current and previous periods (all risk levels combined).
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.__typename
      description: The type of object representing the risk hits for a specific SID.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.__typename
      description: The type of object representing high-risk hits for the risk engine.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.totalHits
      description: The total number of high-risk hits detected by the risk engine for the specific SID.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.violatedHits
      description: The number of high-risk hits that violated security policies for the specific SID.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.__typename
      description: The type of object representing low-risk hits for the risk engine.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.totalHits
      description: The total number of low-risk hits detected by the risk engine for the specific SID.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.violatedHits
      description: The number of low-risk hits that violated security policies for the specific SID.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.__typename
      description: The type of object representing medium-risk hits for the risk engine.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.totalHits
      description: The total number of medium-risk hits detected by the risk engine for the specific SID.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.violatedHits
      description: The number of medium-risk hits that violated security policies for the specific SID.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.__typename
      description: The type of object representing the total number of risk hits for the specific SID (all risk levels combined).
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.totalHits
      description: The total number of risk hits detected by the risk engine for the specific SID (all risk levels combined).
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.violatedHits
      description: The number of risk hits detected by the risk engine that violated security policies for the specific SID (all risk levels combined).
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.__typename
      description: The type of object representing the sensitive files associated with the specific SID.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.__typename
      description: The type of object representing the total number of sensitive files associated with the specific SID.
      type: String
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.totalCount
      description: The total number of sensitive files associated with the specific SID, including both compliant and non-compliant files.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.violatedCount
      description: The number of sensitive files associated with the specific SID that violate security policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.riskReasons.accessRiskReasons
      description: The reasons why the user's access is considered risky.
      type: Unknown
    - contextPath: RubrikPolaris.UserAccess.riskReasons.insecureReasons
      description: The reasons why the user's access is considered insecure.
      type: Unknown
    - contextPath: RubrikPolaris.UserAccess.riskReasons.__typename
      description: The type of the risk reasons field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.totalCount
      description: The total number of high-risk files.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.violatedCount
      description: The number of high-risk files that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.__typename
      description: The high-risk file count field type.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.totalCount
      description: Total number of medium-risk files.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.violatedCount
      description: The number of medium-risk files that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.__typename
      description: The type of the medium risk file count field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.totalCount
      description: The total number of low-risk files.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.violatedCount
      description: The number of low-risk files that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.__typename
      description: The type of the low-risk file count field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveFiles.__typename
      description: The type of the sensitive files field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.totalSensitiveHits.totalHits
      description: The total number of sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.totalSensitiveHits.violatedHits
      description: The number of sensitive hits that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.totalSensitiveHits.__typename
      description: The type of the total sensitive hits field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.sensitiveObjectCount.totalCount
      description: The total number of sensitive objects.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveObjectCount.violatedCount
      description: The Number of sensitive objects that violate policies.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.sensitiveObjectCount.__typename
      description: The type of the sensitive object count field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.numDescendants
      description: The number of descendant users associated with this user.
      type: Number
    - contextPath: RubrikPolaris.UserAccess.domainName
      description: The domain name associated with this user.
      type: String
    - contextPath: RubrikPolaris.UserAccess.directGroups.name
      description: The name of the direct group.
      type: String
    - contextPath: RubrikPolaris.UserAccess.directGroups.sid
      description: The security identifier (SID) of the direct group.
      type: String
    - contextPath: RubrikPolaris.UserAccess.directGroups.__typename
      description: The type of the direct groups field.
      type: String
    - contextPath: RubrikPolaris.UserAccess.__typename
      description: The type of the User Access field.
      type: String
  - arguments:
    - description: "The Object ID or the Snappable ID.\n\nNote: Users can get the list of the object IDs by executing the \"rubrik-polaris-object-list\" command."
      name: object_id
      required: true
    - description: "The Snapshot ID of the object.\n\nNote: Users can get the list of the snapshot IDs by executing the \"rubrik-polaris-object-snapshot-list\" command."
      name: snapshot_id
      required: true
    - description: 'Specify the name of the file, folder, or file share object.'
      name: file_name
    - description: 'Specify the standard file path to filter with.'
      name: file_path
    - description: "Specify the user ID to filter with.\n\nNote: Users can get the list of the user IDs by executing the \"rubrik-sonar-user-access-list\" command."
      name: user_id
    - auto: PREDEFINED
      defaultValue: "False"
      description: "The boolean indicates to include the whitelisted results.\n\nPossible values are: \"True\", \"False\"."
      name: include_whitelisted_results
      predefined:
      - "True"
      - "False"
    - defaultValue: 50
      description: Number of results to retrieve in the response. The maximum allowed size is 1000.
      name: limit
    - auto: PREDEFINED
      defaultValue: HITS
      description: "Specify the field to use for sorting the response.\n\nSupported values are: HITS, NAME, DAILY_CHANGE, LAST_ACCESS_TIME, OPEN_ACCESS_TYPE, FILES_WITH_HITS, FILES_WITH_OPEN_ACCESS_HITS, STALE_FILES_WITH_HITS, CLUSTER, OBJECT_NAME, OBJECT_LOCATION, SNAPSHOT_TIME, NUM_ACTIVITIES, NUM_ACTIVITIES_DELTA, NATIVE_PATH.\n\nNote: For any other values, whether the obtained result is filtered or not, is not confirmed."
      name: sort_by
      predefined:
      - HITS
      - NAME
      - DAILY_CHANGE
      - LAST_ACCESS_TIME
      - OPEN_ACCESS_TYPE
      - FILES_WITH_HITS
      - FILES_WITH_OPEN_ACCESS_HITS
      - STALE_FILES_WITH_HITS
      - CLUSTER
      - OBJECT_NAME
      - OBJECT_LOCATION
      - SNAPSHOT_TIME
      - NUM_ACTIVITIES
      - NUM_ACTIVITIES_DELTA
      - NATIVE_PATH
    - auto: PREDEFINED
      defaultValue: DESC
      description: "Specify the order to sort the data in.\n\nPossible values are: \"ASC\", \"DESC\"."
      name: sort_order
      predefined:
      - ASC
      - DESC
    - description: The next page cursor to retrieve the next set of results.
      name: next_page_token
    description: Retrieve the context of the file, folder, or file share for the provided object and the file details.
    name: rubrik-sonar-file-context-list
    outputs:
    - contextPath: RubrikPolaris.FileContext.nativePath
      description: The native path of the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.stdPath
      description: The standardized path of the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.filename
      description: The filename.
      type: String
    - contextPath: RubrikPolaris.FileContext.mode
      description: The file mode.
      type: String
    - contextPath: RubrikPolaris.FileContext.size
      description: The file size in bytes.
      type: Number
    - contextPath: RubrikPolaris.FileContext.lastAccessTime
      description: The last access time of the file in milliseconds since the epoch.
      type: Number
    - contextPath: RubrikPolaris.FileContext.lastModifiedTime
      description: The last modified time of the file in milliseconds since the epoch.
      type: Number
    - contextPath: RubrikPolaris.FileContext.creationTime
      description: The creation time of the file in milliseconds since the epoch.
      type: Number
    - contextPath: RubrikPolaris.FileContext.lastScanTime
      description: The last scan time of the file in milliseconds since the epoch.
      type: Number
    - contextPath: RubrikPolaris.FileContext.directory
      description: The value of Directory.
      type: String
    - contextPath: RubrikPolaris.FileContext.createdBy
      description: The user who created the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.modifiedBy
      description: The user who last modified the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.numDescendantFiles
      description: The number of descendant files of the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.numDescendantErrorFiles
      description: The number of descendant files of the file that could not be processed.
      type: Number
    - contextPath: RubrikPolaris.FileContext.numDescendantSkippedExtFiles
      description: The number of descendant files of the file that were skipped because of their file extension.
      type: Number
    - contextPath: RubrikPolaris.FileContext.numDescendantSkippedSizeFiles
      description: The number of descendant files of the file that were skipped because of their file size.
      type: Number
    - contextPath: RubrikPolaris.FileContext.errorCode
      description: The error code, if any, for the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.hits.totalHits
      description: The total number of hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.hits.violations
      description: The number of violations for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.hits.violationsDelta
      description: The change in the number of violations for the file since the last scan.
      type: Number
    - contextPath: RubrikPolaris.FileContext.hits.totalHitsDelta
      description: The change in the total number of hits for the file since the last scan.
      type: Number
    - contextPath: RubrikPolaris.FileContext.hits.__typename
      description: The type of the hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.filesWithHits.totalHits
      description: The total number of files with hits.
      type: Number
    - contextPath: RubrikPolaris.FileContext.filesWithHits.violations
      description: The number of files with violations.
      type: Number
    - contextPath: RubrikPolaris.FileContext.filesWithHits.__typename
      description: The type of the files with hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.openAccessFilesWithHits.totalHits
      description: The total number of open access files with hits.
      type: Number
    - contextPath: RubrikPolaris.FileContext.openAccessFilesWithHits.violations
      description: The number of open access files with violations.
      type: Number
    - contextPath: RubrikPolaris.FileContext.openAccessFilesWithHits.__typename
      description: The type of the open access files with hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.staleFilesWithHits.totalHits
      description: The total number of stale files with hits.
      type: Number
    - contextPath: RubrikPolaris.FileContext.staleFilesWithHits.violations
      description: The number of stale files with violations.
      type: Number
    - contextPath: RubrikPolaris.FileContext.staleFilesWithHits.__typename
      description: The type of the stale files with hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.groupType
      description: The type of the analyzer group.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.id
      description: The ID of the analyzer group.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.name
      description: The name of the analyzer group.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.__typename
      description: The type of the analyzer group field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.totalHits
      description: The total number of hits for the analyzer results.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.violations
      description: The number of violations for the analyzer results.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.__typename
      description: The type of the hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.id
      description: The ID of the analyzer.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.name
      description: The name of the analyzer.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.analyzerType
      description: The type of the analyzer.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.__typename
      description: The type of the analyzer field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.__typename
      description: The type of the analyzer results field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.hits.totalHits
      description: The total number of hits for the analyzer group results.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.hits.violations
      description: The number of violations for the analyzer group results.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.hits.violationsDelta
      description: The change in the number of violations for the analyzer group results since the last scan.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.hits.totalHitsDelta
      description: The change in the total number of hits for the analyzer group results since the last scan.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.hits.__typename
      description: The type of the hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerGroupResults.__typename
      description: The type of the analyzer group results field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.totalCount
      description: The total number of high-risk files for the policy object.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.violatedCount
      description: The number of high-risk files for the policy object that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.__typename
      description: The type of the high-risk file count field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.totalCount
      description: The total number of medium-risk files for the policy object.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.violatedCount
      description: The number of medium-risk files for the policy object that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.__typename
      description: The type of the medium risk file count field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.totalCount
      description: The total number of low-risk files for the policy object.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.violatedCount
      description: The number of low-risk files for the policy object that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.__typename
      description: The type of the low-risk file count field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.totalCount
      description: The total number of no-risk files for the policy object.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.violatedCount
      description: The number of no-risk files for the policy object that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.__typename
      description: The type of the no-risk file count field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.totalCount
      description: The total number of files for the policy object.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.violatedCount
      description: The number of files for the policy object that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.__typename
      description: The type of the total file count field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveFiles.__typename
      description: The type of the sensitive files field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.highRiskHits.totalHits
      description: The total number of high-risk sensitive hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.highRiskHits.violatedHits
      description: The number of high-risk sensitive hits for the file that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.highRiskHits.__typename
      description: The type of the high-risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.totalHits
      description: The total number of medium-risk sensitive hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.violatedHits
      description: The number of medium-risk sensitive hits for the file that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.__typename
      description: The type of the medium-risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.totalHits
      description: The total number of low-risk sensitive hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.violatedHits
      description: The number of low-risk sensitive hits for the file that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.__typename
      description: The type of the low-risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.noRiskHits.totalHits
      description: The total number of no-risk sensitive hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.noRiskHits.violatedHits
      description: The number of no-risk sensitive hits for the file that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.noRiskHits.__typename
      description: The type of the no-risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.sensitiveHits.__typename
      description: The type of the sensitive hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.totalHits
      description: The total number of high-risk analyzer hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.violatedHits
      description: The number of high-risk analyzer hits for the file that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.__typename
      description: The type of the high-risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.totalHits
      description: The total number of medium-risk analyzer hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.violatedHits
      description: The number of medium-risk analyzer hits for the file that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.__typename
      description: The type of the medium-risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.totalHits
      description: The total number of low-risk analyzer hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.violatedHits
      description: The number of low-risk analyzer hits for the file that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.__typename
      description: The type of the low-risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.totalHits
      description: The total number of no-risk analyzer hits for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.violatedHits
      description: The number of no-risk analyzer hits for the file that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.__typename
      description: The type of the no-risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerRiskHits.__typename
      description: The type of the analyzer risk hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerResults.hits.totalHits
      description: The total number of hits for the analyzer results.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerResults.hits.violations
      description: The number of violations for the analyzer results.
      type: Number
    - contextPath: RubrikPolaris.FileContext.analyzerResults.hits.__typename
      description: The type of the hits field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerResults.analyzer.id
      description: The ID of the analyzer.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerResults.analyzer.name
      description: The name of the analyzer.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerResults.analyzer.analyzerType
      description: The type of the analyzer.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerResults.analyzer.__typename
      description: The type of the analyzer field.
      type: String
    - contextPath: RubrikPolaris.FileContext.analyzerResults.__typename
      description: The type of the analyzer results field.
      type: String
    - contextPath: RubrikPolaris.FileContext.openAccessType
      description: The open access type for the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.stalenessType
      description: The staleness type for the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.numActivities
      description: The number of activities for the file.
      type: Number
    - contextPath: RubrikPolaris.FileContext.numActivitiesDelta
      description: The change in the number of activities for the file since the last time it was checked.
      type: Number
    - contextPath: RubrikPolaris.FileContext.exposureSummary.exposureType
      description: The exposure type of the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.exposureSummary.fileCount.totalCount
      description: The total number of files with this exposure type.
      type: Number
    - contextPath: RubrikPolaris.FileContext.exposureSummary.fileCount.violatedCount
      description: The number of files with this exposure type that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.exposureSummary.fileCount.__typename
      description: The type of the file count field.
      type: String
    - contextPath: RubrikPolaris.FileContext.exposureSummary.__typename
      description: The type of the exposure summary field.
      type: String
    - contextPath: RubrikPolaris.FileContext.dbEntityType
      description: The database entity type of the file.
      type: String
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.siteId
      description: The site ID of the MIP label.
      type: String
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.labelName
      description: The name of the MIP label.
      type: String
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.labelId
      description: The ID of the MIP label.
      type: String
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.hasProtection
      description: Whether the MIP label has protection applied.
      type: Boolean
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.__typename
      description: The type of the MIP label field.
      type: String
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.filesCount.violatedCount
      description: The number of files with this MIP label that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.filesCount.totalCount
      description: The total number of files with this MIP label.
      type: Number
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.filesCount.__typename
      description: The type of the files count field.
      type: String
    - contextPath: RubrikPolaris.FileContext.mipLabelsSummary.__typename
      description: The type of the MIP labels summary field.
      type: String
    - contextPath: RubrikPolaris.FileContext.documentTypesSummary.id
      description: The ID of the document type.
      type: String
    - contextPath: RubrikPolaris.FileContext.documentTypesSummary.name
      description: The name of the document type.
      type: String
    - contextPath: RubrikPolaris.FileContext.documentTypesSummary.filesCount.totalCount
      description: The total number of files of this document type.
      type: Number
    - contextPath: RubrikPolaris.FileContext.documentTypesSummary.filesCount.violatedCount
      description: The number of files of this document type that violates policies.
      type: Number
    - contextPath: RubrikPolaris.FileContext.documentTypesSummary.filesCount.__typename
      description: The type of the files count field.
      type: String
    - contextPath: RubrikPolaris.FileContext.documentTypesSummary.__typename
      description: The type of the document types summary field.
      type: String
    - contextPath: RubrikPolaris.FileContext.__typename
      description: The type of the file context field.
      type: String
    - contextPath: RubrikPolaris.PageToken.FileContext.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.FileContext.startCursor
      description: The start cursor for the current page.
      type: String
    - contextPath: RubrikPolaris.PageToken.FileContext.endCursor
      description: The end cursor for the current page.
      type: String
    - contextPath: RubrikPolaris.PageToken.FileContext.hasNextPage
      description: Whether the result has the next page or not.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.FileContext.hasPreviousPage
      description: Whether the result has the previous page or not.
      type: Boolean
  - arguments:
    - description: "The Snapshot ID of the object or Activity Series ID.\n\nNote: Users can get the list of the snapshot IDs by executing the \"rubrik-polaris-object-snapshot-list\" command. For the Activity Series ID, the users can execute the \"rubrik-event-list\" command with the \"activity_type\" argument set to \"ANOMALY\"."
      name: snapshot_id
      required: true
    description: Retrieve the suspicious list of files for a snapshot ID with detected file anomalies.
    name: rubrik-radar-suspicious-file-list
    outputs:
    - contextPath: RubrikPolaris.SuspiciousFile.id
      description: 'The anomaly result ID.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.snapshotFid
      description: 'The snapshot ID.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.cluster.id
      description: 'The cluster ID.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.cluster.defaultAddress
      description: 'The default address of the cluster.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.cluster.systemStatusAffectedNodes.ipAddress
      description: 'The IP address of the affected node.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.cluster.name
      description: 'The cluster name.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.cluster.version
      description: 'The cluster version.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.cluster.status
      description: 'The cluster status.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.cluster.__typename
      description: 'The type name of the cluster response.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.cdmId
      description: 'The snapshot CDM ID.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.managedId
      description: 'The managed object ID.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyProbability
      description: 'The probability of the anomaly.'
      type: Number
    - contextPath: RubrikPolaris.SuspiciousFile.workloadId
      description: 'The workload ID.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.location
      description: 'The location of the anomaly.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.isAnomaly
      description: 'Indicates if the file is an anomaly.'
      type: Boolean
    - contextPath: RubrikPolaris.SuspiciousFile.objectType
      description: 'The object type.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.snappableNew.objectType
      description: 'The object type of the snapshot.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.severity
      description: 'The severity of the anomaly.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.detectionTime
      description: 'The detection time of the anomaly.'
      type: Date
    - contextPath: RubrikPolaris.SuspiciousFile.snapshotDate
      description: 'The snapshot date of the anomaly.'
      type: Date
    - contextPath: RubrikPolaris.SuspiciousFile.encryption
      description: 'The encryption standard of the anomaly.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.resolutionStatus
      description: 'The resolution status of the anomaly.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyType
      description: 'The type of the anomaly.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.strainId
      description: 'The ID of the Ransomware Strain.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalAffectedFiles
      description: 'The total number of affected files.'
      type: Number
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalRansomwareNotes
      description: 'The total number of ransomware notes.'
      type: Number
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath
      description: 'The path of the affected file.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.lastModified
      description: 'The last modified time of the affected file.'
      type: Date
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.fileSizeBytes
      description: 'The size of the affected file in bytes.'
      type: Number
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.__typename
      description: 'The type name of the affected file response.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath
      description: 'The path of the ransomware note file.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.lastModified
      description: 'The last modified time of the ransomware note file.'
      type: Date
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.fileSizeBytes
      description: 'The size of the ransomware note file in bytes.'
      type: Number
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.__typename
      description: 'The type name of the ransomware note file response.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.__typename
      description: 'The type name of the strain analysis response.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.__typename
      description: 'The type name of the anomaly response.'
      type: String
    - contextPath: RubrikPolaris.SuspiciousFile.__typename
      description: 'The type name of the suspicious file response.'
      type: String
  - name: ip
    description: Retrieve the sensitive information available for the given IP address(es).
    arguments:
    - name: ip
      description: The IP address(es) for which to retrieve sensitive information.
      required: true
      isArray: true
      default: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.Relationships.EntityA
      description: The source of the relationship.
      type: String
    - contextPath: IP.Relationships.EntityB
      description: The destination of the relationship.
      type: String
    - contextPath: IP.Relationships.Relationship
      description: The name of the relationship.
      type: String
    - contextPath: IP.Relationships.EntityAType
      description: The type of the source of the relationship.
      type: String
    - contextPath: IP.Relationships.EntityBType
      description: The type of the destination of the relationship.
      type: String
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948".'
      type: String
    - contextPath: IP.Hostname
      description: The hostname that is mapped to this IP address.
      type: String
    - contextPath: IP.Geo.Location
      description: 'The geolocation where the IP address is located, in the format: latitude:longitude.'
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Geo.Description
      description: Additional information about the location.
      type: String
    - contextPath: IP.DetectionEngines
      description: The total number of engines that checked the indicator.
      type: Number
    - contextPath: IP.PositiveDetections
      description: The number of engines that positively detected the indicator as malicious.
      type: Number
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: IP.Tags
      description: Tags of the IP address.
      type: Unknown
    - contextPath: IP.FeedRelatedIndicators.value
      description: Indicators that are associated with the IP address.
      type: String
    - contextPath: IP.FeedRelatedIndicators.type
      description: The type of the indicators that are associated with the IP address.
      type: String
    - contextPath: IP.FeedRelatedIndicators.description
      description: The description of the indicators that are associated with the IP address.
      type: String
    - contextPath: IP.MalwareFamily
      description: The malware family associated with the IP address.
      type: String
    - contextPath: IP.Organization.Name
      description: The organization of the IP address.
      type: String
    - contextPath: IP.Organization.Type
      description: The organization type of the IP address.
      type: String
    - contextPath: IP.ASOwner
      description: The autonomous system owner of the IP address.
      type: String
    - contextPath: IP.Region
      description: The region in which the IP address is located.
      type: String
    - contextPath: IP.Port
      description: Ports that are associated with the IP address.
      type: String
    - contextPath: IP.Internal
      description: Whether the IP address is internal or external.
      type: Boolean
    - contextPath: IP.UpdatedDate
      description: The date that the IP address was last updated.
      type: Date
    - contextPath: IP.Registrar.Abuse.Name
      description: The name of the contact for reporting abuse.
      type: String
    - contextPath: IP.Registrar.Abuse.Address
      description: The address of the contact for reporting abuse.
      type: String
    - contextPath: IP.Registrar.Abuse.Country
      description: The country of the contact for reporting abuse.
      type: String
    - contextPath: IP.Registrar.Abuse.Network
      description: The network of the contact for reporting abuse.
      type: String
    - contextPath: IP.Registrar.Abuse.Phone
      description: The phone number of the contact for reporting abuse.
      type: String
    - contextPath: IP.Registrar.Abuse.Email
      description: The email address of the contact for reporting abuse.
      type: String
    - contextPath: IP.Campaign
      description: The campaign associated with the IP address.
      type: String
    - contextPath: IP.TrafficLightProtocol
      description: The Traffic Light Protocol (TLP) color that is suitable for the IP address.
      type: String
    - contextPath: IP.CommunityNotes.note
      description: Notes on the IP address that were given by the community.
      type: String
    - contextPath: IP.CommunityNotes.timestamp
      description: The time in which the note was published.
      type: Date
    - contextPath: IP.Publications.source
      description: The source in which the article was published.
      type: String
    - contextPath: IP.Publications.title
      description: The name of the article.
      type: String
    - contextPath: IP.Publications.link
      description: A link to the original article.
      type: String
    - contextPath: IP.Publications.timestamp
      description: The time in which the article was published.
      type: Date
    - contextPath: IP.ThreatTypes.threatcategory
      description: The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc.
      type: String
    - contextPath: IP.ThreatTypes.threatcategoryconfidence
      description: The confidence level provided by the vendor for the threat type category For example, a confidence of 90 for the threat type category 'malware' means that the vendor rates that this is 90% confidence of being a malware.
      type: String
    - contextPath: RubrikPolaris.IP.ip
      description: 'IP address of the object.'
      type: String
    - contextPath: RubrikPolaris.IP.generalInfo.fid
      description: 'The foreign ID of the object.'
      type: String
    - contextPath: RubrikPolaris.IP.generalInfo.name
      description: 'The name of the object.'
      type: String
    - contextPath: RubrikPolaris.IP.generalInfo.objectType
      description: 'The type of the object.'
      type: String
    - contextPath: RubrikPolaris.IP.generalInfo.protectionStatus
      description: 'The protection status of the object.'
      type: String
    - contextPath: RubrikPolaris.IP.generalInfo.lastSnapshot
      description: 'The timestamp of the last snapshot of the object.'
      type: Date
    - contextPath: RubrikPolaris.IP.generalInfo.redirectLink
      description: 'The link to the object in the Rubrik UI.'
      type: String
    - contextPath: RubrikPolaris.IP.sensitiveInfo.riskLevel
      description: 'The risk level of the object.'
      type: String
    - contextPath: RubrikPolaris.IP.sensitiveInfo.sensitiveFiles.mediumCount
      description: 'The number of sensitive files of medium risk level.'
      type: String
    - contextPath: RubrikPolaris.IP.sensitiveInfo.sensitiveHits
      description: 'The number of sensitive files.'
      type: Number
    - contextPath: RubrikPolaris.IP.sensitiveInfo.openAccessFiles
      description: 'The number of open access files.'
      type: Number
    - contextPath: RubrikPolaris.IP.sensitiveInfo.staleFiles
      description: 'The number of stale files.'
      type: Number
    - contextPath: RubrikPolaris.IP.sensitiveInfo.redirectLink
      description: 'The link to the sensitive information in the Rubrik UI.'
      type: String
    - contextPath: RubrikPolaris.IP.sensitiveInfo.policyNames
      description: 'The names of the policies associated with the object.'
      type: String
    - contextPath: RubrikPolaris.IP.anomalyInfo.severity
      description: 'The severity of the anomaly.'
      type: String
    - contextPath: RubrikPolaris.IP.anomalyInfo.detectionTime
      description: 'The timestamp of the anomaly detection.'
      type: Date
    - contextPath: RubrikPolaris.IP.anomalyInfo.createdFileCount
      description: 'The number of created files.'
      type: String
    - contextPath: RubrikPolaris.IP.anomalyInfo.deletedFileCount
      description: 'The number of deleted files.'
      type: String
    - contextPath: RubrikPolaris.IP.anomalyInfo.modifiedFileCount
      description: 'The number of modified files.'
      type: String
    - contextPath: RubrikPolaris.IP.anomalyInfo.suspiciousFileCount
      description: 'The number of suspicious files.'
      type: String
    - contextPath: RubrikPolaris.IP.anomalyInfo.redirectLink
      description: 'The link to the anomaly information in the Rubrik UI.'
      type: String
    - contextPath: RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.huntId
      description: 'The ID of the latest threat hunt.'
      type: String
    - contextPath: RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.huntStartTime
      description: 'The timestamp of the latest threat hunt.'
      type: Date
    - contextPath: RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.isMalicious
      description: 'Whether the latest threat hunt is malicious.'
      type: String
    - contextPath: RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.huntId
      description: 'The ID of the latest malicious threat hunt.'
      type: String
    - contextPath: RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.huntStartTime
      description: 'The timestamp of the latest malicious threat hunt.'
      type: Date
    - contextPath: RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.isMalicious
      description: 'Whether the latest malicious threat hunt is malicious.'
      type: String
    - contextPath: RubrikPolaris.IP.threatHuntInfo.redirectLink
      description: 'The link to the threat hunt information in the Rubrik UI.'
      type: String
    - contextPath: RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.snapshotFid
      description: 'The foreign ID of the latest threat monitoring snapshot.'
      type: String
    - contextPath: RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.monitoringScanTime
      description: 'The timestamp of the latest threat monitoring scan.'
      type: Date
    - contextPath: RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.isMalicious
      description: 'Whether the latest threat monitoring snapshot is malicious.'
      type: String
    - contextPath: RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.snapshotFid
      description: 'The foreign ID of the latest malicious threat monitoring snapshot.'
      type: String
    - contextPath: RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.monitoringScanTime
      description: 'The timestamp of the latest malicious threat monitoring scan.'
      type: Date
    - contextPath: RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.isMalicious
      description: 'Whether the latest malicious threat monitoring snapshot is malicious.'
      type: String
    - contextPath: RubrikPolaris.IP.threatMonitoringInfo.redirectLink
      description: 'The link to the threat monitoring information in the Rubrik UI.'
      type: String
  - name: domain
    description: Retrieve the sensitive information available for the given domain(s).
    arguments:
    - name: domain
      description: The domain(s) for which to retrieve sensitive information.
      required: true
      isArray: true
      default: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: Domain.Relationships.EntityA
      description: The source of the relationship.
      type: string
    - contextPath: Domain.Relationships.EntityB
      description: The destination of the relationship.
      type: string
    - contextPath: Domain.Relationships.Relationship
      description: The name of the relationship.
      type: string
    - contextPath: Domain.Relationships.EntityAType
      description: The type of the source of the relationship.
      type: string
    - contextPath: Domain.Relationships.EntityBType
      description: The type of the destination of the relationship.
      type: string
    - contextPath: Domain.DNS
      description: A list of IP objects resolved by DNS.
      type: String
    - contextPath: Domain.DetectionEngines
      description: The total number of engines that checked the indicator.
      type: Number
    - contextPath: Domain.PositiveDetections
      description: The number of engines that positively detected the indicator as malicious.
      type: Number
    - contextPath: Domain.CreationDate
      description: The date that the domain was created.
      type: Date
    - contextPath: Domain.UpdatedDate
      description: The date that the domain was last updated.
      type: String
    - contextPath: Domain.ExpirationDate
      description: The expiration date of the domain.
      type: Date
    - contextPath: Domain.DomainStatus
      description: The status of the domain.
      type: Datte
    - contextPath: Domain.NameServers
      description: (List<String>) Name servers of the domain.
      type: Unknown
    - contextPath: Domain.Organization
      description: The organization of the domain.
      type: String
    - contextPath: Domain.Subdomains
      description: (List<String>) Subdomains of the domain.
      type: Unknown
    - contextPath: Domain.Admin.Country
      description: The country of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Email
      description: The email address of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Name
      description: The name of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Phone
      description: The phone number of the domain administrator.
      type: String
    - contextPath: Domain.Registrant.Country
      description: The country of the registrant.
      type: String
    - contextPath: Domain.Registrant.Email
      description: The email address of the registrant.
      type: String
    - contextPath: Domain.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Domain.Registrant.Phone
      description: The phone number for receiving abuse reports.
      type: String
    - contextPath: Domain.Tags
      description: Tags of the domain.
      type: Unknown
    - contextPath: Domain.FeedRelatedIndicators.value
      description: Indicators that are associated with the domain.
      type: String
    - contextPath: Domain.FeedRelatedIndicators.type
      description: The type of the indicators that are associated with the domain.
      type: String
    - contextPath: Domain.FeedRelatedIndicators.description
      description: The description of the indicators that are associated with the domain.
      type: String
    - contextPath: Domain.MalwareFamily
      description: The malware family associated with the domain.
      type: String
    - contextPath: Domain.WHOIS.DomainStatus
      description: The status of the domain.
      type: String
    - contextPath: Domain.WHOIS.NameServers
      description: (List<String>) Name servers of the domain.
      type: String
    - contextPath: Domain.WHOIS.CreationDate
      description: The date that the domain was created.
      type: Date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: The date that the domain was last updated.
      type: Date
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The expiration date of the domain.
      type: Date
    - contextPath: Domain.WHOIS.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Email
      description: The email address of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrant.Phone
      description: The phone number of the registrant.
      type: String
    - contextPath: Domain.WHOIS.Registrar.Name
      description: 'The name of the registrar, for example: "GoDaddy".'
      type: String
    - contextPath: Domain.WHOIS.Registrar.AbuseEmail
      description: The email address of the contact for reporting abuse.
      type: String
    - contextPath: Domain.WHOIS.Registrar.AbusePhone
      description: The phone number of contact for reporting abuse.
      type: String
    - contextPath: Domain.WHOIS.Admin.Name
      description: The name of the domain administrator.
      type: String
    - contextPath: Domain.WHOIS.Admin.Email
      description: The email address of the domain administrator.
      type: String
    - contextPath: Domain.WHOIS.Admin.Phone
      description: The phone number of the domain administrator.
      type: String
    - contextPath: Domain.WHOIS/History
      description: List of Whois objects.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor reporting the domain as malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description explaining why the domain was reported as malicious.
      type: String
    - contextPath: Domain.DomainIDNName
      description: The internationalized domain name (IDN) of the domain.
      type: String
    - contextPath: Domain.Port
      description: Ports that are associated with the domain.
      type: String
    - contextPath: Domain.Internal
      description: Whether or not the domain is internal or external.
      type: Bool
    - contextPath: Domain.Category
      description: The category associated with the indicator.
      type: String
    - contextPath: Domain.Campaign
      description: The campaign associated with the domain.
      type: String
    - contextPath: Domain.TrafficLightProtocol
      description: The Traffic Light Protocol (TLP) color that is suitable for the domain.
      type: String
    - contextPath: Domain.ThreatTypes.threatcategory
      description: The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc.
      type: String
    - contextPath: Domain.ThreatTypes.threatcategoryconfidence
      description: Threat Category Confidence is the confidence level provided by the vendor for the threat type category For example a confidence of 90 for threat type category 'malware' means that the vendor rates that this is 90% confidence of being a malware.
      type: String
    - contextPath: Domain.Geo.Location
      description: 'The geolocation where the domain address is located, in the format: latitude:longitude.'
      type: String
    - contextPath: Domain.Geo.Country
      description: The country in which the domain address is located.
      type: String
    - contextPath: Domain.Geo.Description
      description: Additional information about the location.
      type: String
    - contextPath: Domain.Tech.Country
      description: The country of the domain technical contact.
      type: String
    - contextPath: Domain.Tech.Name
      description: The name of the domain technical contact.
      type: String
    - contextPath: Domain.Tech.Organization
      description: The organization of the domain technical contact.
      type: String
    - contextPath: Domain.Tech.Email
      description: The email address of the domain technical contact.
      type: String
    - contextPath: Domain.CommunityNotes.note
      description: Notes on the domain that were given by the community.
      type: String
    - contextPath: Domain.CommunityNotes.timestamp
      description: The time in which the note was published.
      type: Date
    - contextPath: Domain.Publications.source
      description: The source in which the article was published.
      type: String
    - contextPath: Domain.Publications.title
      description: The name of the article.
      type: String
    - contextPath: Domain.Publications.link
      description: A link to the original article.
      type: String
    - contextPath: Domain.Publications.timestamp
      description: The time in which the article was published.
      type: Date
    - contextPath: Domain.Billing
      description: The billing address of the domain.
      type: String
    - contextPath: RubrikPolaris.Domain.domain
      description: 'The domain of the object.'
      type: String
    - contextPath: RubrikPolaris.Domain.generalInfo.fid
      description: 'The foreign ID of the object.'
      type: String
    - contextPath: RubrikPolaris.Domain.generalInfo.name
      description: 'The name of the object.'
      type: String
    - contextPath: RubrikPolaris.Domain.generalInfo.objectType
      description: 'The type of the object.'
      type: String
    - contextPath: RubrikPolaris.Domain.generalInfo.protectionStatus
      description: 'The protection status of the object.'
      type: String
    - contextPath: RubrikPolaris.Domain.generalInfo.lastSnapshot
      description: 'The timestamp of the last snapshot of the object.'
      type: Date
    - contextPath: RubrikPolaris.Domain.generalInfo.redirectLink
      description: 'The link to the object in the Rubrik UI.'
      type: String
    - contextPath: RubrikPolaris.Domain.sensitiveInfo.riskLevel
      description: 'The risk level of the object.'
      type: String
    - contextPath: RubrikPolaris.Domain.sensitiveInfo.sensitiveFiles.mediumCount
      description: 'The number of sensitive files of medium risk level.'
      type: String
    - contextPath: RubrikPolaris.Domain.sensitiveInfo.sensitiveHits
      description: 'The number of sensitive files.'
      type: Number
    - contextPath: RubrikPolaris.Domain.sensitiveInfo.openAccessFiles
      description: 'The number of open access files.'
      type: Number
    - contextPath: RubrikPolaris.Domain.sensitiveInfo.staleFiles
      description: 'The number of stale files.'
      type: Number
    - contextPath: RubrikPolaris.Domain.sensitiveInfo.redirectLink
      description: 'The link to the sensitive information in the Rubrik UI.'
      type: String
    - contextPath: RubrikPolaris.Domain.sensitiveInfo.policyNames
      description: 'The names of the policies associated with the object.'
      type: String
    - contextPath: RubrikPolaris.Domain.anomalyInfo.severity
      description: 'The severity of the anomaly.'
      type: String
    - contextPath: RubrikPolaris.Domain.anomalyInfo.detectionTime
      description: 'The timestamp of the anomaly detection.'
      type: Date
    - contextPath: RubrikPolaris.Domain.anomalyInfo.createdFileCount
      description: 'The number of created files.'
      type: String
    - contextPath: RubrikPolaris.Domain.anomalyInfo.deletedFileCount
      description: 'The number of deleted files.'
      type: String
    - contextPath: RubrikPolaris.Domain.anomalyInfo.modifiedFileCount
      description: 'The number of modified files.'
      type: String
    - contextPath: RubrikPolaris.Domain.anomalyInfo.suspiciousFileCount
      description: 'The number of suspicious files.'
      type: String
    - contextPath: RubrikPolaris.Domain.anomalyInfo.redirectLink
      description: 'The link to the anomaly information in the Rubrik UI.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.huntId
      description: 'The ID of the latest threat hunt.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.huntStartTime
      description: 'The timestamp of the latest threat hunt.'
      type: Date
    - contextPath: RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.isMalicious
      description: 'Whether the latest threat hunt is malicious.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.huntId
      description: 'The ID of the latest malicious threat hunt.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.huntStartTime
      description: 'The timestamp of the latest malicious threat hunt.'
      type: Date
    - contextPath: RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.isMalicious
      description: 'Whether the latest malicious threat hunt is malicious.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatHuntInfo.redirectLink
      description: 'The link to the threat hunt information in the Rubrik UI.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.snapshotFid
      description: 'The foreign ID of the latest threat monitoring snapshot.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.monitoringScanTime
      description: 'The timestamp of the latest threat monitoring scan.'
      type: Date
    - contextPath: RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.isMalicious
      description: 'Whether the latest threat monitoring snapshot is malicious.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.snapshotFid
      description: 'The foreign ID of the latest malicious threat monitoring snapshot.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.monitoringScanTime
      description: 'The timestamp of the latest malicious threat monitoring scan.'
      type: Date
    - contextPath: RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.isMalicious
      description: 'Whether the latest malicious threat monitoring snapshot is malicious.'
      type: String
    - contextPath: RubrikPolaris.Domain.threatMonitoringInfo.redirectLink
      description: 'The link to the threat monitoring information in the Rubrik UI.'
      type: String
  - name: rubrik-radar-anomaly-status-update
    description: "Updates the status of the Anomaly detection.\n\nNote: Run the \"rubrik-radar-suspicious-file-list\" command first to check the resolution status of the Anomaly Detection snapshot before executing this command."
    arguments:
    - name: anomaly_type
      description: "The type of the anomaly.\n\nNote: For Anomaly Type, users can execute the \"rubrik-radar-suspicious-file-list\" command."
      required: true
      auto: PREDEFINED
      predefined:
      - 'FILESYSTEM'
      - 'HYPERVISOR'
    - name: anomaly_id
      description: "The ID of the Anomaly or Activity Series ID.\n\nNote: For Activity Series ID, users can execute the \"rubrik-event-list\" command with the \"activity_type\" argument set to \"ANOMALY\"."
      required: true
    - name: workload_id
      description: "The workload ID (Snappable ID).\n\nNote: Users can execute the \"rubrik-event-list\" command with the \"activity_type\" argument set to \"ANOMALY\" and get the value of \"fid\" from the context."
      required: true
    - name: false_positive_type
      description: The type for marking the anomaly as a false positive.
      auto: PREDEFINED
      predefined:
      - 'FP_TYPE_UNSPECIFIED'
      - 'OS_UPDATE'
      - 'APPLICATION_UPDATE'
      - 'LOG_ROTATION'
      - 'OTHER'
      - 'NFA_SCHEDULED_MAINTENANCE'
      - 'NFA_UNSCHEDULED_MAINTENANCE'
    - name: false_positive_reason
      description: "The reason for marking the anomaly as a false positive when the \"false_positive_type\" argument is set to OTHER."
    outputs:
    - contextPath: RubrikPolaris.AnomalyStatus.command_name
      description: The name of the command.
      type: String
    - contextPath: RubrikPolaris.AnomalyStatus.anomaly_type
      description: The type of the Anomaly.
      type: String
    - contextPath: RubrikPolaris.AnomalyStatus.anomaly_id
      description: The ID of the Anomaly.
      type: String
    - contextPath: RubrikPolaris.AnomalyStatus.workload_id
      description: The workload ID.
      type: String
    - contextPath: RubrikPolaris.AnomalyStatus.is_resloved
      description: Whether the Anomaly is resolved.
      type: Boolean
    - contextPath: RubrikPolaris.AnomalyStatus.false_positive_type
      description: The type of the false positive.
      type: String
    - contextPath: RubrikPolaris.AnomalyStatus.false_positive_reason
      description: The reason for marking the Anomaly detection snapshot as a false positive.
      type: String
  - name: rubrik-threat-monitoring-matched-object-list
    description: "List the matched objects for Threat Monitoring."
    arguments:
    - name: cluster_id
      description: "The unique ID of the cluster. Supports comma separated values.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      isArray: true
    - name: object_type
      description: "Filter the objects based on the provided object types. Supports comma separated values.\n\nNote: Values not included in the options can be found in the documentation."
      auto: PREDEFINED
      predefined:
      - ShareFileset
      - NutanixVirtualMachine
      - VolumeGroup
      - HypervVirtualMachine
      - LinuxFileset
      - WindowsFileset
      - VmwareVirtualMachine
      isArray: true
    - name: object_name
      description: "Filter objects by their name. Supports partial matches."
    - name: match_type
      description: Filter the objects by the match type. Supports comma separated values.
      auto: PREDEFINED
      predefined:
      - INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME
      - INDICATOR_OF_COMPROMISE_TYPE_HASH
      - INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE
      isArray: true
    - name: start_time
      defaultValue: "7 days"
      description: "Filter the objects detected after this time.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z."
    - name: limit
      defaultValue: "50"
      description: "Number of results to retrieve in the response. The maximum allowed size is 1000."
    - name: next_page_token
      description: "The next page cursor to retrieve the next set of results."
    outputs:
    - contextPath: RubrikPolaris.ThreatMonitoring.objectFid
      description: The unique identifier (FID) of the object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.objectName
      description: The name of the matched object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.objectType
      description: The type of the matched object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.matchType
      description: A list of match types found for the object.
      type: Unknown
    - contextPath: RubrikPolaris.ThreatMonitoring.filesMatched
      description: The number of files matched with the threat monitoring object.
      type: Number
    - contextPath: RubrikPolaris.ThreatMonitoring.lastDetection
      description: The timestamp of the most recent detection.
      type: Date
    - contextPath: RubrikPolaris.ThreatMonitoring.cluster.name
      description: The name of the cluster the object belongs to.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.cluster.id
      description: The unique identifier of the cluster.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.cluster.__typename
      description: The GraphQL typename of the cluster object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.__typename
      description: The GraphQL typename of the matched object.
      type: String
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoring.endCursor
      description: The end cursor of the threat monitoring data.
      type: String
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoring.hasNextPage
      description: A flag indicating if there is a next page of threat monitoring data.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoring.hasPreviousPage
      description: A flag indicating if there is a previous page of threat monitoring data.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoring.name
      description: The name of the threat monitoring data.
      type: String
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoring.total_matched_count
      description: The total number of matched objects.
      type: Number
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoring.startCursor
      description: The start cursor of the threat monitoring data.
      type: String
  - name: rubrik-threat-monitoring-matched-object-get
    description: "Get the matched object for Threat Monitoring."
    arguments:
    - name: object_id
      description: "The object ID for the threat monitoring object.\n\nNote: Users can retrieve the object ID by executing the \"rubrik-threat-monitoring-matched-object-list\" command."
      required: true
    outputs:
    - contextPath: RubrikPolaris.ThreatMonitoring.id
      description: The ID of the threat monitoring data.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.name
      description: The name of the threat monitoring data.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.objectType
      description: The object type of the threat monitoring data.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.slaAssignment
      description: The SLA assignment of the threat monitoring data.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.slaPauseStatus
      description: The SLA pause status of the threat monitoring data.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.id
      description: The ID of the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.name
      description: The name of the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.version
      description: The version of the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.__typename
      description: The type name of the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.snapshotDistribution.id
      description: The ID of the snapshot distribution.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.snapshotDistribution.totalCount
      description: The total count of the snapshot distribution.
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.snapshotDistribution.scheduledCount
      description: The scheduled count of the snapshot distribution.
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.snapshotDistribution.onDemandCount
      description: The on-demand count of the snapshot distribution.
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.snapshotDistribution.retrievedCount
      description: The retrieved count of the snapshot distribution.
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.snapshotDistribution.__typename
      description: The type name of the snapshot distribution.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.id
      description: The ID of the effective retention SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.name
      description: The name of the effective retention SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.version
      description: The version of the effective retention SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.__typename
      description: The type name of the effective retention SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.configuredSlaDomain.id
      description: The ID of the configured SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.configuredSlaDomain.name
      description: The name of the configured SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.configuredSlaDomain.version
      description: The version of the configured SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.configuredSlaDomain.__typename
      description: The type name of the configured SLA domain.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.fid
      description: The FID of the effective SLA source object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.name
      description: The name of the effective SLA source object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.objectType
      description: The object type of the effective SLA source object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.__typename
      description: The type name of the effective SLA source object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.logicalPath.fid
      description: The FID of the logical path.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.logicalPath.name
      description: The name of the logical path.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.logicalPath.objectType
      description: The object type of the logical path.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.logicalPath.__typename 
      description: The type name of the logical path. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.physicalPath.fid 
      description: The FID of the physical path. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.physicalPath.name 
      description: The name of the physical path. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.physicalPath.objectType 
      description: The object type of the physical path. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.physicalPath.__typename 
      description: The type name of the physical path. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.numWorkloadDescendants 
      description: The number of workload descendants. 
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.allOrgs.id 
      description: The ID of the organization. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.allOrgs.name 
      description: The name of the organization. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.allOrgs.description 
      description: The description of the organization. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.allOrgs.mfaStatus 
      description: The MFA status of the organization. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.allOrgs.allUrls 
      description: The all URLs of the organization. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.allOrgs.__typename 
      description: The type name of the organization.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.lowSensitiveHits 
      description: The low sensitive hits of the security metadata. 
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.mediumSensitiveHits 
      description: The medium sensitive hits of the security metadata. 
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.highSensitiveHits 
      description: The high sensitive hits of the security metadata. 
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.sensitivityStatus 
      description: The sensitivity status of the security metadata. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.isLaminarEnabled 
      description: A flag indicating whether laminar is enabled for the security metadata. 
      type: Boolean
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.id 
      description: The ID of the data type result. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.name 
      description: The name of the data type result. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.totalHits 
      description: The total hits of the data type result. 
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.totalViolatedHits 
      description: The total violated hits of the data type result. 
      type: Integer
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.__typename 
      description: The type name of the data type result. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.securityMetadata.__typename 
      description: The type name of the security metadata. 
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoring.__typename 
      description: The type name of the threat monitoring data. 
      type: String
  - name: rubrik-threat-monitoring-matched-file-list
    description: List the matched files for the Threat Monitoring object.
    arguments:
    - name: object_id
      description: "The object ID for the threat monitoring object.\n\nNote: Users can retrieve the object ID by executing the \"rubrik-threat-monitoring-matched-object-list\" command."
      required: true
    - name: file_name
      description: Filter files by their name. Supports partial matches.
    - name: limit
      description: Number of results to retrieve in the response. The maximum allowed size is 1000.
      defaultValue: 50
    - name: next_page_token
      description: The next page cursor to retrieve the next set of results.
    outputs:
    - contextPath: RubrikPolaris.ThreatMonitoringFile.filepath
      description: The full path of the matched file.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.detectedTime
      description: The timestamp when the file was detected.
      type: Date
    - contextPath: RubrikPolaris.ThreatMonitoringFile.fileName
      description: The name of the matched file.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.fileSize
      description: The size of the matched file in bytes.
      type: Number
    - contextPath: RubrikPolaris.ThreatMonitoringFile.matchedSnapshotDate
      description: The date of the snapshot where the match occurred.
      type: Date
    - contextPath: RubrikPolaris.ThreatMonitoringFile.matchedSnapshotFid
      description: The FID of the snapshot where the match occurred.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.isMatchedSnapshotExpired
      description: A flag indicating whether the matched snapshot has expired.
      type: Boolean
    - contextPath: RubrikPolaris.ThreatMonitoringFile.isFirstObservedSnapshotExpired
      description: A flag indicating whether the first observed snapshot has expired.
      type: Boolean
    - contextPath: RubrikPolaris.ThreatMonitoringFile.matchType
      description: The type of indicator match.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.isQuarantinedInFirstObservedSnapshot
      description: A flag indicating whether the file is quarantined in the first observed snapshot.
      type: Boolean
    - contextPath: RubrikPolaris.ThreatMonitoringFile.objectFid
      description: The FID of the associated object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.firstObservedSnapshotFid
      description: The FID of the first observed snapshot.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.firstObservedSnapshotDate
      description: The date of the first observed snapshot.
      type: Date
    - contextPath: RubrikPolaris.ThreatMonitoringFile.objectType
      description: The type of the associated object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.objectName
      description: The name of the associated object.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.matchId
      description: The ID of the match event.
      type: Number
    - contextPath: RubrikPolaris.ThreatMonitoringFile.__typename
      description: The GraphQL typename of the file match object.
      type: String
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoringFile.endCursor
      description: The end cursor of the threat monitoring file data.
      type: String
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoringFile.hasNextPage
      description: A flag indicating if there is a next page of threat monitoring file data.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoringFile.hasPreviousPage
      description: A flag indicating if there is a previous page of threat monitoring file data.
      type: Boolean
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoringFile.name
      description: The name of the threat monitoring file data.
      type: String
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoringFile.total_matched_count
      description: The total number of matched files.
      type: Number
    - contextPath: RubrikPolaris.PageToken.ThreatMonitoringFile.startCursor
      description: The start cursor of the threat monitoring file data.
      type: String
  - name: rubrik-threat-monitoring-matched-file-get
    description: Get the matched file for the Threat Monitoring object.
    arguments:
    - name: matched_snapshot_id
      description: "ID of the snapshot where the threat monitoring match was found.\n\nNote: Users can retrieve the matched snapshot ID by executing the \"rubrik-threat-monitoring-matched-file-list\" command."
      required: true
    - name: file_path
      description: "Path of the file.\n\nNote: Users can retrieve the file path by executing the \"rubrik-threat-monitoring-matched-file-list\" command."
      required: true
    outputs:
    - contextPath: RubrikPolaris.ThreatMonitoringFile.matchedFileMd5
      description: The MD5 hash of the matched file.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.matchedFileSha1
      description: The SHA1 hash of the matched file.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.matchedFileSha256
      description: The SHA256 hash of the matched file.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.iocDetails.matchType
      description: The type of IOC match.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.iocDetails.intelFeedName
      description: The name of the intelligence feed that provided the IOC.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.iocDetails.malwareName
      description: The name of the malware associated with the IOC.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.iocDetails.iocRuleAuthor
      description: The author of the IOC rule.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.iocDetails.malwareDescription
      description: The description of the malware associated with the IOC.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.iocDetails.iocHashHex
      description: The hash value of the IOC in hexadecimal format.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.iocDetails.iocStatus
      description: The status of the IOC.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.iocDetails.__typename
      description: The GraphQL typename of the IOC details.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.isQuarantinedInFirstObservedSnapshot
      description: A flag indicating whether the file was quarantined in the first observed snapshot.
      type: Boolean
    - contextPath: RubrikPolaris.ThreatMonitoringFile.detectedSnapshotDate
      description: The date when the file was detected in the snapshot.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.firstDetectedSnapshotFid
      description: The ID of the first snapshot where the file was detected.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.filePath
      description: The full path of the file.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.fileName
      description: The name of the file.
      type: String
    - contextPath: RubrikPolaris.ThreatMonitoringFile.__typename
      description: The GraphQL typename of the threat monitoring file.
      type: String
  - name: rubrik-ioc-scan-list-v2
    description: List details of the Turbo and Advance Threat Hunt.
    arguments:
    - name: cluster_id
      description: "The ID of the cluster whose IOC scans are to be listed. Supports comma separated values.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      isArray: true
    - name: ioc_match
      description: Filter hunts on any matches.
      auto: PREDEFINED
      predefined:
      - MATCHES_FOUND
      - NO_MATCHES
      - UNSCANNED
    - name: hunt_status
      description: Filter by hunt status.
      auto: PREDEFINED
      predefined:
      - ABORTED
      - CANCELED
      - CANCELING
      - FAILED
      - IN_PROGRESS
      - PARTIALLY_SUCCEEDED
      - PENDING
      - SUCCEEDED
    - name: quarantine_status
      description: Filter by quarantine matches.
      auto: PREDEFINED
      predefined:
      - QUARANTINED_MATCHES
      - NO_QUARANTINED_MATCHES
    - name: start_time
      description: "Filter the threat hunts that started after this time.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z."
      defaultValue: "7 days"
    - name: end_time
      description: "Filter the threat hunts that ended before this time.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z."
    - name: limit
      description: Number of results to retrieve in the response. The maximum allowed size is 1000.
      defaultValue: 50
    - name: next_page_token
      description: The next page cursor to retrieve the next set of results.
    outputs:
    - contextPath: RubrikPolaris.IOCScan.huntId
      description: The unique identifier for the threat hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.name
      description: The name of the threat hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.createdBy.id
      description: The ID of the user who initiated the hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.createdBy.username
      description: The username of the user who initiated the hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.createdBy.email
      description: The email of the user who initiated the hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.createdBy.__typename
      description: The GraphQL typename of the user object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.huntType
      description: The type of the threat hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.startTime
      description: The start time of the threat hunt.
      type: date
    - contextPath: RubrikPolaris.IOCScan.status
      description: The current status of the threat hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.stats.totalProcessedSnapshots
      description: The total number of processed snapshots.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.totalAffectedObjects
      description: The total number of affected objects.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.totalAffectedSnapshots
      description: The total number of affected snapshots.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.totalUniqueMatchedPaths
      description: The total number of unique matched file paths.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.totalSucceededScans
      description: The total number of successful scans.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.totalSnapshotsScanned
      description: The total number of snapshots scanned.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.totalUniqueQuarantinedPaths
      description: The total number of unique quarantined file paths.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.totalObjectsScanned
      description: The total number of objects scanned.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.totalIocs
      description: The total number of IOCs used in the scan.
      type: number
    - contextPath: RubrikPolaris.IOCScan.stats.__typename
      description: The GraphQL typename of the stats object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.huntDetails.startTime
      description: The start time of the detailed threat hunt process.
      type: date
    - contextPath: RubrikPolaris.IOCScan.huntDetails.endTime
      description: The end time of the detailed threat hunt process.
      type: date
    - contextPath: RubrikPolaris.IOCScan.huntDetails.cluster.id
      description: The ID of the cluster used in the hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.huntDetails.cluster.name
      description: The name of the cluster used in the hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.huntDetails.cluster.__typename
      description: The GraphQL typename of the cluster object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.huntDetails.config.name
      description: The name of the configuration used in the hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.huntDetails.config.indicatorsOfCompromise
      description: The list of indicators of compromise.
      type: unknown
    - contextPath: RubrikPolaris.IOCScan.huntDetails.config.__typename
      description: The GraphQL typename of the hunt config object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.huntDetails.__typename
      description: The GraphQL typename of the hunt details object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.__typename
      description: The GraphQL typename of the top-level threat hunt object.
      type: string
    - contextPath: RubrikPolaris.PageToken.IOCScan.endCursor
      description: The end cursor of the IOC scan data.
      type: string
    - contextPath: RubrikPolaris.PageToken.IOCScan.hasNextPage
      description: A flag indicating if there is a next page of IOC scan data.
      type: boolean
    - contextPath: RubrikPolaris.PageToken.IOCScan.hasPreviousPage
      description: A flag indicating if there is a previous page of IOC scan data.
      type: boolean
    - contextPath: RubrikPolaris.PageToken.IOCScan.name
      description: The name of the IOC scan data.
      type: string
    - contextPath: RubrikPolaris.PageToken.IOCScan.startCursor
      description: The start cursor of the IOC scan data.
      type: string
    - contextPath: RubrikPolaris.PageToken.IOCScan.total_matched_count
      description: The total number of matched IOC scans.
      type: number
  - name: rubrik-ioc-scan-results-v2
    description: Retrieve details of the Turbo and Advance Threat Hunt.
    arguments:
    - name: hunt_id
      description: "The ID of the threat hunt.\n\nNote: Users can retrieve the hunt ID by executing the \"rubrik-ioc-scan-list-v2\" command."
      required: true
    outputs:
    - contextPath: RubrikPolaris.IOCScan.hunt_id
      description: The ID of the threat hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.totalObjectFids
      description: The total number of object FIDs involved in the threat hunt.
      type: number
    - contextPath: RubrikPolaris.IOCScan.startTime
      description: The start time of the threat hunt.
      type: date
    - contextPath: RubrikPolaris.IOCScan.endTime
      description: The end time of the threat hunt.
      type: date
    - contextPath: RubrikPolaris.IOCScan.status
      description: The current status of the threat hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.totalMatchedSnapshots
      description: The total number of matched snapshots.
      type: number
    - contextPath: RubrikPolaris.IOCScan.totalScannedSnapshots
      description: The total number of scanned snapshots.
      type: number
    - contextPath: RubrikPolaris.IOCScan.totalUniqueFileMatches
      description: The total number of unique file matches.
      type: number
    - contextPath: RubrikPolaris.IOCScan.clusters.id
      description: The ID of the cluster.
      type: string
    - contextPath: RubrikPolaris.IOCScan.clusters.name
      description: The name of the cluster.
      type: string
    - contextPath: RubrikPolaris.IOCScan.clusters.type
      description: The type of the cluster.
      type: string
    - contextPath: RubrikPolaris.IOCScan.clusters.__typename
      description: The GraphQL typename of the cluster object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.name
      description: The name of the base configuration used in the threat hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.notes
      description: The notes added to the hunt configuration.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.maxMatchesPerSnapshot
      description: The maximum number of matches allowed per snapshot.
      type: number
    - contextPath: RubrikPolaris.IOCScan.baseConfig.threatHuntType
      description: The type of the threat hunt.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.__typename
      description: The GraphQL typename of the base configuration object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.ioc.__typename
      description: The GraphQL typename of the IOC object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.ioc.iocList.__typename
      description: The GraphQL typename of the IOC list container.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.iocKind
      description: The type of IOC.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.iocValue
      description: The value of the IOC indicator.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.__typename
      description: The GraphQL typename of the IOC indicator.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.__typename
      description: The GraphQL typename of the snapshot scan limit object.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.__typename
      description: The GraphQL typename of the scan limit configuration.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.maxSnapshotsPerObject
      description: The maximum snapshots to scan per object.
      type: number
    - contextPath: RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.startTime
      description: The start time for the snapshot scan window.
      type: date
    - contextPath: RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.endTime
      description: The end time for the snapshot scan window.
      type: date
    - contextPath: RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.__typename
      description: The GraphQL typename of the scan limit configuration.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.objectSnapshotConfig
      description: An object snapshot configuration.
      type: string
    - contextPath: RubrikPolaris.IOCScan.baseConfig.fileScanCriteria
      description: A file scan criteria.
      type: string
    - contextPath: RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalObjectsScanned
      description: The total number of objects scanned during the hunt.
      type: number
    - contextPath: RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalAffectedObjects
      description: The total number of affected objects.
      type: number
    - contextPath: RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalUnaffectedObjects
      description: The total number of unaffected objects.
      type: number
    - contextPath: RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalObjectsUnscannable
      description: The total number of objects that couldn't be scanned.
      type: number
    - contextPath: RubrikPolaris.IOCScan.threatHuntObjectMetrics.unaffectedObjectsFromDb
      description: The number of clean objects retrieved from the database.
      type: number
    - contextPath: RubrikPolaris.IOCScan.threatHuntObjectMetrics.cleanRecoverableObjectLimit
      description: The maximum number of clean recoverable objects allowed.
      type: number
    - contextPath: RubrikPolaris.IOCScan.threatHuntObjectMetrics.__typename
      description: The GraphQL typename of the object metrics reply.
      type: string
    - contextPath: RubrikPolaris.IOCScan.__typename
      description: The GraphQL typename of the root hunt details object.
      type: string
  - name: rubrik-turbo-ioc-scan
    description: Start a new turbo threat hunt.
    arguments:
    - name: ioc
      description: "The value of the indicator to scan for. Supports comma separated values.\n\nNote: Users can retrieve the Md5, SHA1 or SHA256 by executing the \"rubrik-threat-monitoring-matched-file-get\" command."
      required: true
      isArray: true
    - name: scan_name
      description: Name of the new turbo threat hunt scan.
      defaultValue: "PAXSOAR-1.6.0"
    - name: cluster_id
      description: "The ID of the cluster on which to perform a scan. If not provided, all the clusters will be scanned.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      isArray: true
    - name: start_time
      description: "Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.\n\nFor example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z."
    - name: end_time
      description: "Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.\n\nFor example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z."
    - name: max_snapshots_per_object
      description: Maximum number of snapshots to scan per object.
    outputs:
    - contextPath: RubrikPolaris.TurboIOCScan.huntId
      description: The ID of the new turbo threat hunt.
      type: String
    - contextPath: RubrikPolaris.TurboIOCScan.__typename
      description: The type of the new turbo threat hunt.
      type: String
  - name: rubrik-advance-ioc-scan
    description: Start a new advance threat hunt.
    arguments:
    - name: object_id
      description: "The Object ID of the system on which to perform the scan. Supports comma separated values.\n\nNote: Users can get the list of object IDs by executing the \"rubrik-polaris-object-list\" command."
      required: true
      isArray: true
    - name: ioc_type
      description: "The type of the indicator to scan.\n\nNote: To provide multiple IOCs use the argument \"advance_ioc\"."
      auto: PREDEFINED
      predefined:
      - INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME
      - INDICATOR_OF_COMPROMISE_TYPE_HASH
      - INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE
    - name: ioc_value
      description: "The value of the indicator to scan.\n\nNote: To provide multiple IOCs use the argument \"advance_ioc\"."
    - name: scan_name
      description: Name of the new advanced threat hunt scan.
      defaultValue: PAXSOAR-1.6.0
    - name: advance_ioc
      description: "Json encoded Indicators Of Compromise to scan. Json keys signify the type of IOC and the corresponding list of values are the values of the IOC's. If provided, will ignore the ioc_type and ioc_value arguments.\n\nPossible keys to indicate type of indicator: \nINDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE\n\nFormat Accepted:\n{\n\"<ioc_type1>\": [\"<ioc_value1>\", \"<ioc_value2>\"],\n\"<ioc_type2>\": \"<ioc_value3>\"\n}\n\nExample:\n{\n\"INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME\": [\"C:\\\\Users\\\\Malware_Executible.ps1\", \"\\\\bin\\\\Malware_Executible\"],\n\"INDICATOR_OF_COMPROMISE_TYPE_HASH\": [\"e5c1b9c44be582f895eaea3d3738c5b4\", \"f541b9844be897f895eaea3d3738cfb2\"],\n\"INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE\": \"rule match_everything {condition:true}\"\n}."
    - name: max_matches_per_snapshot
      description: Maximum number of IOC matches allowed per snapshot.
    - name: start_date
      description: "Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.\n\nFor example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z."
    - name: end_date
      description: "Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.\n\nFor example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z."
    - name: max_snapshots_per_object
      description: Maximum number of snapshots to scan per object.
    - name: min_file_size
      description: Minimum size of the file in bytes that will be included in the scan.
    - name: max_file_size
      description: Maximum size of the file in bytes that will be included in the scan.
    - name: paths_to_include
      description: "Paths to include in the scan. Supports comma separated values.\n\nFormat accepted: \"path_to_include_1, path_to_include_2\"."
      isArray: true
    - name: paths_to_exclude
      description: "Paths to exclude from the scan. Supports comma separated values.\n\nFormat accepted: \"path_to_exclude_1, path_to_exclude_2\"."
      isArray: true
    - name: paths_to_exempt
      description: "Paths to exempt from exclusion. Supports comma separated values.\n\nFormat accepted: \"path_to_exempt_1, path_to_exempt_2\"."
      isArray: true
    outputs:
    - contextPath: RubrikPolaris.AdvanceIOCScan.huntId
      description: The ID of the new advance threat hunt.
      type: string
    - contextPath: RubrikPolaris.AdvanceIOCScan.huntName
      description: The name or label of the advanced threat hunt.
      type: string
    - contextPath: RubrikPolaris.AdvanceIOCScan.config.huntType
      description: The type of threat hunt configuration.
      type: string
    - contextPath: RubrikPolaris.AdvanceIOCScan.config.clusterUuids
      description: The list of cluster UUIDs included in the hunt config.
      type: unknown
    - contextPath: RubrikPolaris.AdvanceIOCScan.config.objectFids
      description: The list of object FIDs targeted by the hunt.
      type: unknown
    - contextPath: RubrikPolaris.AdvanceIOCScan.config.__typename
      description: The GraphQL typename for the HuntConfig object.
      type: string
    - contextPath: RubrikPolaris.AdvanceIOCScan.status
      description: The status of the threat hunt execution.
      type: string
    - contextPath: RubrikPolaris.AdvanceIOCScan.__typename
      description: The GraphQL typename for the HuntResponse object.
      type: string
  - arguments:
    - description: "The unique ID of the cluster.\n\nNote: Users can retrieve the list of the cluster IDs by executing the \"rubrik-gps-cluster-list\" command."
      name: cluster_id
      required: true
    - description: "The CDM snapshot ID.\n\nNote: Use the \"rubrik-radar-suspicious-file-list\" command to retrieve the actual CDM ID from the Anomaly ID.\nExample format to get the snapshot CDM ID from Anomaly ID: \"<Cluster-ID>:::VirtualMachine:::<Snappable-ID>:::<CDM-ID>\"."
      name: snapshot_id
      required: true
    - description: "The VM object ID (Snappable ID).\n\nNote: Users can retrieve the list of Snappable IDs by executing the \"rubrik-polaris-vm-objects-list\" command.\nExample format to get the Snappable ID: \"VirtualMachine:::<Snappable-ID>\"."
      name: object_id
      required: true
    - name: polling
      description: "Whether to poll for the command."
      required: false
      hidden: true
    description: Request for the analysis and directly download the anomaly CSV analyzed file.
    name: rubrik-anomaly-csv-analysis-v2
    polling: true
    outputs:
    - contextPath: RubrikPolaris.AnomalyCSVv2.clusterId
      description: The ID of the cluster.
      type: String
    - contextPath: RubrikPolaris.AnomalyCSVv2.snapshotId
      description: The ID of the snapshot.
      type: String
    - contextPath: RubrikPolaris.AnomalyCSVv2.objectId
      description: The ID of the object.
      type: String
    - contextPath: RubrikPolaris.AnomalyCSVv2.externalId
      description: The external ID of the CSV file.
      type: String
    - contextPath: RubrikPolaris.AnomalyCSVv2.isSuccessful
      description: Whether the CSV analysis was successful or not.
      type: Boolean
    - contextPath: InfoFile.Name
      description: FileName.
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report.
      type: string
    - contextPath: InfoFile.Size
      description: File Size.
      type: number
    - contextPath: InfoFile.Type
      description: File type e.g. "PE".
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file.
      type: string
  - name: rubrik-data-security-violation-list
    description: Retrieve the list of DSPM violations.
    arguments:
    - name: object_type
      description: "Filter the violations based on object types. Supports comma separated values.\n\nNote: Values not included in the options can be found in the documentation."
      auto: PREDEFINED
      predefined:
      - AWS_NATIVE_DYNAMODB_TABLE
      - AWS_NATIVE_EBS_VOLUME
      - AWS_NATIVE_RDS_INSTANCE
      - AWS_NATIVE_S3_BUCKET
      - AZURE_MANAGED_DISK
      - AZURE_SQL_DATABASE_DB
      - AZURE_SQL_MANAGED_INSTANCE_DB
      - AZURE_STORAGE_ACCOUNT
      - AZURE_VIRTUAL_MACHINE
      - GCP_NATIVE_DISK
      - GCP_NATIVE_GCE_INSTANCE
      - HYPERV_VIRTUAL_MACHINE
      - K8S_PROTECTION_SET
      - K8S_VIRTUAL_MACHINE
      - LINUX_FILESET
      - NAS_FILESET
      - NUTANIX_VIRTUAL_MACHINE
      - O365_ONEDRIVE
      - O365_SITE
      - ORACLE_DATA_GUARD_GROUP
      - ORACLE_DATABASE
      - SHARE_FILESET
      - VOLUME_GROUP
      - VSPHERE_VIRTUAL_MACHINE
      - WINDOWS_FILESET
      isArray: true
    - name: detection_start_date
      description: "Filter the violations detected after this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: detection_start_date and detection_end_date both or none of them should be initialized."
    - name: detection_end_date
      description: "Filter the violations detected before this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: detection_start_date and detection_end_date both or none of them should be initialized."
    - name: resolved_start_date
      description: "Filter the violations resolved after this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: resolved_start_date and resolved_end_date both or none of them should be initialized."
    - name: resolved_end_date
      description: "Filter the violations resolved before this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: resolved_start_date and resolved_end_date both or none of them should be initialized."
    - name: category
      description: "Filter the violations by category. Supports comma separated values."
      auto: PREDEFINED
      predefined:
      - CATEGORY_UNSPECIFIED
      - MISPLACED
      - REDUNDANT
      - OVEREXPOSED
      - UNPROTECTED
      isArray: true
    - name: status
      description: "Filter the violations by status. Supports comma separated values."
      auto: PREDEFINED
      predefined:
      - OPEN
      - IN_PROGRESS
      - REMEDIATED
      - DISMISSED
      - CLOSED
      isArray: true
    - name: severity
      description: "Filter the violations by severity level. Supports comma separated values."
      auto: PREDEFINED
      predefined:
      - SEVERITY_UNSPECIFIED
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      isArray: true
    - name: sensitivity
      description: "Filter the violations by sensitivity level. Supports comma separated values."
      auto: PREDEFINED
      predefined:
      - HIGH
      - MEDIUM
      - LOW
      - NO
      isArray: true
    - name: limit
      defaultValue: "50"
      description: "Number of results to retrieve in the response. The maximum allowed size is 1000."
    - name: next_page_token
      description: "The next page cursor to retrieve the next set of results."
    - name: sort_by
      defaultValue: "DETECTION_TIME"
      description: "Specify the field to use for sorting the response."
      auto: PREDEFINED
      predefined:
      - SEVERITY
      - HITS
      - DETECTION_TIME
      - UPDATE_TIME
      - IDENTITY_TYPE
      - FILES_AT_RISK
      - TOTAL_HITS
      - ACCESSIBLE_OBJECTS
      - ORIGIN
      - EVENT_TIME
      - NAME
      - TYPE
    - name: sort_order
      defaultValue: "DESC"
      description: "Specify the order to sort the data in."
      auto: PREDEFINED
      predefined:
      - ASC
      - DESC
    outputs:
    - contextPath: RubrikPolaris.DSPMViolation.policyViolationId
      description: The unique identifier for the policy violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.status
      description: The current status of the policy violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.__typename
      description: The GraphQL typename for the violation object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.createdAt
      description: The date and time when the policy violation was created.
      type: Date
    - contextPath: RubrikPolaris.DSPMViolation.lastUpdatedAt
      description: The date and time when the policy violation was last updated.
      type: Date
    - contextPath: RubrikPolaris.DSPMViolation.policy.policyId
      description: The unique identifier of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.name
      description: The name of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.policySeverity
      description: The severity level assigned to the policy.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.__typename
      description: The GraphQL typename for the policy object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceId
      description: The unique identifier of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceType
      description: The type of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.name
      description: The name of the resource where the violation occurred.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.objectType
      description: The object type of the resource.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.platform
      description: The platform of the resource.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.physicalHost
      description: The physical host where the resource resides.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.accountName
      description: The name of the associated cloud account.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.__typename
      description: The GraphQL typename for the cloud account info object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.__typename
      description: The GraphQL typename for the resource metadata details object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.__typename
      description: The GraphQL typename for the resource metadata object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataCategories.id
      description: The ID of the data category.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataCategories.name
      description: The name of the data category.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataCategories.totalViolatedHits
      description: The total violated hits of the data category.
      type: Integer
    - contextPath: RubrikPolaris.DSPMViolation.details.dataCategories.__typename
      description: The type name of the data category.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataTypes.id
      description: The ID of the data type.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataTypes.name
      description: The name of the data type.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataTypes.totalViolatedHits
      description: The total violated hits of the data type.
      type: Integer
    - contextPath: RubrikPolaris.DSPMViolation.details.dataTypes.__typename
      description: The type name of the data type.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedNoRiskSensitiveHits
      description: The number of no-risk sensitive hits involved in the violation.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedLowRiskSensitiveHits
      description: The number of low-risk sensitive hits involved in the violation.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedMediumRiskSensitiveHits
      description: The number of medium-risk sensitive hits involved in the violation.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedHighRiskSensitiveHits
      description: The number of high-risk sensitive hits involved in the violation.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.snapshotId
      description: The ID of the snapshot associated with the violation details.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.__typename
      description: The GraphQL typename for the violation details object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.remediations.type
      description: The type of the remediation action.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.remediations.state
      description: The state of the remediation action.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.remediations.remediationDetails
      description: Detailed information about the remediation action.
      type: Unknown
    - contextPath: RubrikPolaris.DSPMViolation.remediations.__typename
      description: The GraphQL typename for the remediation object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.remediations
      description: The list of remediations associated with the violation.
      type: Unknown
    - contextPath: RubrikPolaris.PageToken.DSPMViolation.next_page_token
      description: Next page token.
      type: String
    - contextPath: RubrikPolaris.PageToken.DSPMViolation.name
      description: Name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.DSPMViolation.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
  - arguments:
    - description: "The ID of the DSPM violation.\n\nNote: Users can get the violation ID by executing the \"rubrik-data-security-violation-list\" command."
      name: violation_id
      required: true
    description: Retrieve the details of DSPM violation based on the provided violation ID.
    name: rubrik-data-security-violation-get
    outputs:
    - contextPath: RubrikPolaris.DSPMViolation.policyViolationId
      description: The unique identifier for the policy violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.status
      description: The current status of the policy violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.__typename
      description: The GraphQL typename for the violation object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.createdAt
      description: The date and time when the policy violation was created.
      type: Date
    - contextPath: RubrikPolaris.DSPMViolation.lastUpdatedAt
      description: The date and time when the policy violation was last updated.
      type: Date
    - contextPath: RubrikPolaris.DSPMViolation.policy.policyId
      description: The unique identifier of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.name
      description: The name of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.policySeverity
      description: The severity level assigned to the policy.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.__typename
      description: The GraphQL typename for the policy object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceId
      description: The unique identifier of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.name
      description: The name of the resource where the violation occurred.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.objectType
      description: The object type of the resource.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.platform
      description: The platform of the resource.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.physicalHost
      description: The physical host where the resource resides.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.accountName
      description: The name of the associated cloud account.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.__typename
      description: The GraphQL typename for the cloud account info object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.__typename
      description: The GraphQL typename for the resource metadata details object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.clusterName
      description: The name of the cluster.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.clusterUuid
      description: The UUID of the cluster.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.__typename
      description: The GraphQL typename for the cluster info object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.creationTime
      description: The creation time of the metadata.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.lastAccessTime
      description: The last access time of the metadata.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.snapshotTimestamp
      description: The snapshot timestamp.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.isDeleted
      description: Whether the resource is deleted.
      type: Boolean
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.metadata.region
      description: The region of the resource.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.resourceMetadata.__typename
      description: The GraphQL typename for the resource metadata object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedNoRiskSensitiveHits
      description: The number of no-risk sensitive hits involved in the violation.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedLowRiskSensitiveHits
      description: The number of low-risk sensitive hits involved in the violation.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedMediumRiskSensitiveHits
      description: The number of medium-risk sensitive hits involved in the violation.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedHighRiskSensitiveHits
      description: The number of high-risk sensitive hits involved in the violation.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.violatedSensitiveHits
      description: The total number of violated sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.dataTypes.id
      description: The ID of the data type.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataTypes.name
      description: The name of the data type.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataTypes.totalViolatedHits
      description: The total violated hits for the data type.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.dataTypes.__typename
      description: The GraphQL typename for the data type stats.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.mipLabels
      description: The MIP labels associated with the details.
      type: Unknown
    - contextPath: RubrikPolaris.DSPMViolation.details.documentTypes
      description: The document types associated with the details.
      type: Unknown
    - contextPath: RubrikPolaris.DSPMViolation.details.dataCategories.id
      description: The ID of the data category.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataCategories.name
      description: The name of the data category.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.dataCategories.totalViolatedHits
      description: The total violated hits for the data category.
      type: Number
    - contextPath: RubrikPolaris.DSPMViolation.details.dataCategories.__typename
      description: The GraphQL typename for the data category stats.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.snapshotId
      description: The ID of the snapshot associated with the violation details.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.details.__typename
      description: The GraphQL typename for the violation details object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.description
      description: The description of the policy.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.policyCategory
      description: The category of the policy.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.policy.containsAccessFilters
      description: Whether the policy contains access filters.
      type: Boolean
    - contextPath: RubrikPolaris.DSPMViolation.remediations.state
      description: The state of the remediation action.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.remediations.remediationId
      description: The ID of the remediation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.remediations.remediationDetails
      description: Detailed information about the remediation action.
      type: Unknown
    - contextPath: RubrikPolaris.DSPMViolation.remediations.__typename
      description: The GraphQL typename for the remediation object.
      type: String
  - name: rubrik-data-security-violation-status-update
    description: Updates the status of the DSPM violation.
    arguments:
    - name: violation_id
      description: "The ID of the DSPM violation.\n\nNote: Users can get the violation ID by executing the \"rubrik-data-security-violation-list\" command."
      required: true
    - name: status
      description: The status to update for violation.
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - IN_PROGRESS
      - REMEDIATED
      - DISMISSED
      - CLOSED
    outputs:
    - contextPath: RubrikPolaris.DSPMViolation.policyViolationId
      description: The ID of the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolation.status
      description: The status of the violation.
      type: String
  - name: rubrik-data-security-violation-file-list
    description: Retrieve the file information of data security violation based on the provided violation ID.
    arguments:
    - name: violation_id
      description: "The ID of the DSPM violation.\n\nNote: Users can get the violation ID by executing the \"rubrik-data-security-violation-list\" command."
      required: true
    - name: snapshot_id
      description: "The snapshot ID.\n\nNote: Users can get the snapshot ID by executing the \"rubrik-polaris-object-snapshot-list\" command."
      required: true
    - name: object_id
      description: "The object ID.\n\nNote: Users can get the Object ID by executing the \"rubrik-polaris-objects-list\" command."
      required: true
    - name: limit
      description: Number of results to retrieve in the response. The maximum allowed size is 1000.
      defaultValue: 25
      required: false
    - name: next_page_token
      description: The next page cursor to retrieve the next set of results.
      required: false
    - name: file_name
      description: Filter files by their name.
      required: false
    - name: last_access_start_date
      description: "Filter files with last access after this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: last_access_start_date and last_access_end_date both or none of them should be initialized."
      required: false
    - name: last_access_end_date
      description: "Filter files with last access before this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: last_access_start_date and last_access_end_date both or none of them should be initialized."
      required: false
    - name: last_modified_start_date
      description: "Filter files with last modified after this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: last_modified_start_date and last_modified_end_date both or none of them should be initialized."
      required: false
    - name: last_modified_end_date
      description: "Filter files with last modified before this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: last_modified_start_date and last_modified_end_date both or none of them should be initialized."
      required: false
    - name: creation_start_date
      description: "Filter files created after this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: creation_date_start_date and creation_date_start_date both or none of them should be initialized."
      required: false
    - name: creation_end_date
      description: "Filter files created before this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: creation_date_start_date and creation_date_start_date both or none of them should be initialized."
      required: false
    - name: last_scan_start_date
      description: "Filter files with last scan after this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: last_scan_start_date and last_scan_end_date both or none of them should be initialized."
      required: false
    - name: last_scan_end_date
      description: "Filter files with last scan before this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: last_scan_start_date and last_scan_end_date both or none of them should be initialized."
      required: false
    - name: sensitivity
      description: Filter files by sensitivity level. Supports comma separated values.
      auto: PREDEFINED
      isArray: true
      predefined:
      - HIGH
      - MEDIUM
      - LOW
      - NO
      required: false
    - name: exposure
      description: Filter files by exposure type. Supports comma separated values.
      auto: PREDEFINED
      isArray: true
      predefined:
      - EXPLICIT
      - INHERITED
      - NOT_OPEN
      - PUBLIC
      required: false
    - name: access_via
      description: Filter files by access type.
      auto: PREDEFINED
      defaultValue: ACCESS_TYPE_UNSPECIFIED
      predefined:
      - ACCESS_TYPE_UNSPECIFIED
      - DIRECT
      - GROUP
      - ROLE
      required: false
    - name: sort_order
      description: Specify the order to sort the data in.
      auto: PREDEFINED
      defaultValue: DESC
      predefined:
      - ASC
      - DESC
      required: false
    - name: sort_by
      description: Specify the field to use for sorting the response.
      defaultValue: HITS
      auto: PREDEFINED
      predefined:
      - CLUSTER
      - CREATION_TIME
      - DAILY_CHANGE
      - DATA_CATEGORY
      - DATA_TYPE
      - DOCUMENT_TYPE
      - EXPOSED_FILES
      - FILES_WITH_HITS
      - FILES_WITH_OPEN_ACCESS_HITS
      - HITS
      - HITS_BY_SENSITIVITY
      - LAST_ACCESS_TIME
      - LAST_MODIFIED
      - LAST_SCAN_TIME
      - NAME
      - NATIVE_PATH
      - NUM_ACTIVITIES
      - NUM_ACTIVITIES_DELTA
      - OBJECT_LOCATION
      - OBJECT_NAME
      - OPEN_ACCESS_TYPE
      - SNAPSHOT_TIME
      - STALE_FILES_WITH_HITS
      - TOTAL_SENSITIVE_HITS
      required: false
    outputs:
    - contextPath: Rubrik.DSPMViolationFile.nativePath
      description: The native path of the file.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.stdPath
      description: The standardized path of the file.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.filename
      description: The name of the file.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.mode
      description: The file mode.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.size
      description: The file size in bytes.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.lastAccessTime
      description: The last access time of the file.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.lastModifiedTime
      description: The last modified time of the file.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.creationTime
      description: The creation time of the file.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.lastScanTime
      description: The last scan time of the file.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.directory
      description: The directory of the file.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.createdBy
      description: The user who created the file.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.modifiedBy
      description: The user who last modified the file.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.numDescendantFiles
      description: The number of descendant files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.numDescendantErrorFiles
      description: The number of descendant files with errors.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.numDescendantSkippedExtFiles
      description: The number of descendant files skipped due to extension.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.numDescendantSkippedSizeFiles
      description: The number of descendant files skipped due to size.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.errorCode
      description: The error code.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.hits.totalHits
      description: The total number of hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.hits.violations
      description: The number of violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.hits.violationsDelta
      description: The change in the number of violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.hits.totalHitsDelta
      description: The change in the total number of hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.hits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.filesWithHits.totalHits
      description: The total number of hits in files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.filesWithHits.violations
      description: The number of violations in files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.filesWithHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.openAccessFilesWithHits.totalHits
      description: The total number of hits in open access files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.openAccessFilesWithHits.violations
      description: The number of violations in open access files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.openAccessFilesWithHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.staleFilesWithHits.totalHits
      description: The total number of hits in stale files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.staleFilesWithHits.violations
      description: The number of violations in stale files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.staleFilesWithHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.groupType
      description: The type of the analyzer group.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.id
      description: The ID of the analyzer group.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.name
      description: The name of the analyzer group.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.totalHits
      description: The total number of hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.violations
      description: The number of violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.id
      description: The ID of the analyzer.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.name
      description: The name of the analyzer.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.analyzerType
      description: The type of the analyzer.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.hits.totalHits
      description: The total number of hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.hits.violations
      description: The number of violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.hits.violationsDelta
      description: The change in the number of violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.hits.totalHitsDelta
      description: The change in the total number of hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.hits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerGroupResults.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.totalCount
      description: The total count of high risk files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.violatedCount
      description: The count of high risk files with violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.totalCount
      description: The total count of medium risk files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.violatedCount
      description: The count of medium risk files with violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.totalCount
      description: The total count of low risk files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.violatedCount
      description: The count of low risk files with violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.noRiskFileCount
      description: The count of files with no risk.
      type: Unknown
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.totalCount
      description: The total count of files.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.violatedCount
      description: The count of files with violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveFiles.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.totalHits
      description: The total number of high risk hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.violatedHits
      description: The number of violated high risk hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.totalHits
      description: The total number of medium risk hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.violatedHits
      description: The number of violated medium risk hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.totalHits
      description: The total number of low risk hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.violatedHits
      description: The number of violated low risk hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.totalHits
      description: The total number of no risk hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.violatedHits
      description: The number of violated no risk hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.sensitiveHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.totalHits
      description: The total number of high risk analyzer hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.violatedHits
      description: The number of violated high risk analyzer hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.totalHits
      description: The total number of medium risk analyzer hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.violatedHits
      description: The number of violated medium risk analyzer hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.totalHits
      description: The total number of low risk analyzer hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.violatedHits
      description: The number of violated low risk analyzer hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.totalHits
      description: The total number of no risk analyzer hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.violatedHits
      description: The number of violated no risk analyzer hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerRiskHits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerResults.hits.totalHits
      description: The total number of hits.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerResults.hits.violations
      description: The number of violations.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.analyzerResults.hits.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerResults.analyzer.id
      description: The ID of the analyzer.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerResults.analyzer.name
      description: The name of the analyzer.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerResults.analyzer.analyzerType
      description: The type of the analyzer.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerResults.analyzer.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.analyzerResults.__typename
      description: The GraphQL type name.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.openAccessType
      description: The open access type.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.stalenessType
      description: The staleness type.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.numActivities
      description: The number of activities.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.numActivitiesDelta
      description: The change in the number of activities.
      type: Number
    - contextPath: Rubrik.DSPMViolationFile.exposureSummary
      description: The exposure summary.
      type: Unknown
    - contextPath: Rubrik.DSPMViolationFile.dbEntityType
      description: The database entity type.
      type: String
    - contextPath: Rubrik.DSPMViolationFile.mipLabelsSummary
      description: The MIP labels summary.
      type: Unknown
    - contextPath: Rubrik.DSPMViolationFile.documentTypesSummary
      description: The document types summary.
      type: Unknown
    - contextPath: Rubrik.DSPMViolationFile.__typename
      description: The GraphQL type name.
      type: String
  - name: rubrik-data-security-violation-csv-download
    description: Download all files at risk as CSV file for the specified data security violation.
    arguments:
    - name: violation_id
      description: "The ID of the DSPM violation.\n\nNote: Users can get the violation ID by executing the \"rubrik-data-security-violation-list\" command."
      required: true
    - name: snapshot_id
      description: "The snapshot ID.\n\nNote: Users can retrieve the snapshot ID by executing the \"rubrik-polaris-object-snapshot-list\" command."
      required: true
    - name: object_id
      description: "The object ID.\n\nNote: Users can retrieve the object ID by executing the \"rubrik-polaris-objects-list\" command."
      required: true
    - name: object_name
      description: "The object Name.\n\nNote: If not specified command will retrieve it using the \"rubrik-data-security-violation-get\" command."
    - name: polling
      description: "Whether to poll for the command."
      required: false
      hidden: true
    polling: true
    outputs:
    - contextPath: RubrikPolaris.DSPMViolationCSVDownload.violationId
      description: The ID of the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationCSVDownload.snapshotId
      description: The ID of the snapshot.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationCSVDownload.objectId
      description: The ID of the object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationCSVDownload.objectName
      description: The Name of the object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationCSVDownload.externalId
      description: The external ID of the CSV file.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationCSVDownload.isSuccessful
      description: Whether the CSV analysis was successful or not.
      type: Boolean
    - contextPath: InfoFile.Name
      description: FileName.
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report.
      type: string
    - contextPath: InfoFile.Size
      description: File Size.
      type: number
    - contextPath: InfoFile.Type
      description: File type e.g. "PE".
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file.
      type: string
  - name: rubrik-data-security-violation-log-download
    description: Download remediation logs as CSV file for the specified data security violation.
    arguments:
    - name: violation_id
      description: "The ID of the DSPM violation.\n\nNote: Users can get the violation ID by executing the \"rubrik-data-security-violation-list\" command."
      required: true
    - name: object_id
      description: "The object ID.\n\nNote: Users can retrieve the object ID by executing the \"rubrik-polaris-objects-list\" command."
      required: true
    - name: object_name
      description: "The object Name.\n\nNote: If not specified command will retrieve it using the \"rubrik-data-security-violation-get\" command."
    - name: polling
      description: "Whether to poll for the command."
      required: false
      hidden: true
    polling: true
    outputs:
    - contextPath: RubrikPolaris.DSPMViolationRemediationLogDownload.violationId
      description: The ID of the violation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationRemediationLogDownload.objectId
      description: The ID of the object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationRemediationLogDownload.remediationId
      description: The ID of the remediation.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationRemediationLogDownload.objectName
      description: The Name of the object.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationRemediationLogDownload.externalId
      description: The external ID of the file.
      type: String
    - contextPath: RubrikPolaris.DSPMViolationRemediationLogDownload.isSuccessful
      description: Whether the command was successful or not.
      type: Boolean
    - contextPath: InfoFile.Name
      description: FileName.
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report.
      type: string
    - contextPath: InfoFile.Size
      description: File Size.
      type: number
    - contextPath: InfoFile.Type
      description: File type e.g. "PE".
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file.
      type: string
  - name: rubrik-identity-resilience-violation-list
    description: Retrieves the list of Identity Resilience (IR) violations.
    arguments:
    - name: policy_type
      description: Filter the violations by policy type. Supports comma separated values.
      auto: PREDEFINED
      predefined:
      - IDENTITY
      - IDP
      - IDENTITY_EVENT
      - CROWDSTRIKE
      - MICROSOFT_DEFENDER
      isArray: true
    - name: detection_start_date
      description: "Filter the violations detected after this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: detection_start_date and detection_end_date both or none of them should be initialized."
    - name: detection_end_date
      description: "Filter the violations detected before this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: detection_start_date and detection_end_date both or none of them should be initialized."
    - name: resolved_start_date
      description: "Filter the violations resolved after this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: resolved_start_date and resolved_end_date both or none of them should be initialized."
    - name: resolved_end_date
      description: "Filter the violations resolved before this date.\n\nFormats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z.\n\nNote: resolved_start_date and resolved_end_date both or none of them should be initialized."
    - name: category
      description: Filter the violations by category. Supports comma separated values.
      auto: PREDEFINED
      predefined:
      - CATEGORY_UNSPECIFIED
      - AUTHENTICATION_AND_SECRET_MANAGEMENT
      - IDENTITY_HYGIENE
      - EXCESSIVE_IDENTITY_RIGHTS
      - IDENTITY_PROVIDER_SECURITY
      - PRIVILEGED_ACCOUNT_RISK
      - IDENTITY_RISK
      - INFRASTRUCTURE_SECURITY
      - CONFIGURATION_SECURITY
      - MEMBERSHIP_CHANGE
      - GPO_CHANGE
      isArray: true
    - name: status
      description: Filter the violations by status. Supports comma separated values.
      auto: PREDEFINED
      predefined:
      - OPEN
      - IN_PROGRESS
      - REMEDIATED
      - DISMISSED
      - CLOSED
      isArray: true
    - name: severity
      description: Filter the violations by severity level. Supports comma separated values.
      auto: PREDEFINED
      predefined:
      - SEVERITY_UNSPECIFIED
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      isArray: true
    - name: identity_provider
      description: Filter the violations by identity provider type. Supports comma separated values.
      auto: PREDEFINED
      predefined:
      - IDP_UNSPECIFIED
      - ON_PREM_AD
      - ENTRA_ID
      - AWS
      - LOCAL_AD
      - SHAREPOINT
      - SYSTEM
      - OKTA
      isArray: true
    - name: identity_tag
      description: Filter the violations by identity tag. Supports comma separated values.
      auto: PREDEFINED
      predefined:
      - IDENTITY_TAG_UNSPECIFIED
      - PRIVILEGED
      - AT_RISK
      - SENSITIVE
      isArray: true
    - name: limit
      defaultValue: "50"
      description: Number of results to retrieve in the response. The maximum allowed size is 1000.
    - name: next_page_token
      description: The next page cursor to retrieve the next set of results.
    - name: sort_by
      description: Specify the field to use for sorting the response.
      defaultValue: DETECTION_TIME
      auto: PREDEFINED
      predefined:
      - SEVERITY
      - HITS
      - DETECTION_TIME
      - UPDATE_TIME
      - IDENTITY_TYPE
      - TOTAL_HITS
      - EVENT_TIME
      - NAME
      - TYPE
    - name: sort_order
      defaultValue: DESC
      description: Specify the order to sort the data in.
      auto: PREDEFINED
      predefined:
      - ASC
      - DESC
    outputs:
    - contextPath: RubrikPolaris.IRViolation.policyViolationId
      description: The unique identifier for the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.name
      description: The name of the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.violationSeverity
      description: The severity level of the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.status
      description: The current status of the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.createdAt
      description: The date and time when the policy violation was created.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.lastUpdatedAt
      description: The date and time when the policy violation was last updated.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.resourceId
      description: The unique identifier of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceType
      description: The type of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.policyId
      description: The unique identifier of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.name
      description: The name of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.description
      description: The description of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.policySeverity
      description: The severity level assigned to the policy.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.policyCategory
      description: The category of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.policyType
      description: The type of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.frameworks
      description: The compliance frameworks associated with the policy.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.manualRemediationProcess
      description: The manual remediation process recommended for the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.details.domainUniqueId
      description: The unique identifier of the domain associated with the violation details.
      type: String
    - contextPath: RubrikPolaris.IRViolation.details.detectionTime
      description: The time at which the threat was detected.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.details.startTime
      description: The start time of the alert event.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.details.endTime
      description: The end time of the alert event.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.details.mitreTactic
      description: The MITRE ATT&CK tactic associated with the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.displayName
      description: The display name of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.domainName
      description: The domain name of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.domainUniqueId
      description: The unique identifier of the domain of the resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.idpType
      description: The identity provider type of the resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.principalType
      description: The principal type of the identity resource (e.g. USER, COMPUTER).
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.privilegeType
      description: The privilege type of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.userPrincipalName
      description: The user principal name of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.status
      description: The status of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.title
      description: The job title of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.source
      description: The source of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.identityTags
      description: The list of tags associated with the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.uniqueId
      description: The unique identifier of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.nativeType
      description: The native type of the identity resource (e.g. User).
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainName
      description: The root domain name of the resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainId
      description: The unique identifier of the root domain of the resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityId
      description: The unique identifier of the actor identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityName
      description: The name of the actor identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityType
      description: The type of the actor identity involved in the alert (e.g. USER).
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorPrivilegeType
      description: The privilege type of the actor identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorState
      description: The state of the actor identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.entityName
      description: The name of the entity associated with the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.entityId
      description: The unique identifier of the entity associated with the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityUniqueIdentifier
      description: The unique identifier of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityName
      description: The name of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentitySource
      description: The source domain of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityStatus
      description: The status of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityType
      description: The type of the target identity involved in the alert (e.g. COMPUTER).
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdpType
      description: The identity provider type of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetPrivilegeType
      description: The privilege type of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.eventTime
      description: The time at which the identity event occurred.
      type: Date
    - contextPath: RubrikPolaris.PageToken.IRViolation.next_page_token
      description: The next page token.
      type: String
    - contextPath: RubrikPolaris.PageToken.IRViolation.name
      description: The name of the command.
      type: String
    - contextPath: RubrikPolaris.PageToken.IRViolation.has_next_page
      description: Whether the result has the next page or not.
      type: Boolean
  - arguments:
    - description: "The ID of the IR violation.\n\nNote: Users can get the violation ID by executing the \"rubrik-identity-resilience-violation-list\" command."
      name: violation_id
      required: true
    - description: "The policy type of the IR violation.\n\nNote: Users can get the policy type by executing the \"rubrik-identity-resilience-violation-list\" command."
      name: policy_type
      required: false
      auto: PREDEFINED
      predefined:
      - IDENTITY
      - IDP
      - IDENTITY_EVENT
      - CROWDSTRIKE
      - MICROSOFT_DEFENDER
    description: Retrieves the details of the Identity Resilience (IR) violation based on the provided violation ID.
    name: rubrik-identity-resilience-violation-get
    outputs:
    - contextPath: RubrikPolaris.IRViolation.policyViolationId
      description: The unique identifier for the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.name
      description: The name of the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.violationSeverity
      description: The severity level of the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.status
      description: The current status of the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.createdAt
      description: The date and time when the policy violation was created.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.lastUpdatedAt
      description: The date and time when the policy violation was last updated.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.resourceId
      description: The unique identifier of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceType
      description: The type of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.policyId
      description: The unique identifier of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.name
      description: The name of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.description
      description: The description of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.policySeverity
      description: The severity level assigned to the policy.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.policyCategory
      description: The category of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.policyType
      description: The type of the policy associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.frameworks
      description: The compliance frameworks associated with the policy.
      type: String
    - contextPath: RubrikPolaris.IRViolation.policy.manualRemediationProcess
      description: The manual remediation process recommended for the policy violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.details.domainUniqueId
      description: The unique identifier of the domain associated with the violation details.
      type: String
    - contextPath: RubrikPolaris.IRViolation.details.detectionTime
      description: The time at which the threat was detected.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.details.startTime
      description: The start time of the alert event.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.details.endTime
      description: The end time of the alert event.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.details.mitreTactic
      description: The MITRE ATT&CK tactic associated with the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.displayName
      description: The display name of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.domainName
      description: The domain name of the resource associated with the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.domainUniqueId
      description: The unique identifier of the domain of the resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.idpType
      description: The identity provider type of the resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.principalType
      description: The principal type of the identity resource (e.g. USER, COMPUTER).
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.privilegeType
      description: The privilege type of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.userPrincipalName
      description: The user principal name of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.status
      description: The status of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.title
      description: The job title of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.source
      description: The source of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.identityTags
      description: The list of tags associated with the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.uniqueId
      description: The unique identifier of the identity resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.nativeType
      description: The native type of the identity resource (e.g. User).
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainName
      description: The root domain name of the resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainId
      description: The unique identifier of the root domain of the resource.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityId
      description: The unique identifier of the actor identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityName
      description: The name of the actor identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityType
      description: The type of the actor identity involved in the alert (e.g. USER).
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorPrivilegeType
      description: The privilege type of the actor identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.actorState
      description: The state of the actor identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.entityName
      description: The name of the entity associated with the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.entityId
      description: The unique identifier of the entity associated with the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityUniqueIdentifier
      description: The unique identifier of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityName
      description: The name of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentitySource
      description: The source domain of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityStatus
      description: The status of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityType
      description: The type of the target identity involved in the alert (e.g. COMPUTER).
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdpType
      description: The identity provider type of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.targetPrivilegeType
      description: The privilege type of the target identity involved in the alert.
      type: String
    - contextPath: RubrikPolaris.IRViolation.resourceMetadata.metadata.eventTime
      description: The time at which the identity event occurred.
      type: Date
    - contextPath: RubrikPolaris.IRViolation.sensitiveHits.highRiskHits.violatedHits
      description: The number of high risk sensitive hits violated by the identity.
      type: Number
    - contextPath: RubrikPolaris.IRViolation.sensitiveHits.mediumRiskHits.violatedHits
      description: The number of medium risk sensitive hits violated by the identity.
      type: Number
    - contextPath: RubrikPolaris.IRViolation.sensitiveHits.lowRiskHits.violatedHits
      description: The number of low risk sensitive hits violated by the identity.
      type: Number
    - contextPath: RubrikPolaris.IRViolation.sensitiveHits.noRiskHits.violatedHits
      description: The number of no risk sensitive hits violated by the identity.
      type: Number
    - contextPath: RubrikPolaris.IRViolation.sensitiveHits.totalHits.violatedHits
      description: The total number of sensitive hits violated by the identity.
      type: Number
    - contextPath: RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryName
      description: The name of the data category associated with the sensitive hits.
      type: String
    - contextPath: RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryHits.dataCategoryId
      description: The unique identifier of the data category.
      type: String
    - contextPath: RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryHits.totalViolatedHits
      description: The total number of violated hits for the data category.
      type: Number
  - name: rubrik-identity-resilience-violation-status-update
    description: Updates the status of the Identity Resilience (IR) violation.
    arguments:
    - name: violation_id
      description: "The ID of the IR violation.\n\nNote: Users can get the violation ID by executing the \"rubrik-identity-resilience-violation-list\" command."
      required: true
    - name: status
      description: The status to update for the violation.
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - IN_PROGRESS
      - REMEDIATED
      - DISMISSED
      - CLOSED
    outputs:
    - contextPath: RubrikPolaris.IRViolation.policyViolationId
      description: The ID of the violation.
      type: String
    - contextPath: RubrikPolaris.IRViolation.status
      description: The status of the violation.
      type: String
  - name: rubrik-sensitive-data-object-get
    arguments:
    - description: "The ID of the object (snappable FID).\n\nNote: Users can get the object ID by executing the \"rubrik-polaris-object-list\" command."
      name: object_id
      required: true
    - description: "The Snapshot ID of the object.\n\nNote: Users can get the snapshot ID by executing the \"rubrik-polaris-object-snapshot-list\" command."
      name: snapshot_id
      required: true
    - auto: PREDEFINED
      defaultValue: "False"
      description: "The boolean indicates to include the whitelisted results."
      name: include_whitelisted_results
      predefined:
      - "True"
      - "False"
    description: Retrieve the details of the object based on the provided object ID and snapshot ID.
    outputs:
    - contextPath: RubrikPolaris.SensitiveDataObject.id
      description: The ID of the sensitive data object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snapshotFid
      description: The FID of the snapshot associated with the object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snapshotTimestamp
      description: The timestamp of the snapshot.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.shareType
      description: The share type of the object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.riskLevel
      description: The risk level of the object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.osType
      description: The OS type of the object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.isUserAccessEnabledObject
      description: Whether user access is enabled for the object.
      type: Boolean
    - contextPath: RubrikPolaris.SensitiveDataObject.__typename
      description: The GraphQL type name of the sensitive data object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.snapshotTime
      description: The time of the latest snapshot result.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.snapshotFid
      description: The FID of the latest snapshot result.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.objectStatus.policyStatuses.status
      description: The status of the policy for the object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.objectStatus.__typename
      description: The GraphQL type name of the object status.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.__typename
      description: The GraphQL type name of the latest snapshot result.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.hits.totalHits
      description: The total number of sensitive data hits in the object.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.hits.violations
      description: The total number of violations in the object.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.hits.violationsDelta
      description: The change in violations since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.hits.totalHitsDelta
      description: The change in total hits since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.__typename
      description: The GraphQL type name of the root file result.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.hits.__typename
      description: The GraphQL type name of the root file result hits.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.groupType
      description: The type of the analyzer group.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.id
      description: The ID of the analyzer group.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.name
      description: The name of the analyzer group.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.totalHits
      description: The total hits for the analyzer group.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.violations
      description: The violations for the analyzer group.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.violationsDelta
      description: The change in violations for the analyzer group since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.totalHitsDelta
      description: The change in total hits for the analyzer group since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.__typename
      description: The GraphQL type name of the analyzer group result.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.__typename
      description: The GraphQL type name of the analyzer group.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.__typename
      description: The GraphQL type name of the analyzer group hits.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.analyzer.id
      description: The ID of the analyzer.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.analyzer.name
      description: The name of the analyzer.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.totalHits
      description: The total hits for the analyzer.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.violations
      description: The violations for the analyzer.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.violationsDelta
      description: The change in violations for the analyzer since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.totalHitsDelta
      description: The change in total hits for the analyzer since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.__typename
      description: The GraphQL type name of the analyzer result hits.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.totalHits
      description: The total number of files with sensitive data hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.violations
      description: The number of files with violations.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.violationsDelta
      description: The change in files with violations since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.totalHitsDelta
      description: The change in files with hits since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.__typename
      description: The GraphQL type name of the files with hits.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.totalHits
      description: The total number of open-access files.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.violations
      description: The number of open-access files with violations.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.violationsDelta
      description: The change in open-access files with violations since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.totalHitsDelta
      description: The change in open-access files hits since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.__typename
      description: The GraphQL type name of the open access files.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.totalHits
      description: The total number of open-access folders.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.violations
      description: The number of open-access folders with violations.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.violationsDelta
      description: The change in open-access folders with violations since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.totalHitsDelta
      description: The change in open-access folders hits since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.__typename
      description: The GraphQL type name of the open access folders.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.totalHits
      description: The total number of open-access files with sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.violations
      description: The number of open-access files with hits and violations.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.violationsDelta
      description: The change in open-access files with hits violations since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.totalHitsDelta
      description: The change in open-access files with hits since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.__typename
      description: The GraphQL type name of the open access files with hits.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.totalHits
      description: The total number of stale files.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.violations
      description: The number of stale files with violations.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.violationsDelta
      description: The change in stale files with violations since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.totalHitsDelta
      description: The change in stale files hits since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.__typename
      description: The GraphQL type name of the stale files.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.totalHits
      description: The total number of stale files with sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.violations
      description: The number of stale files with hits and violations.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.violationsDelta
      description: The change in stale files with hits violations since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.totalHitsDelta
      description: The change in stale files with hits since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.__typename
      description: The GraphQL type name of the stale files with hits.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.totalHits
      description: The total number of open-access stale files.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.violations
      description: The number of open-access stale files with violations.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.violationsDelta
      description: The change in open-access stale files with violations since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.totalHitsDelta
      description: The change in open-access stale files hits since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.__typename
      description: The GraphQL type name of the open access stale files.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.totalHits
      description: The total high risk sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.violatedHits
      description: The violated high risk sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.__typename
      description: The GraphQL type name of the high risk hits summary.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.totalHits
      description: The total medium risk sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.violatedHits
      description: The violated medium risk sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.__typename
      description: The GraphQL type name of the medium risk hits summary.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.totalHits
      description: The total low risk sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.violatedHits
      description: The violated low risk sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.__typename
      description: The GraphQL type name of the low risk hits summary.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.totalHits
      description: The total no-risk sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.violatedHits
      description: The violated no-risk sensitive hits.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.__typename
      description: The GraphQL type name of the no-risk hits summary.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.totalHits
      description: The total sensitive hits across all risk levels.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.violatedHits
      description: The total violated sensitive hits across all risk levels.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.__typename
      description: The GraphQL type name of the total sensitive hits summary.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.__typename
      description: The GraphQL type name of the sensitive hits.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.numActivities
      description: The number of activities associated with the file result.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.rootFileResult.numActivitiesDelta
      description: The change in number of activities since last scan.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.id
      description: The ID of the snappable object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.name
      description: The name of the snappable object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.objectType
      description: The type of the snappable object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.slaAssignment
      description: The SLA assignment of the snappable object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.logicalPath.fid
      description: The FID of the logical path node.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.logicalPath.name
      description: The name of the logical path node.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.logicalPath.objectType
      description: The object type of the logical path node.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.logicalPath.__typename
      description: The GraphQL type name of the logical path node.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.physicalPath.fid
      description: The FID of the physical path node.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.physicalPath.name
      description: The name of the physical path node.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.physicalPath.objectType
      description: The object type of the physical path node.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.id
      description: The ID of the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.name
      description: The name of the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.isRetentionLockedSla
      description: Whether the SLA domain has retention lock enabled.
      type: Boolean
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.retentionLockMode
      description: The retention lock mode of the SLA domain.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.description
      description: The description of the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.__typename
      description: The GraphQL type name of the effective SLA domain.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.rscNativeObjectPendingSla.id
      description: The ID of the pending SLA for the native object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.rscNativeObjectPendingSla.name
      description: The name of the pending SLA for the native object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.snappable.__typename
      description: The GraphQL type name of the snappable object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.policySummaries.id
      description: The ID of the classification policy.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.policySummaries.name
      description: The name of the classification policy.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.policySummaries.colorEnum
      description: The color enum of the classification policy.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObject.policySummaries.__typename
      description: The GraphQL type name of the classification policy summary.
      type: String
  - name: rubrik-sensitive-data-object-file-get
    arguments:
    - description: "The ID of the object (snappable FID).\n\nNote: Users can get the object ID by executing the \"rubrik-polaris-object-list\" command."
      name: object_id
      required: true
    - description: "The Snapshot ID of the object.\n\nNote: Users can get the snapshot ID by executing the \"rubrik-polaris-object-snapshot-list\" command."
      name: snapshot_id
      required: true
    - description: The full path of the file for which to retrieve information.
      name: file_path
      required: true
    - auto: PREDEFINED
      defaultValue: "True"
      description: Whether to resolve SIDs to display names in the file response.
      name: resolve_sids
      predefined:
      - "True"
      - "False"
    description: Retrieve the file information for the provided file path in the object.
    outputs:
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.objectId
      description: The unique identifier of the snappable object.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.stdPath
      description: The standard file path of the sensitive file.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.path
      description: The full path of the sensitive file from the security descriptor.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.owner
      description: The SID of the owner of the file.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.cn
      description: The display name of the principal with file permissions.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalId
      description: The SID or identifier of the principal with file permissions.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalOrigin
      description: The origin of the principal.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.idpType
      description: The identity provider type for the principal.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalType
      description: The type of the principal.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.resolutionType
      description: The resolution type of the principal SID.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.access
      description: The access level granted to the principal.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.flags
      description: The permission flags.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.accessMethodDetails.accessMethod
      description: The access method used.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.fileMetadata.createdBy.value
      description: The value of the principal who created the file.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.fileMetadata.creationTime
      description: The creation time of the file as a Unix timestamp.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastAccessTime
      description: The last access time of the file as a Unix timestamp.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastModifiedBy.value
      description: The value of the principal who last modified the file.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastModifiedTime
      description: The last modified time of the file as a Unix timestamp.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastScanTime
      description: The last scan time of the file as a Unix timestamp.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.fileMetadata.path
      description: The full path of the file as recorded in the metadata.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.fileMetadata.size
      description: The size of the file in bytes.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.exposureSummary.exposureType
      description: The exposure type of the file.
      type: String
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.exposureSummary.fileCount.totalCount
      description: The total count of files in the exposure summary.
      type: Number
    - contextPath: RubrikPolaris.SensitiveDataObjectFile.exposureSummary.fileCount.violatedCount
      description: The number of files with violations in the exposure summary.
      type: Number
  dockerimage: demisto/rubrik-polaris-sdk-py3:1.0.0.10133006
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- RubrikPolaris-Test
defaultmapperin: Rubrik Polaris Radar - Mapping
defaultclassifier: Rubrik Polaris Radar - Classification
fromversion: 6.0.0