RubrikPolaris

The Rubrik Security Cloud integration will fetch the Rubrik Anomaly Event and is rich with commands to perform the on-demand scans, backups, recoveries and many more features to manage and protect the organizational data.

Data Enrichment & Threat Intelligence · Rubrik Security Cloud

Details

ID	`RubrikPolaris`
Provider	Rubrik
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/rubrik-polaris-sdk-py3:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

Configure Rubrik Security Cloud in Cortex

Parameter	Description	Required
Service Account JSON		False
Rubrik Account (e.g. ${rubrikAccount}.my.rubrik.com)		False
Email		False
Password		False
Fetch incidents		False
Incident type		False
RSC Fetch Types	Select RSC types to fetch as incidents. Note: Supports the listed options only. If not provided, it will fetch all listed options.	False
Event types to fetch as incidents	Event types to fetch as incidents. Note: Supports the listed options only. If not provided, it will fetch events for all listed options. Applies only when RSC fetch type is set to “Event”.	False
Event severities to fetch as incidents	Event severities to fetch as incidents. Note: Supports the listed options only. If not provided, it will fetch events for critical severity level. Applies only when RSC fetch type is set to “Event”.	False
Threat Monitoring Match Types	Select Threat Monitoring Match Types to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “Threat Monitoring object”.	False
Threat Monitoring Object Types	Select Threat Monitoring Object Types to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “Threat Monitoring object”.	False
First fetch time	The time interval for the first fetch (retroactive). Examples of supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates.	False
Fetch Limit (Maximum of 1000)	Maximum number of incidents to fetch every time. The maximum value is 1000. Note: If multiple fetch types (Events, Threat Monitoring objects, DSPM Violations, IR Violations, Sensitive Data Objects) are selected, the limit is distributed optimally among them to fetch all types.	False
Event Critical Severity Level Mapping	When an event of Critical severity is detected and fetched, this setting indicates what severity will get assigned within XSOAR.	False
Event Warning Severity Level Mapping	When an event of Warning severity is detected and fetched, this setting indicates what severity will get assigned within XSOAR.	False
Threat Monitoring Object Severity Level Mapping	When a threat monitoring object is fetched, this setting indicates what severity will get assigned within XSOAR.	False
DSPM Violation Statuses	Select DSPM violation statuses to fetch as incidents. Default is OPEN and IN_PROGRESS. Note: Applies only when RSC fetch type is set to “DSPM Violation”.	False
DSPM Violation Sensitivity Levels	Select DSPM violation sensitivity levels to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “DSPM Violation”.	False
DSPM Violation Severity Levels	Select DSPM violation severity levels to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “DSPM Violation”.	False
DSPM Violation Categories	Select DSPM violation categories to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “DSPM Violation”.	False
DSPM Violation Object Types	Select DSPM violation object types to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “DSPM Violation”. Values not included in the options can be found in the documentation.	False
IR Violation Policy Types	Select IR violation policy types to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “IR Violation”.	False
IR Violation Statuses	Select IR violation statuses to fetch as incidents. Default is OPEN and IN_PROGRESS. Note: Applies only when RSC fetch type is set to “IR Violation”.	False
IR Violation Severity Levels	Select IR violation severity levels to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “IR Violation”.	False
IR Violation Categories	Select IR violation categories to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “IR Violation”.	False
IR Violation Identity Providers	Select IR violation identity providers to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “IR Violation”.	False
IR Violation Identity Tags	Select IR violation identity tags to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “IR Violation”.	False
Sensitive Data Object Sensitivity Levels	Select Sensitive Data Object sensitivity levels to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “Sensitive Data Object”.	False
Sensitive Data Object Types	Select Sensitive Data Object types to fetch as incidents. Default is all. Note: Applies only when RSC fetch type is set to “Sensitive Data Object”. Values not included in the options can be found in the documentation.	False
Source Reliability	Reliability of the source providing the intelligence data.	False
Use system proxy settings	Whether to use XSOAR’s system proxy settings to connect to the API.	False
Trust any certificate (not secure)	Whether to allow connections without verifying SSL certificates validity.	False

Known Limitations

The fetch-incidents only ingests the events with “Critical” severity.
During the fetch cycle of threat monitoring objects, changing the filter parameters (Threat Monitoring Match Types or Threat Monitoring Object Types) may result in delayed ingestion of threat monitoring objects.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

rubrik-radar-analysis-status

Check the Radar Event for updates.

Base Command

rubrik-radar-analysis-status

Input

Argument Name	Description	Required
activitySeriesId	The ID of the Polaris Event Series. When used in combination with "Rubrik Radar Anomaly" incidents, this value will automatically be looked up using the incident context. Otherwise it is a required value. Note: Users can retrieve the list of the activity series IDs by executing the "rubrik-event-list" command.	Required
clusterId	The ID of the CDM cluster. When used in combination with "Rubrik Radar Anomaly" incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value. Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.	Required

Context Output

Path	Type	Description
Rubrik.Radar.EventComplete	Boolean	Flag that indicates whether Radar has finished analysing the object.
Rubrik.Radar.Message	Unknown	The text, ID, and timestamp of each message in the Activity Series.
Rubrik.Radar.ActivitySeriesId	String	The ID of the Rubrik Polaris Activity Series.
Rubrik.Radar.ClusterId	String	The ID of the cluster.

Command Example

!rubrik-radar-analysis-status activitySeriesId="" clusterId="cc19573c-db6c-418a-9d48-067a256543ba"

Human Readable Output

Radar Analysis Status

Activity Series ID	Cluster ID	Message	Event Complete
ec9c48ce-5faf-474a-927c-33667355aecd	cc19573c-db6c-418a-9d48-067a256543ba	Completed backup of the transaction log for SQL Server database ‘AdventureWorks2012’ from ‘sx1-sql12-1\MSSQLSERVER’.	True

rubrik-sonar-sensitive-hits

Find data classification hits on an object.

Base Command

rubrik-sonar-sensitive-hits

Input

Argument Name	Description	Required
objectName	The name of the Rubrik object to check for sensitive hits. When used in combination with “Rubrik Radar Anomaly” incidents, this value will automatically be looked up using the incident context. Otherwise it is a required value. Note: Users can get the list of the object names by executing the “rubrik-polaris-object-list” or “rubrik-polaris-object-search” command.	Optional
searchTimePeriod	The number of days in the past to look for sensitive hits. If no value is provided, then today’s data will be returned and, if there is no data for today then the argument will default to 7 days. Default is 7.	Optional

Context Output

Path	Type	Description
Rubrik.Sonar.totalHits	String	The total number of data classification hits found on the provided object.
Rubrik.Sonar.id	String	ID of the sensitive hits object.
Rubrik.Sonar.policy_hits	Unknown	Information of the policy analyzer group of the sensitive hits object.
Rubrik.Sonar.filesWithHits	Number	The total number of files with hits of the object.
Rubrik.Sonar.openAccessFiles	Number	The total number of open access files of the object.
Rubrik.Sonar.openAccessFilesWithHits	Number	The total number of open access files with hits of the object.
Rubrik.Sonar.openAccessFolders	Number	The total number of open access folders of the object.
Rubrik.Sonar.staleFiles	Number	The total number of stale files of the object.
Rubrik.Sonar.staleFilesWithHits	Number	The total number of stale files with hits of the object.
Rubrik.Sonar.openAccessStaleFiles	Number	The total number of open access stale files of the object.
Rubrik.Radar.Message	Unknown	The text, ID, and timestamp of each message in the Activity Series.
Rubrik.Radar.ActivitySeriesId	String	The ID of the Rubrik Polaris Activity Series.

Command Example

!rubrik-sonar-sensitive-hits objectName="sx1-radar15"

Human Readable Output

Sensitive Hits

ID	Total Hits
afc0f6f0-148a-54c5-9927-c24c7cde1608	49684

rubrik-cdm-cluster-location

Find the CDM GeoLocation of a CDM Cluster.

Base Command

rubrik-cdm-cluster-location

Input

Argument Name	Description	Required
clusterId	The ID of the CDM cluster. When used in combination with “Rubrik Radar Anomaly” incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value. Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.	Required

Context Output

Path	Type	Description
Rubrik.CDM.Cluster.Location	String	The GeoLocation of the Rubrik CDM Cluster.
Rubrik.CDM.ClusterId	String	The ID of the cluster.

Command Example

!rubrik-cdm-cluster-location clusterId="cc19573c-db6c-418a-9d48-067a256543ba"

Human Readable Output

CDM Cluster Location

Location
San Francisco, CA, USA

rubrik-cdm-cluster-connection-state

Find the CDM Connection State of a CDM Cluster.

Base Command

rubrik-cdm-cluster-connection-state

Input

Argument Name	Description	Required
clusterId	The ID of the CDM cluster. When used in combination with “Rubrik Radar Anomaly” incidents, this value will automatically be looked up using the incident context. Otherwise, it is a required value. Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.	Required

Context Output

Path	Type	Description
Rubrik.CDM.Cluster.ConnectionState	String	The Connection State of the Rubrik CDM Cluster.
Rubrik.CDM.ClusterId	String	The ID of the cluster.

Command Example

!rubrik-cdm-cluster-connection-state clusterId="cc19573c-db6c-418a-9d48-067a256543ba"

Human Readable Output

CDM Cluster Connection State

Connection State
Connected

rubrik-polaris-object-search

Search for Rubrik discovered objects of any type, return zero or more matches.

Base Command

rubrik-polaris-object-search

Input

Argument Name	Description	Required
limit	Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50.	Optional
object_name	The name of the object to search for.	Required
sort_by	Specify the field to use for sorting the response. Note: Supported values are “ID” and “NAME” only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID.	Optional
sort_order	Specify the order to sort the data in. Possible values are: “ASC”, “DESC”. Default is ASC.	Optional
next_page_token	The next page cursor to retrieve the next set of results.	Optional

Context Output

Path	Type	Description
RubrikPolaris.GlobalSearchObject.id	String	The ID of the object.
RubrikPolaris.GlobalSearchObject.name	String	The name of the object.
RubrikPolaris.GlobalSearchObject.objectType	String	The type of the object.
RubrikPolaris.GlobalSearchObject.physicalPath.fid	String	The FID of the physical path of the object.
RubrikPolaris.GlobalSearchObject.physicalPath.name	String	The name of the physical path where the object relies.
RubrikPolaris.GlobalSearchObject.physicalPath.objectType	String	The object type of the physical path where the object relies.
RubrikPolaris.GlobalSearchObject.azureRegion	String	The azure region of the object.
RubrikPolaris.GlobalSearchObject.awsRegion	String	The aws region of the object.
RubrikPolaris.GlobalSearchObject.emailAddress	String	The email address of the object.
RubrikPolaris.GlobalSearchObject.isRelic	Boolean	Whether the object is relic (historical) or not.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.id	String	The effective SLA domain ID of the object.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.name	String	The effective SLA domain name of the object.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.description	String	The effective SLA domain description of the object.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.fid	String	The FID of the object’s effective SLA domain.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.cluster.id	String	The cluster ID of the object’s effective SLA domain.
RubrikPolaris.GlobalSearchObject.effectiveSlaDomain.cluster.name	String	The cluster name of the object’s effective SLA domain.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.count	String	The count of physical child connection of the object.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.id	String	The ID of physical child connection of the object.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.name	String	The name of the physical child connection of the object.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.replicatedObjects.cluster.id	String	The cluster ID of the replicated objects of physical child connection of the object.
RubrikPolaris.GlobalSearchObject.physicalChildConnection.edges.node.replicatedObjects.cluster.name	String	The cluster name of the replicated objects of physical child connection of the object.
RubrikPolaris.GlobalSearchObject.cluster.id	String	The cluster ID related to the object.
RubrikPolaris.GlobalSearchObject.cluster.name	String	The name of the cluster related to the object.
RubrikPolaris.GlobalSearchObject.primaryClusterLocation.id	String	The primary cluster location ID of the object.
RubrikPolaris.GlobalSearchObject.gcpZone	String	The gcp zone of the object.
RubrikPolaris.GlobalSearchObject.gcpRegion	String	The gcp region of the object.
RubrikPolaris.GlobalSearchObject.gcpNativeProject.name	String	The gcp native project name of the object.
RubrikPolaris.PageToken.GlobalSearchObject.next_page_token	String	Next page token.
RubrikPolaris.PageToken.GlobalSearchObject.name	String	Name of the command.
RubrikPolaris.PageToken.GlobalSearchObject.has_next_page	Boolean	Whether the result has the next page or not.

Command Example

!rubrik-polaris-object-search object_name="admin" limit=2

Human Readable Output

Global Objects

Object ID	Object Name	Type	SLA Domain
0f667954-9052-42c8-ac20-2149da4d0ec4	Hoang-Admin Nguyen	O365Mailbox	UNPROTECTED
3e5d0800-71f6-4e42-badc-ae8b98c8a808	Admin o365	O365Mailbox	UNPROTECTED

Note: To retrieve the next set of results use, “next_page_token” = xyz

rubrik-sonar-policies-list

Retrieve the list of all the available Sonar policies.

Base Command

rubrik-sonar-policies-list

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
RubrikPolaris.SonarPolicy.id	String	Unique ID of the policy.
RubrikPolaris.SonarPolicy.name	String	Name of the policy.
RubrikPolaris.SonarPolicy.description	String	Descriptive name of the policy.
RubrikPolaris.SonarPolicy.creator.email	String	Email of the user who created the policy.
RubrikPolaris.SonarPolicy.totalObjects	Number	Number of total objects present in the policy.
RubrikPolaris.SonarPolicy.numAnalyzers	Number	Number of analyzers present in the policy.
RubrikPolaris.SonarPolicy.objectStatuses.id	String	ID of the object present in the policy.
RubrikPolaris.SonarPolicy.objectStatuses.latestSnapshotResult.snapshotFid	String	Snapshot ID of the object present in the policy.
RubrikPolaris.SonarPolicy.objectStatuses.policyStatuses.policyId	String	Policy ID.
RubrikPolaris.SonarPolicy.objectStatuses.policyStatuses.status	String	Policy status.

Command Example


#### Human Readable Output

### Sonar Policies

|ID|Name|Description|Analyzers|Objects|Creator Email|
|---|---|---|---|---|---|
| bdb8c043-ee89-43ef-a3e2-73e94b5b3900 | CCPA | California Consumer Privacy Act | 5 | 3 | dummy.email@rubrik.com |
| 53e447ed-9114-4fcd-b5a6-7ac759980fde | GLBA | U.S. Gramm-Leach-Bliley Act | 4 | 3 |  |

### rubrik-sonar-policy-analyzer-groups-list

***
List the analyzer group policies.

#### Base Command

`rubrik-sonar-policy-analyzer-groups-list`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarAnalyzerGroup.id | String | The analyzer group ID. |
| RubrikPolaris.SonarAnalyzerGroup.name | String | The name of the analyzer group. |
| RubrikPolaris.SonarAnalyzerGroup.groupType | String | The analyzer group type. |
| RubrikPolaris.SonarAnalyzerGroup.analyzers.id | String | The ID of the analyzers belong to the group. |
| RubrikPolaris.SonarAnalyzerGroup.analyzers.name | String | The name of the analyzers belong to the group. |
| RubrikPolaris.SonarAnalyzerGroup.analyzers.analyzerType | String | The type of the analyzers belong to the group. |

#### Command Example

```!rubrik-sonar-policy-analyzer-groups-list```

#### Human Readable Output

### Sonar Policy Analyzer Groups

|ID|Name|Group Type|Analyzers|
|---|---|---|---|
| 97c6a54a-acfc-5ab2-a24a-6a7f3a9a1553 | GLBA | GLBA | id: ed30dfa0-334f-55ff-a1b7-03b6bdd7849b, Name: Credit Card, Analyzer Type: CREDIT_CARD<br/><br/>id: 3e60a612-3e97-5f03-b3a1-cfb7a6a67e8f, Name: Test Bank Acct, Analyzer Type: US_BANK_ACCT<br/><br/>id: 03b3dc9e-81c1-561c-8235-17cf2fc1c729, Name: US ITIN, Analyzer Type: US_ITIN<br/><br/>id: d5ce3ae5-f530-562a-85b1-4a84264a350a, Name: US SSN, Analyzer Type: US_SSN |
| 543dd5e0-c72c-50e2-a3d9-1688343f472c | HIPAA | HIPAA | id: 9da675b3-944b-5da3-a2da-ed149d300075, Name: US/UK Passport, Analyzer Type: PASSPORT<br/><br/>id: 18665533-c28c-5a40-b747-4b6508fecdfa, Name: US NPI, Analyzer Type: US_HEALTHCARE_NPI<br/><br/>id: 03b3dc9e-81c1-561c-8235-17cf2fc1c729, Name: US ITIN, Analyzer Type: US_ITIN<br/><br/>id: d5ce3ae5-f530-562a-85b1-4a84264a350a, Name: US SSN, Analyzer Type: US_SSN<br/><br/>id: 6bcc8e4e-0ec9-5538-b91d-a506dac47ec6, Name: US DEA, Analyzer Type: DEA_NUMBER |
| 16bd3864-bad6-513b-b38d-a108e648cf4a |  | PCI_DSS |  |
| c8c8072a-9454-5e68-9a23-bbcb9824838e | U.S. Financials | US_FINANCE | id: bb9a929b-3f29-5d3f-a768-de74e8ee5a9c, Name: n/a, Analyzer Type: CUSIP_NUMBER |

### rubrik-polaris-vm-object-metadata-get

***
Retrieve details for a Vsphere object based on the provided object ID.

#### Base Command

`rubrik-polaris-vm-object-metadata-get`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| object_id | The ID of the object to get details.<br/><br/>Note: Users can get the list of the object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.VSphereVm.id | String | Unique ID of the object. |
| RubrikPolaris.VSphereVm.metadata.authorizedOperations | Unknown | List of operations performed by the object. |
| RubrikPolaris.VSphereVm.metadata.name | String | The name of the object. |
| RubrikPolaris.VSphereVm.metadata.isRelic | Boolean | Whether the object is relic or not. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.id | String | ID of the SLA domain. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.name | String | Name of the SLA domain. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.cluster.id | String | ID of the cluster of the SLA domain. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaDomain.cluster.name | String | Name of the cluster of the SLA domain. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.fid | String | SLA Source object FID. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.name | String | SLA source object name. |
| RubrikPolaris.VSphereVm.metadata.effectiveSlaSourceObject.objectType | String | SLA source object type. |
| RubrikPolaris.VSphereVm.metadata.protectionDate | String | Protection date of the object. |
| RubrikPolaris.VSphereVm.metadata.reportSnappable.id | String | The ID of the snappable for a particular report related to an object. Snappable supports backups or filesets of physical machines using the rubrik connector. |
| RubrikPolaris.VSphereVm.metadata.reportSnappable.logicalBytes | Number | Logical bytes of snappable report. |
| RubrikPolaris.VSphereVm.metadata.reportSnappable.physicalBytes | Number | The physical byte of the snappable for a particular report related to an object. |
| RubrikPolaris.VSphereVm.metadata.reportSnappable.archiveStorage | Number | The archived storage of the snappable for a particular report related to an object. |
| RubrikPolaris.VSphereVm.metadata.cluster.id | String | Unique ID of the cluster which is the datastore for the recovered virtual machine. |
| RubrikPolaris.VSphereVm.metadata.cluster.name | String | Cluster name of the VM to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.cluster.status | String | Cluster status of the VM to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.cluster.version | String | Cluster version of the VM to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.cluster.lastConnectionTime | String | Last time when the vm was connected to the cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.defaultAddress | String | Default address where the cluster is stored. |
| RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.id | String | Node ID of the node connection related to cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.status | String | Node status of the node connection related to cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.clusterNodeConnection.nodes.ipAddress | String | IP address of the node connection related to cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.state.connectedState | String | Connected state of the cluster. |
| RubrikPolaris.VSphereVm.metadata.cluster.state.clusterRemovalState | String | State of the cluster if it is registered for removal or not. |
| RubrikPolaris.VSphereVm.metadata.cluster.passesConnectivityCheck | Boolean | Whether the cluster passes connectivity check or not. |
| RubrikPolaris.VSphereVm.metadata.cluster.globalManagerConnectivityStatus.urls.url | String | URL of Global Manager Connectivity Status. |
| RubrikPolaris.VSphereVm.metadata.cluster.globalManagerConnectivityStatus.urls.isReachable | Boolean | Whether the url in global Manager Connectivity Status is reachable or not. |
| RubrikPolaris.VSphereVm.metadata.cluster.connectivityLastUpdated | String | Date time when the connectivity status of the cluster is lastly updated. |
| RubrikPolaris.VSphereVm.metadata.primaryClusterLocation.id | String | The location ID of the primary cluster to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.primaryClusterLocation.name | String | The location name of the primary cluster to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.arrayIntegrationEnabled | Boolean | Whether the array integration is enabled or not. |
| RubrikPolaris.VSphereVm.metadata.snapshotConsistencyMandate | String | Data consistency in recovery points is the snapshot consistency mandate. It is broadly classified into 3 categories: inconsistent, crash-consistent, app-consistent. |
| RubrikPolaris.VSphereVm.metadata.agentStatus.agentStatus | String | The status of an agent related to an object. In Rubrik agents are connectors also known as Rubrik Backup Service. |
| RubrikPolaris.VSphereVm.metadata.logicalPath.fid | String | The logical path ID of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.logicalPath.objectType | String | The logical object type of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.logicalPath.name | String | The logical name of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.metadata.physicalPath.fid | String | The physical path of where the VM resides. |
| RubrikPolaris.VSphereVm.metadata.physicalPath.objectType | String | The physical path object type of the VM. |
| RubrikPolaris.VSphereVm.metadata.physicalPath.name | String | The physical Name of the VM. |
| RubrikPolaris.VSphereVm.metadata.vsphereTagPath.fid | String | FID of Vsphere tag. |
| RubrikPolaris.VSphereVm.metadata.vsphereTagPath.objectType | String | Object type of Vsphere tag. |
| RubrikPolaris.VSphereVm.metadata.vphereTagPath.name | String | Name of Vsphere tag. |
| RubrikPolaris.VSphereVm.metadata.oldestSnapshot.id | String | The ID of the oldest snapshot. |
| RubrikPolaris.VSphereVm.metadata.oldestSnapshot.date | String | The date when the oldest snapshot was generated. |
| RubrikPolaris.VSphereVm.metadata.oldestSnapshot.isIndexed | Boolean | Whether the oldest snapshot is indexed or not. |
| RubrikPolaris.VSphereVm.metadata.totalSnapshots.count | Number | Total snapshot counts. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.id | String | The ID of the object which is replicated in the VM. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.primaryClusterLocation.id | String | The primary cluster location ID where the replicated object resides. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.primaryClusterLocation.name | String | The primary cluster location name where the replicated object resides. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.cluster.name | String | The cluster name where the replicated object resides. |
| RubrikPolaris.VSphereVm.metadata.replicatedObjects.cluster.id | String | The cluster ID where the replicated object resides. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.id | String | ID of the newest archived snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.date | String | The date when the newest archived snapshot was generated. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.isIndexed | Boolean | Whether the newest archived snapshot is indexed or not. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.archivalLocations.id | String | ID of the archival location of the newest archived snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestArchivedSnapshot.archivalLocations.name | String | Name of the archival location of the newest archival snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.id | String | The ID of the newest replicated snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.date | String | The date when the newest replicated snapshot was generated. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.isIndexed | Boolean | Whether the newest replicated snapshot is indexed or not. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.replicationLocations.id | String | The ID of the replication locations of the newest replicated snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestReplicatedSnapshot.replicationLocations.name | String | The name of the replication locations of the newest replicated snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestSnapshot.id | String | The ID of the newest snapshot. |
| RubrikPolaris.VSphereVm.metadata.newestSnapshot.date | String | The date when the newest snapshot was generated. |
| RubrikPolaris.VSphereVm.metadata.newestSnapshot.isIndexed | Boolean | Whether the newest snapshot is indexed or not. |
| RubrikPolaris.VSphereVm.metadata.onDemandSnapshotCount | Number | Count of how many on demand snapshot created in a VM. |
| RubrikPolaris.VSphereVm.metadata.vmwareToolsInstalled | Boolean | Whether the Vmware tools are installed or not. |
| RubrikPolaris.VSphereVm.metadata.cdmLink | String | The Cloud Data Management link to navigate to the VM on cloud. |

#### Command Example

```!rubrik-polaris-vm-object-metadata-get object_id="e060116b-f9dc-56a1-82a6-1b968d2f6cef"```

#### Human Readable Output

### VM Object Data

|Object ID|Name|Snappable ID|SLA Domain|Cluster Name|Total Snapshots|Oldest Snapshot Date|Latest Snapshot Date|
|---|---|---|---|---|---|---|---|
| e060116b-f9dc-56a1-82a6-1b968d2f6cef | Kali-VM | VirtualMachine:::ae4484c6-b4c0-4ce8-b2ba-206a4184540b-vm-521 | DO_NOT_PROTECT | sand2-rbk01 | 42 | 2019-04-24T16:21:12.000Z | 2020-02-12T14:00:36.000Z |

### rubrik-polaris-vm-objects-list

***
Retrieve a list of all the objects of the Vsphere Vm known to the Rubrik.

#### Base Command

`rubrik-polaris-vm-objects-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| is_relic | Filter based on whether VM objects are moved to relic/archive or not.<br/><br/>Possible values are: "True", "False". | Optional |
| is_replicated | Filter based on whether VM objects are replicated or not.<br/><br/>Possible values are: "True", "False". | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Supported values are "ID" and "NAME" only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.VSphereVm.id | String | Unique ID of the object. |
| RubrikPolaris.VSphereVm.name | String | Name of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.objectType | String | Object type of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.replicatedObjectCount | Number | Number of objects replicated in the node in which the object relies. |
| RubrikPolaris.VSphereVm.cluster.id | String | ID of the cluster which is the datastore for the recovered virtual machine. |
| RubrikPolaris.VSphereVm.cluster.name | String | Cluster name of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.cluster.version | String | Cluster version of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.cluster.status | String | Cluster status of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.id | String | ID of the SLA domain which is simply a set of policies that define at what frequencies backups should be performed of the protected objects within Rubrik and for how long they should be either locally or a replication partner or on the archival location. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.name | String | Descriptive name of the SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.description | String | Description of the SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.fid | String | FID of the SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.cluster.id | String | ID of the cluster related to the effective SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaDomain.cluster.name | String | Name of the cluster related to the effective SLA domain. |
| RubrikPolaris.VSphereVm.effectiveSlaSourceObject.fid | String | SLA source object FID. |
| RubrikPolaris.VSphereVm.effectiveSlaSourceObject.name | String | SLA source object name. |
| RubrikPolaris.VSphereVm.effectiveSlaSourceObject.objectType | String | SLA source object type. |
| RubrikPolaris.VSphereVm.slaAssignment | String | A SLA rule when referred at assignment is SLA assignment. |
| RubrikPolaris.VSphereVm.isRelic | Boolean | Whether the object is relic or not. |
| RubrikPolaris.VSphereVm.authorizedOperations | Unknown | List of operations that can be performed on the object. |
| RubrikPolaris.VSphereVm.primaryClusterLocation.id | String | The location ID of the primary cluster to which the object belongs. |
| RubrikPolaris.VSphereVm.primaryClusterLocation.name | String | The location name of the primary cluster to which the object belongs. |
| RubrikPolaris.VSphereVm.logicalPath.fid | String | The logical path ID of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.logicalPath.name | String | The logical path name of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.logicalPath.objectType | String | The logical object type of the node to which the object belongs. |
| RubrikPolaris.VSphereVm.snapshotDistribution.id | String | Rubrik uses a snapshot for powerful data protection. Snapshot distribution ID is the ID of the snapshot distribution node related to a particular object. |
| RubrikPolaris.VSphereVm.snapshotDistribution.onDemandCount | Number | The demand count of distribution of snapshot related to an object. |
| RubrikPolaris.VSphereVm.snapshotDistribution.retrievedCount | Number | The retrieved count of distribution of snapshot related to an object. |
| RubrikPolaris.VSphereVm.snapshotDistribution.scheduledCount | Number | The scheduled count of distribution of snapshot related to an object. |
| RubrikPolaris.VSphereVm.snapshotDistribution.totalCount | Number | The total count of distribution of snapshot related to an object. |
| RubrikPolaris.VSphereVm.reportSnappable.id | String | The ID of the snappable for a particular report related to an object. Snapple supports backups or filesets of physical machines using the rubrik connector. |
| RubrikPolaris.VSphereVm.reportSnappable.archieveStorage | Number | The archived storage of the snappable for a particular report related to an object. |
| RubrikPolaris.VSphereVm.reportSnappable.physicalBytes | Number | The physical byte of the snappable for a particular report related to an object. |
| RubrikPolaris.VSphereVm.vmwareToolsInstalled | Boolean | Whether the vm tools are installed or not. |
| RubrikPolaris.VSphereVm.agentStatus.agentStatus | String | The status of an agent related to an object. The Rubrik agents are connectors also known as Rubrik Backup Service. |
| RubrikPolaris.VSphereVm.agentStatus.disconnectReason | String | Displays the reason if the agent disconnects. |
| RubrikPolaris.PageToken.VSphereVm.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.VSphereVm.name | String | Name of the command. |
| RubrikPolaris.PageToken.VSphereVm.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-polaris-vm-objects-list limit=2```

#### Human Readable Output

### Objects List

|Object ID|Name|Snappable ID|Cluster|Object Type|SLA Domain|Assignment|Snapshots|RBS Status|Source Storage|Archival Storage|
|---|---|---|---|---|---|---|---|---|---|---|
| 0242e84c-773a-5877-b955-1d52765ac852 | sx1-ganebala-l1 | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-206037 | sand1-rbk01 | VmwareVirtualMachine | DO_NOT_PROTECT | Direct | 0 | Unregistered | 0 | 0 |
| 0556f691-b750-556c-baea-800dbb2920e7 | linux-a-Fri Feb 15 2019 04:43:40 GMT+0000 (Greenwich Mean Time)-9P4t | VirtualMachine:::d2f41f4b-5d53-4063-a618-25046a0f4c7d-vm-35806 | sand1-rbk01 | VmwareVirtualMachine | UNPROTECTED | Unassigned | 34 | Unregistered | 0 | 1.115023609 GB |

 Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-sonar-ondemand-scan

***
Trigger an on-demand scan of a system. Supports "Vsphere VM" object type only.

Note: To know the scan status use the "rubrik-sonar-ondemand-scan-status" command. To download the completed request use the "rubrik-sonar-ondemand-scan-result" command.

#### Base Command

`rubrik-sonar-ondemand-scan`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| scan_name | Name of the scan. If not provided, it defaults to "&lt;today's date&gt; Classification". | Optional |
| sonar_policy_analyzer_groups | List of sonar policies to scan.<br/><br/>Note: Users can get the list of analyzer groups by executing the "rubrik-sonar-policy-analyzer-groups-list" command. <br/><br/>Format Accepted: <br/>[<br/>        {<br/>            "id": "543dd5e0-c72c-50e2-a3d9-1688343f472c",<br/>            "name": "HIPAA",<br/>            "groupType": "HIPAA",<br/>            "analyzers": [<br/>                {<br/>                    "id": "9da675b3-944b-5da3-a2da-ed149d300075",<br/>                    "name": "US/UK Passport",<br/>                    "analyzerType": "PASSPORT"<br/>                },<br/>                {<br/>                    "id": "18665533-c28c-5a40-b747-4b6508fecdfa",<br/>                    "name": "US NPI",<br/>                    "analyzerType": "US_HEALTHCARE_NPI"<br/>                }<br/>            ]<br/>      }<br/>]. | Required |
| objects_to_scan | List of VM object IDs to scan.<br/><br/>Note: Users can get the list of VM object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarOndemandScan.crawlId | String | Unique crawl ID. |

#### Command Example

```!rubrik-sonar-ondemand-scan scan_name="GLBA Scan for new user" sonar_policy_analyzer_groups='[{"id":"97c6a54a-acfc-5ab2-a24a-6a7f3a9a1553","name":"GLBA","groupType":"GLBA","analyzers":[{"id":"ed30dfa0-334f-55ff-a1b7-03b6bdd7849b","name":"CreditCard","analyzerType":"CREDIT_CARD"},{"id":"3e60a612-3e97-5f03-b3a1-cfb7a6a67e8f","name":"BANK_ACCT","analyzerType":"US_BANK_ACCT"},{"id":"03b3dc9e-81c1-561c-8235-17cf2fc1c729","name":"USITIN","analyzerType":"US_ITIN"},{"id":"d5ce3ae5-f530-562a-85b1-4a84264a350a","name":"USSSN","analyzerType":"US_SSN"}]}]' objects_to_scan="0887e71c-56ac-59f7-8763-54b726e64dd6, a82e888c-2440-5af9-8c2a-447a97f6746c"```

#### Human Readable Output

### Sonar On-Demand Scan

|Crawl ID|
|---|
| bb4eedc0-594b-4566-b06d-24de0bf752ca |

### rubrik-sonar-ondemand-scan-status

***
Retrieve the status of a scanned system.

Note: To download the completed request use the "rubrik-sonar-ondemand-scan-result" command.

#### Base Command

`rubrik-sonar-ondemand-scan-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| crawl_id | ID for which scanning status is to be obtained.<br/><br/>Note: Users can get the crawl ID by executing the "rubrik-sonar-ondemand-scan" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarOndemandScan.crawlId | String | Crawl ID of the scan for which the rubrik-sonar-ondemand-scan command is hit. |
| RubrikPolaris.SonarOndemandScan.Status.error | String | Error description if any. |
| RubrikPolaris.SonarOndemandScan.Status.snappable.id | String | Snappable ID of the scanned object. |
| RubrikPolaris.SonarOndemandScan.Status.snappable.name | String | Snappable Name of the scanned object. |
| RubrikPolaris.SonarOndemandScan.Status.snappable.objectType | String | Snappable object type of the scanned object. |
| RubrikPolaris.SonarOndemandScan.Status.snapshotTime | Number | Time when the snapshot is taken. |
| RubrikPolaris.SonarOndemandScan.Status.status | String | Status of the scanning or scanned object. |
| RubrikPolaris.SonarOndemandScan.Status.progress | Number | Count of objects that are in progress. |
| RubrikPolaris.SonarOndemandScan.Status.totalHits | Number | Number of total hits obtained from an object that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.groupType | String | Group type of the analyzer. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.id | String | Group ID of the analyzer. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerGroup.name | String | Group Name of the analyzer. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.totalHits | Number | Number of total hits obtained from an analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.violations | Number | Number of violations obtained from an analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.hits.permittedHits | Number | Number of permitted hits obtained from an analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.analyzer.id | String | ID of the analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analzerGroupResults.analyzerResults.analyzer.name | String | Name of the analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.analyzerResults.analyzer.analyzerType | String | Type of the analyzer that is scanned. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.totalHits | Number | Number of total hits obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.violations | Number | Number of violations obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.permittedHits | Number | Number of permitted hits obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.violationsDelta | Number | Number of violation delta obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.analyzerGroupResults.hits.totalHitsDelta | Number | Number of total hits delta obtained from an analyzer group. |
| RubrikPolaris.SonarOndemandScan.Status.cluster.id | String | Cluster ID in which the object is getting scanned. |
| RubrikPolaris.SonarOndemandScan.Status.cluster.name | String | Cluster name in which the object is getting scanned. |
| RubrikPolaris.SonarOndemandScan.Status.cluster.type | String | Cluster type in which the object is getting scanned. |

#### Command Example

```!rubrik-sonar-ondemand-scan-status crawl_id="bb4eedc0-594b-4566-b06d-24de0bf752ca"```

#### Human Readable Output

### Sonar On-Demand Scan Status

Final status of scan with crawl ID bb4eedc0-594b-4566-b06d-24de0bf752ca is IN_PROGRESS

|Object ID|Object Name|Scan Status|
|---|---|---|
| 6e307121-e5dc-5e6a-9a6b-37e1c9afd6b1 | AllTheThings | COMPLETE |
| a82e888c-2440-5af9-8c2a-447a97f6746c | /tmp | IN_PROGRESS |

### rubrik-polaris-vm-object-snapshot-list

***
Search for a Rubrik snapshot of an object based on the provided snapshot ID, exact timestamp, or specific value like earliest/latest, or closest before/after a timestamp.

#### Base Command

`rubrik-polaris-vm-object-snapshot-list`

#### Input

| **Argument Name** | **Description**                                                                                                                                                                                              | **Required** |
| --- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| object_id | The object ID for which the snapshots are to be searched.<br/><br/>Note: Users can get the list of the object IDs by executing the "rubrik-polaris-vm-objects-list" command.                                 | Required |
| snapshot_group_by | Grouping the snapshots on the basis of the selected value.<br/><br/>Possible values are: "Month", "Day", "Year", "Week", "Hour", "Quarter". Default is Day.                                                  | Optional |
| missed_snapshot_group_by | Grouping the missed snapshots on the basis of the selected value.<br/><br/>Possible values are: "MONTH", "DAY", "YEAR", "WEEK", "HOUR", "QUARTER". Default is DAY.                                           | Optional |
| start_date | The start date to get snapshots from.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.                                              | Required |
| end_date | The end date to get snapshots until.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.                                               | Required |
| timezone_offset | The timezone offset from UTC changes to match the configured time zone. Use this argument to filter the data according to the provided timezone offset.<br/><br/>Formats accepted: 1, 1.5, 2, 2.5, 5.5, etc. | Required |
| cluster_connected | Whether the cluster is connected or not.<br/><br/>Possible values are: "True", "False". Default is True.                                                                                                     | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.VSphereVm.id | String | Unique ID of the object. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.unit | String | Unit of snapshot group by connection nodes. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.start | String | Start date of snapshot group by connection nodes. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.groupByInfo.end | String | End date of snapshot group by connection nodes. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.count | Number | Count of snapshot connections related to the object. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.id | String | ID of snapshot connection related to the object. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.isIndexed | Boolean | Whether the node is indexed or not. |
| RubrikPolaris.VSphereVm.Snapshot.snapshotGroupByConnection.nodes.snapshotConnection.nodes.isUnindexable | Boolean | Whether the node is unindexable or not. |

#### Command Example

```!rubrik-polaris-vm-object-snapshot-list object_id="86db05d1-292f-5973-b616-2ae3977f4428" start_date="2020-05-19T18:30:00.000000Z" end_date="2020-05-20T18:30:00.000000Z" timezone_offset=5.5```

#### Human Readable Output

### VM Object Snapshots

|Snapshot Details|Snapshot IDs|
|---|---|
| Total Snapshots: 2<br/>Date Range: From 2020-05-19T22:30:00.000Z to 2020-05-20T22:29:59.999Z | 33060f59-9c99-5c48-8305-8d1edfe402d2,<br/>57eac609-9529-5cb5-845a-b7cc78998222 |

### rubrik-sonar-ondemand-scan-result

***
Retrieve the download link for the requested scanned file.

#### Base Command

`rubrik-sonar-ondemand-scan-result`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| crawl_id | ID for which file needs to be downloaded.<br/><br/>Note: Users can get the crawl_id by executing the "rubrik-sonar-ondemand-scan" command. | Required |
| file_type | The type of the file that needs to be downloaded.<br/><br/>Possible values are: "ANY", "HITS", "STALE", "OPEN_ACCESS", "STALE_HITS", "OPEN_ACCESS_HITS". | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarOndemandScan.crawlId | String | Crawl ID of the file that needs to be downloaded. |
| RubrikPolaris.SonarOndemandScan.Result.downloadLink | String | Link to download the file when scan status is complete. |

#### Command Example

```!rubrik-sonar-ondemand-scan-result crawl_id="bb4eedc0-594b-4566-b06d-24de0bf752ca" file_type="HITS"```

#### Human Readable Output

### Sonar On-Demand Scan Result

|Scan result CSV Download Link|
|---|
| Download the [CSV](https://www.example.com/csv_file) file to see the result. |

### rubrik-radar-anomaly-csv-analysis

***
Request for the analysis and retrieve the download link or directly download file for the Radar CSV analyzed file.

#### Base Command

`rubrik-radar-anomaly-csv-analysis`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| cluster_id | The unique ID of the cluster.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |
| snapshot_id | The CDM snapshot ID.<br/><br/>Note: Users can retrieve the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command.<br/>Use the "rubrik-radar-suspicious-file-list" command to retrieve the actual CDM ID from the Anomaly ID.<br/>Example format to get the snapshot CDM ID from Anomaly ID: "&lt;Cluster-ID&gt;:::VirtualMachine:::&lt;Snappable-ID&gt;:::&lt;CDM-ID&gt;". | Required |
| object_id | The VM object ID (Snappable ID).<br/><br/>Note: Users can retrieve the list of Snappable IDs by executing the "rubrik-polaris-vm-objects-list" command.<br/>Example format to get the Snappable ID: "VirtualMachine:::&lt;Snappable-ID&gt;". | Required |
| download_file | If set to True, the command downloads the anomaly analysis CSV file directly on XSOAR server.<br/><br/>Possible values are: True, False. Default is False. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.RadarAnomalyCSV.clusterId | String | Cluster ID of the CSV. |
| RubrikPolaris.RadarAnomalyCSV.snapshotId | String | Snapshot ID of the CSV. |
| RubrikPolaris.RadarAnomalyCSV.objectId | String | Object ID of the CSV. |
| RubrikPolaris.RadarAnomalyCSV.investigationCsvDownloadLink.downloadLink | String | The download link of the CSV analysis. |
| File.Size | String | File size in bytes. |
| File.SHA1 | String | SHA1 hash of file. |
| File.SHA256 | String | SHA256 hash of file. |
| File.SHA512 | String | SHA512 hash of file. |
| File.Name | String | File name. |
| File.SSDeep | String | SSDeep hash of the file. |
| File.EntryID | Unknown | The entry ID of the file. |
| File.Info | String | File information. |
| File.Type | String | The file type. |
| File.MD5 | String | MD5 hash of the file. |
| File.Extension | String | The file extension. |

#### Command Example

```!rubrik-radar-anomaly-csv-analysis cluster_id="0000-000-000-000-0000" snapshot_id="0000-000-000-000-0000" object_id="0000-000-000-000-vm-0000" download_file=True```

#### Human Readable Output
>
>### Radar Anomaly CSV Analysis
>
>|CSV Download Link|
>|---|
>| Download the analyzed [CSV](https://www.example.com/snapshot_000-000-000-000.csv) file. |

>Uploaded file: snapshot_000-000-000-000.csv Download
>
>|Property|Value|
>|---|---|
>| Type | text/csv; charset=utf-8 |
>| Size | 10,069 bytes |
>| Info | ASCII text, with very long lines |
>| MD5 | 10000000000000000000000000 |
>| SHA1 | 1000000000000000000000000000000 |
>| SHA256 | 1000000000000000000000000000000000000000000000000000000000 |
>| SHA512 | 10000000000000000000000000000000000000000000000000000000000000000000000 |
>| SSDeep | 1:100000000000000000000000000000000000000000000000000000000: |

### rubrik-sonar-csv-download

***
Request to download the Sonar CSV Snapshot results file.

Note: To know the ID and status of the download, use the "rubrik-user-downloads-list" command. To download the file, use the "rubrik-sonar-csv-result-download" command.

#### Base Command

`rubrik-sonar-csv-download`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| snapshot_id | ID of the snapshot.<br/><br/>Note: Users can retrieve the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list"  command. | Required |
| object_id | Object ID.<br/><br/>Note: Users can retrieve the list of object IDs by executing "rubrik-polaris-vm-objects-list" command. | Required |
| file_type | The type of the file that needs to be downloaded.<br/><br/>Possible values are: "ANY", "HITS", "STALE", "OPEN_ACCESS", "STALE_HITS", "OPEN_ACCESS_HITS". | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarCSVDownload.snapshotId | String | Snapshot ID of the CSV requested to download. |
| RubrikPolaris.SonarCSVDownload.objectId | String | Object ID of the CSV requested to download. |
| RubrikPolaris.SonarCSVDownload.downloadSnapshotResultsCsv.isSuccessful | Boolean | The status of the download. |

#### Command Example

```!rubrik-sonar-csv-download snapshot_id="c38ec074-0c45-5c72-b611-3322cbd46776" object_id="ac0a6844-a2fc-52b0-bb71-6a55f43677be"```

#### Human Readable Output

### Sonar CSV Download

|Download Status|
|---|
| Success |

### rubrik-gps-snapshot-files-list

***
Retrieve the list of the available files that can be downloaded.

Note: To initiate the file download request use the "rubrik-gps-snapshot-files-download" command.

#### Base Command

`rubrik-gps-snapshot-files-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| snapshot_id | The Snapshot ID of the file that needs to be downloaded.<br/><br/>Note: Users can retrieve the list of the snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command. | Required |
| path | The path of the folder to list the sub-files. If not provided the root directory files will be returned.<br/><br/>Format accepted : "/&lt;directory name&gt;/&lt;sub directory name or file name&gt;"<br/><br/>Example: "/C:", "/C:/Users". | Optional |
| search_prefix | Provide a keyword to search in the file names.<br/><br/>Example: "admin". | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSSnapshotFile.snapshotId | String | Snapshot ID provided as an argument to retrieve the files. |
| RubrikPolaris.GPSSnapshotFile.node.absolutePath | String | The absolute path of the file. |
| RubrikPolaris.GPSSnapshotFile.node.displayPath | String | The display path of the file. |
| RubrikPolaris.GPSSnapshotFile.node.path | String | The path of the file. |
| RubrikPolaris.GPSSnapshotFile.node.filename | String | The name of the file. |
| RubrikPolaris.GPSSnapshotFile.node.fileMode | String | The mode of the file. |
| RubrikPolaris.GPSSnapshotFile.node.size | String | The size of the file. |
| RubrikPolaris.GPSSnapshotFile.node.lastModified | String | The last modified time of the file. |
| RubrikPolaris.PageToken.GPSSnapshotFile.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.GPSSnapshotFile.name | String | Name of the command. |
| RubrikPolaris.PageToken.GPSSnapshotFile.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-gps-snapshot-files-list snapshot_id=90858c2f-e572-5b9c-b455-ba309d50c1a2```

#### Human Readable Output

### GPS Snapshot Files

|File Name|Absolute Path|Path|File Mode|Last Modified|
|---|---|---|---|---|
| C: | /C: | C: | DIRECTORY | 2020-10-05T18:56:18.000Z |
| disk_0_part_1 | /disk_0_part_1 |  | DIRECTORY | 2018-06-14T00:47:18.000Z |

Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-gps-vm-export

***
Request to initiate an export of a snapshot of a virtual machine.

Note: To know about the exported VM's status, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-vm-export`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| vm_name | Name given to the VM that runs the snapshot. If not provided the name will be "&lt;Snapshot VM Name&gt; &lt;MM/DD of snapshot creation&gt; &lt;hh/mm of snapshot creation&gt; &lt;Num&gt;". | Optional |
| object_id | The VM object ID whose snapshot needs to be exported.<br/><br/>Note: Users can get the list of object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |
| snapshot_id | The ID of the snapshot that is to be exported.<br/><br/>Note: Users can get the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command. | Required |
| datastore_id | The ID of the datastore which will be used by the new VM.<br/><br/>Note: Users can get the list of  datastore IDs by executing the "rubrik-gps-vm-datastore-list" command. | Required |
| host_id | The ID of the Vsphere ESXi host on which the new VM will be made. Either host_id or host_compute_cluster_id must be provided.<br/><br/>Note: Users can get the list of host IDs by executing the "rubrik-gps-vm-host-list" command. | Optional |
| host_compute_cluster_id | The ID of the VSphere Compute Cluster of a host. Either host_id or host_compute_cluster_id must be provided. <br/><br/>Note: Users can get the list of Compute Cluster IDs by executing the "rubrik-gps-vm-host-list" command. The ID must belong to the VSphereComputeCluster objectType. | Optional |
| power_on | Whether to turn on the new VM or not.<br/><br/>Possible values are: "True", "False". | Optional |
| keep_mac_addresses | Whether the mac addresses of network devices of the new VM be removed or not.<br/><br/>Possible values are: "True", "False". | Optional |
| remove_network_devices | Whether the network devices on the original VM be kept or not.<br/><br/>Possible values are: "True", "False". | Optional |
| recover_tags | Whether to keep vSphere tags associated with the original VM or not.<br/><br/>Possible values are: "True", "False". | Optional |
| disable_network | Whether to disable networking on the new VM or not.<br/><br/>Possible values are: "True", "False". | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMSnapshotExport.id | String | Snapshot export request ID. |

#### Command Example

```!rubrik-gps-vm-export object_id=d39e956f-a3c9-5307-865b-58ed045b59c5 snapshot_id=07fa66e1-137a-5473-8a8e-825547075d7b datastore_id=5fe3a92a-d848-5325-a1a2-ef6cf7a16376 host_compute_cluster_id=0dc88a78-0d46-57d7-86c6-f1bd97ff979f```

#### Human Readable Output

### GPS VM Export

|Snapshot Export Request ID|
|---|
| dummy_id |

### rubrik-user-downloads-list

***
Retrieve the user downloads. This would return the current and past download history.

Note: To download the requested Sonar CSV Snapshot results file use the "rubrik-sonar-csv-result-download" command.

#### Base Command

`rubrik-user-downloads-list`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.UserDownload.id | Number | The ID of the download. |
| RubrikPolaris.UserDownload.name | String | The name of the download. |
| RubrikPolaris.UserDownload.status | String | The status of the download. |
| RubrikPolaris.UserDownload.progress | Number | The progress of the download. |
| RubrikPolaris.UserDownload.identifier | String | The identifier of the download or the type of download requested. |
| RubrikPolaris.UserDownload.createTime | String | The creation time of the download. |
| RubrikPolaris.UserDownload.completeTime | String | The completion time of the download. |

#### Command Example

```!rubrik-user-downloads-list```

#### Human Readable Output

### User Downloads

|Download ID|Name|Status|Identifier|Creation Time|Completion Time|
|---|---|---|---|---|---|
| 156 | GDIT-billing-test-oct10 | COMPLETED | SONAR_DOWNLOAD | 2021-10-06T07:25:51.676432470Z | 2021-10-06T07:25:51.856374014Z |

### rubrik-gps-sla-domain-list

***
Enumerates the available SLA Domains to apply to the on-demand snapshot as a retention policy.

#### Base Command

`rubrik-gps-sla-domain-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | Name of the SLA Domain to search for. | Optional |
| cluster_id | Cluster, the SLA domain is managed by.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Optional |
| object_type | Filters SLA domain based on the provided object types. Supports comma separated values. <br/><br/>Possible values are: "FILESET_OBJECT_TYPE", "VSPHERE_OBJECT_TYPE". | Optional |
| show_cluster_slas_only | Whether to show Cluster SLAs and not Global SLAs. "False" value will result in showing only Global SLAs. <br/><br/>Possible values are: "True", "False". Default is True. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Possible values are: "NAME", "PROTECTED_OBJECT_COUNT". Default is NAME. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSSLADomain.name | String | Name of the SLA domain. |
| RubrikPolaris.GPSSLADomain.id | String | ID of the SLA domain. |
| RubrikPolaris.GPSSLADomain.description | String | Description of the SLA domain. |
| RubrikPolaris.GPSSLADomain.protectedObjectCount | Number | Number of objects under the SLA Domain. |
| RubrikPolaris.GPSSLADomain.baseFrequency.duration | Number | Base snapshot frequency duration. |
| RubrikPolaris.GPSSLADomain.baseFrequency.unit | String | Base snapshot frequency unit \(HOURS, DAYS etc\). |
| RubrikPolaris.GPSSLADomain.archivalSpec.archivalLocationName | String | Location where the archives are stored. |
| RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.id | String | ID of the archival target. |
| RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.name | String | Name of the archival target. |
| RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.groupType | String | Group type of the archival target. |
| RubrikPolaris.GPSSLADomain.archivalSpecs.storageSetting.targetType | String | Target type of the archival target. |
| RubrikPolaris.GPSSLADomain.replicationSpec.replicationType | String | Enum value representing the type of replication. Values: UNKNOWN_REPLICATION_TYPE, UNIDIRECTIONAL_REPLICATION_TO_CLUSTER, REPLICATION_TO_CLOUD_REGION, REPLICATION_TO_CLOUD_LOCATION. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.unidirectionalSpec.replicationTargetName | String | Cloud replication target name. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudRegionSpec.replicationTargetRegion | String | Cloud replication target region. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudRegionSpec.cloudProvider | String | Cloud replication service provider. Values:  AWS, AZURE. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudLocationSpec.targetMapping.id | String | ID of the cloud target where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpec.specificReplicationSpec.cloudLocationSpec.targetMapping.name | String | Name of the cloud target where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.cluster.id | String | ID of the cluster where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.cluster.name | String | Name of the cluster where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.accountId | String | Account ID on AWS where the replication happens. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.accountName | String | Account name on AWS where the replication happens. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.awsTarget.region | String | Account region on AWS where the replication happens. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.azureTarget.region | String | Account region on Azure where the replication happens. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.retentionDuration.duration | Number | Replication retention duration. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.retentionDuration.unit | String | Replication retention duration unit. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.targetMapping.id | String | ID of the object target where replication takes place. |
| RubrikPolaris.GPSSLADomain.replicationSpecsV2.targetMapping.name | String | Name of the object target where replication takes place. |
| RubrikPolaris.GPSSLADomain.localRetentionLimit.duration | Number | Local retention limit duration. |
| RubrikPolaris.GPSSLADomain.localRetentionLimit.unit | String | Local retention limit duration unit. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.frequency | Number | Snapshot frequency every minute. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.retention | Number | Snapshot retention value per minute snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.minute.basicSchedule.retentionUnit | String | Snapshot retention time unit per minute snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.frequency | Number | Snapshot hourly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.retention | Number | Snapshot retention value per hour snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.hourly.basicSchedule.retentionUnit | String | Snapshot retention time unit per hour snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.frequency | Number | Snapshot daily frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.retention | Number | Snapshot retention value per day snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.daily.basicSchedule.retentionUnit | String | Snapshot retention unit per day snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.frequency | Number | Snapshot weekly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.retention | Number | Snapshot retention value per week snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.basicSchedule.retentionUnit | String | Snapshot retention unit per week snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.weekly.dayOfWeek | String | Starting day of the weekly snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.frequency | Number | Snapshot monthly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.retention | Number | Snapshot retention value per month snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.basicSchedule.retentionUnit | String | Snapshot retention unit per month snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.monthly.dayOfMonth | String | Starting day of the month snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.frequency | Number | Snapshot quarterly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.retention | Number | Snapshot retention value per quarter snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.basicSchedule.retentionUnit | String | Snapshot retention unit per quarter snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.dayOfQuarter | String | Starting day of the quarterly snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.quarterly.quarterStartMonth | String | Starting month of the quarterly snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.frequency | Number | Snapshot yearly frequency. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.retention | Number | Snapshot retention value per year snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.basicSchedule.retentionUnit | String | Snapshot retention unit per year snapshots. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.dayOfYear | String | Starting day of the yearly snapshot. |
| RubrikPolaris.GPSSLADomain.snapshotSchedule.yearly.yearStartMonth | String | Starting month of the yearly snapshot. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.awsRdsConfig.logRetention.duration | Number | Duration of retentioning AWS Relational database logs. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.awsRdsConfig.logRetention.unit | String | Unit of duration of retentioning AWS Relational database logs. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.incrementalFrequency.duration | Number | Duration of retentioning SAP HANA incremental backups. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.incrementalFrequency.unit | String | Unit of duration of retentioning SAP HANA incremental backups. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.differentialFrequency.duration | Number | Duration of retentioning SAP HANA differential backups. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.differentialFrequency.unit | String | Unit of duration of retentioning SAP HANA differential backups. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.logRetention.duration | Number | Duration of retensioning SAP HANA Database logs. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.sapHanaConfig.logRetention.unit | String | Unit of duration of retentioning SAP HANA Database logs. |
| RubrikPolaris.GPSSLADomain.objectSpecificConfigs.vmwareVmConfig.logRetentionSeconds | Number | Seconds of retentioning VMWare virtual machine logs. |
| RubrikPolaris.GPSSLADomain.objectTypes | Unknown | List of object types associated with this SLA Domain. |

#### Command Example

```!rubrik-gps-sla-domain-list cluster_id=4d4a41d5-8910-4e4d-9dca-0798f5fc6d61 limit=2```

#### Human Readable Output

### GPS SLA Domains

|SLA Domain ID|SLA Domain Name|Base Frequency|Protected Object Count|Archival Location|Description|Replication Target 1|Replication Target 2|
|---|---|---|---|---|---|---|---|
| 00000000-0000-0000-0000-000000000002 | Bronzecd | 1 Days | 0 | AWS S3:bucket-1234 | Rubrik default Bronze level SLA Domain policy | sand2-rbk01 | sand2-rbk02 |
| 00000000-0000-0000-0000-000000000000 | Gold | 4 Hours | 0 |  | Rubrik default Gold level SLA Domain policy | sand2-rbk01 |  |

### rubrik-sonar-csv-result-download

***
Retrieve the download link for the requested Sonar CSV Snapshot file.

#### Base Command

`rubrik-sonar-csv-result-download`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| download_id | The ID of the download, requested using "rubrik-sonar-csv-download" command.<br/><br/>Note: Users can retrieve the list of downloads containing ID by executing the "rubrik-user-downloads-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.SonarCSVDownload.downloadId | String | The download ID of the download request. |
| RubrikPolaris.SonarCSVDownload.getDownloadUrl.url | String | The link of the file that needs to be downloaded. |

#### Command Example

```!rubrik-sonar-csv-result-download download_id=65```

#### Human Readable Output

### Sonar CSV Result

|Download URL|
|---|
| Download the [CSV](https://www.example.com/csv_file) file to see the result. |

### rubrik-gps-vm-snapshot-create

***
Triggers an on-demand snapshot of a system.

Note: To know about the status of the on-demand snapshot creation, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-vm-snapshot-create`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| object_id | The ID of the object whose snapshot is to be created. <br/><br/>Note: Users can get the list of object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |
| sla_domain_id | The ID of the SLA domain retention policy to be applied on the object.<br/><br/>Note: Users can get the list of SLA Domain IDs by executing the "rubrik-gps-sla-domain-list" command. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSOndemandSnapshot.id | String | ID of the requested snapshot. |
| RubrikPolaris.GPSOndemandSnapshot.status | String | Status of the requested snapshot. |

#### Command Example

```!rubrik-gps-vm-snapshot-create object_id=ac0a6844-a2fc-52b0-bb71-6a55f43677be```

#### Human Readable Output

### GPS VM Snapshot

|On-Demand Snapshot Request ID|Status|
|---|---|
| dummy_id | QUEUED |

### rubrik-gps-snapshot-files-download

***
Request to download the snapshot file from the backup.

Note: To know about the file information and which file can be downloaded, use the "rubrik-gps-snapshot-files-list" command. To know about the status of the downloadable files, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-snapshot-files-download`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| snapshot_id | The Snapshot ID of the file that needs to be downloaded.<br/><br/>Note: Users can retrieve the list of the snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command. | Required |
| file_path | The absolute path of the file to be downloaded. A list of files can be downloaded as a zip folder. Multiple file paths can be separated with comma(,).<br/><br/>Note: Users can retrieve the list of the files with absolute path by executing the "rubrik-gps-snapshot-files-list" command.<br/><br/>Format accepted: "/&lt;directory name&gt;/&lt;sub directory name or file name&gt;"<br/><br/>Example: "/C:/PerfLogs/Admin", "/C:/Windows/Microsoft.NET". | Required |
| object_type | The type of object for which the file to be downloaded.<br/><br/>Possible values are: "WindowsFileset", "LinuxFileset", "VolumeGroup", "VmwareVm". Default is VmwareVm. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSSnapshotFileDownload.id | String | The ID of the download. |
| RubrikPolaris.GPSSnapshotFileDownload.status | String | Status of the download. |
| RubrikPolaris.GPSSnapshotFileDownload.links.href | String | Link of the download. |
| RubrikPolaris.GPSSnapshotFileDownload.links.rel | String | Relationship of the download. |

#### Command Example

```!rubrik-gps-snapshot-files-download snapshot_id=3765b5b5-827b-5588-8c34-5cb737a28685 file_path="/.autorelabel"```

#### Human Readable Output

### Snapshot File Request ID

|ID|Status|
|---|---|
| dummy_id | QUEUED |

### rubrik-gps-vm-livemount

***
Performs a live mount of a virtual machine snapshot.

Note: To know about the live mount status, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-vm-livemount`

#### Input

| **Argument Name** | **Description**                                                                                                                                                                             | **Required** |
| --- |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| snappable_id | The snappable ID.                                                                                                                                                                           | Required |
| should_recover_tags | Whether to keep vSphere tags associated with the VM or not.<br/><br/>Possible values are: "True", "False". Default is True.                                                                 | Optional |
| power_on | Whether to power on the mount or not.<br/><br/>Possible values are: "True", "False". Default is True.                                                                                       | Optional |
| keep_mac_addresses | Whether the mac addresses of network devices be removed or not.<br/><br/>Possible values are: "True", "False". Default is False.                                                            | Optional |
| remove_network_devices | Whether the network devices of the original VM be kept.<br/><br/>Possible values are: "True", "False". Default is False.                                                                    | Optional |
| host_id | The ID of the Vsphere ESXi host on which the new VM will be mounted.<br/><br/>Note: Users can get the list of host IDs by executing the "rubrik-gps-vm-host-list" command.                  | Optional |
| cluster_id | ID of the compute cluster where the new VM will be mounted.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.               | Optional |
| resource_pool_id | ID of the resource pool where the new VM will be mounted.                                                                                                                                   | Optional |
| snapshot_fid | ID of the snapshot to recover.                                                                                                                                                              | Optional |
| vm_name | Name given to the VM that runs the snapshot. If not provided the name will be "&lt;Snapshot VM Name&gt; &lt;MM/DD of snapshot creation&gt; &lt;hh/mm of snapshot creation&gt; &lt;Num&gt;". | Optional |
| vnic_bindings | List of network bindings for vNIC of the VM.  <br/><br/> e.g. [{"networkDeviceInfo":{"key":2000,"name":"Network adapter"},"backingNetworkInfo":{"moid":"db68871d-0fbf-5551-97de-4c234885766b","name":"Router"}}]            | Optional |
| recovery_point | Point in time to recover to, e.g.: "2023-03-04T05:06:07.890".                                                                                                                               | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMLiveMount.id | String | ID of the Live mount request. |

#### Command Example

```!rubrik-gps-vm-livemount snapshot_id=d680b484-0084-5231-a05d-18e9cd5402fc vm_name=live-mount-demo```

#### Human Readable Output

### GPS VM Livemount

|VM Live Mount Request ID|
|---|
| dummy_id |

### rubrik-gps-vm-host-list

***
Retrieve the list of available Vsphere Hosts.

#### Base Command

`rubrik-gps-vm-host-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | The name of the host to search for. | Optional |
| cluster_id | To list hosts from the specific cluster.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Supported values are "ID" and "NAME" only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMHost.id | String | ID of the Vsphere host. |
| RubrikPolaris.GPSVMHost.name | String | Name of the Vsphere host. |
| RubrikPolaris.GPSVMHost.physicalPath.fid | String | ID of a physical path of a node. |
| RubrikPolaris.GPSVMHost.physicalPath.name | String | Name of a physical path of a node. |
| RubrikPolaris.GPSVMHost.physicalPath.objectType | String | Type of a physical path of a node, for example, VSphereComputeCluster, VSphereDatacenter etc. |
| RubrikPolaris.PageToken.GPSVMHost.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.GPSVMHost.name | String | Name of the command. |
| RubrikPolaris.PageToken.GPSVMHost.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-gps-vm-host-list```

#### Human Readable Output

### GPS VM Hosts

|VSphere Host ID|Name|Physical Host|
|---|---|---|
| f57bfebf-c7c9-5310-a5fd-1f0aeea5ba25 | sjc-40302-sand1-esx02.rubrikdemo.com | {'id': '72480b29-0eaa-57a9-8c5c-45b7e1c2c826', 'name': 'Sandbox-1 SJC Cluster', 'objectType': 'VSphereComputeCluster'},<br/>{'id': '3f3a92de-c7f3-57f7-989f-3731db83aeab', 'name': 'Sandbox-1 Datacenter', 'objectType': 'VSphereDatacenter'},<br/>{'id': '415859e2-fd22-53ea-8de1-041d99298fe3', 'name': 'sand1-vcsa.rubrikdemo.com', 'objectType': 'VSphereVCenter'} |

### rubrik-gps-vm-datastore-list

***
Retrieve the list of the available datastores on a Vsphere Host.

#### Base Command

`rubrik-gps-vm-datastore-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | The name of the datastore to search for. | Optional |
| host_id | The ID of a Vsphere host whose datastores are to be listed.<br/><br/>Note: Users can get the list of host IDs by executing the "rubrik-gps-vm-host-list" command. | Required |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Supported values are "ID" and "NAME" only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMHost.id | String | ID of the Vsphere host. |
| RubrikPolaris.GPSVMHost.Datastore.id | String | ID of the Vsphere datastore. |
| RubrikPolaris.GPSVMHost.Datastore.name | String | Name of the Vsphere datastore. |
| RubrikPolaris.GPSVMHost.Datastore.capacity | Number | Datastore capacity in bytes. |
| RubrikPolaris.GPSVMHost.Datastore.isLocal | Boolean | Whether the datastore is local or remote. |
| RubrikPolaris.GPSVMHost.Datastore.freeSpace | Number | Free space on the datastore in bytes. |
| RubrikPolaris.GPSVMHost.Datastore.datastoreType | String | Type of datastore, for example, "NFS",  "VMFS" etc. |
| RubrikPolaris.PageToken.GPSVMHost.Datastore.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.GPSVMHost.Datastore.name | String | Name of the command. |
| RubrikPolaris.PageToken.GPSVMHost.Datastore.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-gps-vm-datastore-list```

#### Human Readable Output

### GPS VM Datastores

|VSphere Datastore ID|Name|Capacity|Free Space|Datastore Type|
|---|---|---|---|---|
| dummy_datastore_id | dummy-repo | 0.53362190336 TB | 0.188318314496 TB | NFS |

### rubrik-event-list

***
Retrieve the list of events.

#### Base Command

`rubrik-event-list`

#### Input

| **Argument Name** | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | **Required** |
| --- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| activity_status | Filter the events based on the provided activity statuses. Supports comma separated values.<br/><br/>Possible values are: "UNKNOWN_EVENT_STATUS", "SUCCESS", "FAILURE", "INFO", "CANCELED", "RUNNING", "WARNING", "CANCELING", "TASK_SUCCESS", "QUEUED", "TASK_FAILURE", "PARTIAL_SUCCESS".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Optional |
| activity_type | Filter the events based on provided activity types. Supports comma separated values.<br/><br/>Possible values are: "UNKNOWN_EVENT_TYPE", "ARCHIVE", "AUTH_DOMAIN", "AWS_EVENT", "BACKUP", "CLASSIFICATION", "CLOUD_NATIVE_SOURCE", "CLOUD_NATIVE_VIRTUAL_MACHINE", "CLOUD_NATIVE_VM", "CONFIGURATION", "CONVERSION", "CONNECTION", "DIAGNOSTIC", "DISCOVERY", "DOWNLOAD", "FAILOVER", "FILESET", "HARDWARE", "HDFS", "HOST_EVENT", "HYPERV_SCVMM", "HYPERV_SERVER", "INDEX", "INSTANTIATE", "LEGAL_HOLD", "LOCAL_RECOVERY", "MAINTENANCE", "NUTANIX_CLUSTER", "RANSOMWARE_INVESTIGATION_ANALYSIS", "RECOVERY", "REPLICATION", "RESOURCE_OPERATIONS", "ANOMALY", "STORAGE", "STORAGE_ARRAY", "STORM_RESOURCE", "SUPPORT", "SYNC", "SYSTEM", "TEST_FAILOVER", "THREAT_HUNT", "TPR", "LOCK_SNAPSHOT", "UPGRADE", "VCENTER", "VCD", "VOLUME_GROUP", "EMBEDDED_EVENT", "ISOLATED_RECOVERY", "OWNERSHIP", "LOG_BACKUP", "K8S".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Optional |
| severity | Filter the events based on provided severities. Supports comma separated values.<br/><br/>Possible values are: "SEVERITY_INFO", "SEVERITY_CRITICAL", "SEVERITY_WARNING".                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Optional |
| object_name | Filter out events based on object name.<br/><br/>Note: Users can get the object names by executing the "rubrik-polaris-vm-objects-list" or "rubrik-polaris-object-search" command.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Optional |
| object_type | Filter the events based on provided object types. Supports comma separated values.<br/><br/>Possible values are: "UNKNOWN_EVENT_OBJECT_TYPE", "RUBRIK_SAAS_ACCOUNT", "APP_BLUEPRINT", "APP_FLOWS", "OBJECT_TYPE_AUTH_DOMAIN", "AWS_ACCOUNT", "AWS_EVENT_TYPE", "AZURE_NATIVE_SUBSCRIPTION", "AZURE_NATIVE_VM", "AZURE_NATIVE_DISK", "AZURE_SQL_DATABASE", "AZURE_SQL_MANAGED_INSTANCE", "AZURE_SQL_DATABASE_SERVER", "AZURE_SQL_MANAGED_INSTANCE_DATABASE", "CAPACITY_BUNDLE", "OBJECT_TYPE_CLOUD_NATIVE_VIRTUAL_MACHINE", "OBJECT_TYPE_CLOUD_NATIVE_VM", "CERTIFICATE", "CLUSTER", "COMPUTE_INSTANCE", "DATA_LOCATION", "DB2_DATABASE", "DB2_INSTANCE", "EC2_INSTANCE", "ENVOY", "FAILOVER_CLUSTER_APP", "EXOCOMPUTE", "EXCHANGE_DATABASE", "OBJECT_TYPE_HDFS", "HOST", "OBJECT_TYPE_HYPERV_SCVMM", "OBJECT_TYPE_HYPERV_SERVER", "HYPERV_VM", "JOB_INSTANCE", "LDAP", "LINUX_FILESET", "LINUX_HOST", "MANAGED_VOLUME", "MSSQL", "NAS_FILESET", "WEBHOOK", "NAS_HOST", "NAS_SYSTEM", "OBJECT_TYPE_NUTANIX_CLUSTER", "NUTANIX_VM", "O365_CALENDAR", "O365_MAILBOX", "O365_ONEDRIVE", "O365_SITE", "O365_SHARE_POINT_DRIVE", "O365_SHARE_POINT_LIST", "O365_TEAM", "O365_ORGANIZATION", "O365_GROUP", "OBJECT_PROTECTION", "ORACLE", "ORACLE_DB", "ORACLE_HOST", "ORACLE_RAC", "AWS_NATIVE_ACCOUNT", "AWS_NATIVE_EBS_VOLUME", "AWS_NATIVE_EC2_INSTANCE", "RUBRIK_SAAS_EBS_VOLUME", "RUBRIK_SAAS_EC2_INSTANCE", "PUBLIC_CLOUD_MACHINE_INSTANCE", "SAML_SSO", "SAP_HANA_DB", "SAP_HANA_SYSTEM", "SHARE_FILESET", "SLA_DOMAIN", "SMB_DOMAIN", "SNAP_MIRROR_CLOUD", "OBJECT_TYPE_STORAGE_ARRAY", "STORAGE_ARRAY_VOLUME_GROUP", "STORAGE_LOCATION", "STORM", "SUPPORT_BUNDLE", "USER", "OBJECT_TYPE_UPGRADE", "OBJECT_TYPE_VCD", "VCD_VAPP", "OBJECT_TYPE_VCENTER", "VMWARE_COMPUTE_CLUSTER", "VMWARE_VM", "OBJECT_TYPE_VOLUME_GROUP", "WINDOWS_FILESET", "WINDOWS_HOST", "GCP_NATIVE_PROJECT", "AWS_NATIVE_RDS_INSTANCE", "GCP_NATIVE_GCE_INSTANCE", "GCP_NATIVE_DISK", "KUPR_CLUSTER", "KUPR_NAMESPACE", "CASSANDRA_COLUMN_FAMILY", "CASSANDRA_KEYSPACE", "CASSANDRA_SOURCE", "MONGODB_COLLECTION", "MONGODB_DATABASE", "MONGODB_SOURCE", "CLOUD_DIRECT_NAS_EXPORT", "MONGO_COLLECTION", "MONGO_DATABASE", "MONGO_SOURCE", "CERTIFICATE_MANAGEMENT", "AWS_NATIVE_S3_BUCKET", "AZURE_STORAGE_ACCOUNT", "K8S_CLUSTER", "K8S_RESOURCE_SET", "AZURE_AD_TENANT". | Optional |
| cluster_id | Filter the events based on provided cluster IDs. Supports comma separated values.<br/><br/>Note: Users can get the list of cluster IDs by executing the "rubrik-gps-cluster-list" command.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Optional |
| start_date | The start date to fetch updated events from.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Optional |
| end_date | The end date to fetch updated events until.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Optional |
| next_page_token | The next page cursor to retrieve the next set of results.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Possible values are: "LAST_UPDATED", "LOCATION", "OBJECT_TYPE", "CLUSTER_NAME", "OBJECT_NAME", "START_TIME", "ACTIVITY_TYPE", "SEVERITY", "ACTIVITY_STATUS". Default is LAST_UPDATED.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC","DESC". Default is DESC.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.Event.id | Number | ID of the event. |
| RubrikPolaris.Event.startTime | String | Start time of the event. |
| RubrikPolaris.Event.fid | String | FID of the event. |
| RubrikPolaris.Event.activitySeriesId | String | Activity Series ID of the event. |
| RubrikPolaris.Event.lastUpdated | String | Date time when the event was last updated. |
| RubrikPolaris.Event.lastActivityType | String | Last Activity Type of the event. |
| RubrikPolaris.Event.lastActivityStatus | String | Last Activity Status of the event. |
| RubrikPolaris.Event.location | String | Location of the event. |
| RubrikPolaris.Event.objectId | String | ID of the object. |
| RubrikPolaris.Event.objectName | String | Name of the object. |
| RubrikPolaris.Event.objectType | String | Type of the object. |
| RubrikPolaris.Event.severity | String | Severity of the event. |
| RubrikPolaris.Event.progress | String | Progress of the event. |
| RubrikPolaris.Event.cluster.id | String | The ID of the cluster. |
| RubrikPolaris.Event.cluster.name | String | The name of the cluster. |
| RubrikPolaris.Event.activityConnection.nodes.id | String | ID of the activity connection. |
| RubrikPolaris.Event.activityConnection.nodes.message | String | Message of the activity connection. |
| RubrikPolaris.Event.activityConnection.nodes.severity | String | Severity of the activity connection. |
| RubrikPolaris.Event.activityConnection.nodes.time | String | Date time when the activity connection was last updated. |
| RubrikPolaris.PageToken.Event.next_page_token | String | Next page token. |
| RubrikPolaris.PageToken.Event.name | String | Name of the command. |
| RubrikPolaris.PageToken.Event.has_next_page | Boolean | Whether the result has the next page or not. |

#### Command Example

```!rubrik-event-list limit=1```

#### Human Readable Output

### Events

|Event ID|Activity Series ID|Cluster ID|Object ID|Object Name|Severity|Start Time|Last Updated|Last Activity Type|Last Activity Status|
|---|---|---|---|---|---|---|---|---|---|
| 7739500 | 422d17c0-737d-44df-98a0-a7fa9f714c0d | cc19573c-db6c-418a-9d48-067a256543ba | Fileset:::f2666679-5b94-4116-9cbf-6ab69e575522 | AllTheThings | Info | 2021-10-25T12:15:36.911Z | 2021-10-25T12:16:10.212Z | Index | Success |

 Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-polaris-object-list

***
Retrieve the list of Rubrik objects, based on the provided filters.

#### Base Command

`rubrik-polaris-object-list`

#### Input

| **Argument Name** | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | **Required** |
| --- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| type_filter | Filter the objects based on the provided object types. Supports comma separated values.<br/><br/>Possible values are: "MONGODB_DATABASE", "FilesetTemplate", "VcdOrgVdc", "ShareFileset", "KuprNamespace", "O365Group", "AwsNativeEbsVolume", "OracleDatabase", "O365Mailbox", "MONGO_DB", "AzureNativeResourceGroup", "AZURE_SQL_MANAGED_INSTANCE_DB", "Db2Database", "HOST_FAILOVER_CLUSTER", "VolumeGroup", "AzureNativeVm", "VcdOrg", "Db2Instance", "PhysicalHost", "AwsNativeRdsInstance", "AzureSqlManagedInstanceServer", "O365Site", "VmwareVirtualMachine", "O365User", "ORACLE_DATA_GUARD_GROUP", "AwsNativeEc2Instance", "MssqlInstance", "NutanixVirtualMachine", "CASSANDRA_COLUMN_FAMILY", "MONGO_COLLECTION", "O365Org", "OracleHost", "NAS_FILESET", "SapHanaDatabase", "AllSubHierarchyType", "AWS_NATIVE_S3_BUCKET", "NasSystem", "O365Teams", "VSphereFolder", "VSphereResourcePool", "GcpNativeDisk", "AwsNativeAccount", "VSphereDatacenter", "AZURE_STORAGE_ACCOUNT", "VSphereComputeCluster", "HypervCluster", "CASSANDRA_SOURCE", "VSphereTag", "VcdVapp", "RubrikEbsVolume", "NasVolume", "NasNamespace", "Vcd", "VcdVimServer", "AZURE_SQL_DATABASE_DB", "VSPHERE_VIRTUAL_DISK", "MssqlDatabaseBatchMaintenance", "EXCHANGE_SERVER", "CLOUD_DIRECT_NAS_EXPORT", "VcdCatalog", "O365File", "HypervSCVMM", "Blueprint", "AzureSqlDatabaseServer", "FeldsparSite", "CloudNativeTagRule", "Mssql", "MONGO_SOURCE", "HostShare", "SnapMirrorCloud", "O365Calendar", "O365SharePointDrive", "VSphereNetwork", "Fileset", "SapHanaSystem", "O365Onedrive", "Hdfs", "Ec2Instance", "WindowsCluster", "GcpNativeProject", "MONGODB_COLLECTION", "MONGO_DATABASE", "VSphereDatastore", "AZURE_AD_TENANT", "HypervServer", "VSphereHost", "AppBlueprint", "MssqlAvailabilityGroup", "LinuxFileset", "MANAGED_VOLUME_EXPORT", "CASSANDRA_KEYSPACE", "HypervVirtualMachine", "GcpNativeGCEInstance", "StorageArrayVolumeGroup", "O365SharePointList", "ExchangeDatabase", "NutanixCluster", "AzureNativeManagedDisk", "AzureNativeSubscription", "VSPHERE_DATASTORE_CLUSTER", "ManagedVolume", "FAILOVER_CLUSTER_APP", "VSphereVCenter", "NasShare", "EXCHANGE_DAG", "KuprCluster", "OracleRac", "MONGODB_SOURCE", "ORCHESTRATED_APPLICATION_RECOVERY_BLUEPRINT", "VSphereTagCategory", "ORCHESTRATED_APPLICATION_RECOVERY_PLAN", "WindowsVolumeGroup", "RubrikEc2Instance", "WindowsFileset". | Required |
| cluster_id | Filter the objects based on the provided cluster IDs. Supports comma separated values.<br/><br/>Note: Users can get the list of cluster IDs by executing the "rubrik-gps-cluster-list" command.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Optional |
| next_page_token | The next page cursor to retrieve the next set of results.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Note: Supported values are "ID" and "NAME" only. For any other values, the obtained result is sorted or not is not confirmed. Default is ID.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is ASC.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.Object.id | String | ID of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.name | String | Name of the SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.id | String | ID of the SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.description | String | Description of the SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.cluster.id | String | Cluster ID of effective SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.cluster.name | String | Cluster name of effective SLA domain of the object. |
| RubrikPolaris.Object.effectiveSlaDomain.fid | String | FID of effective SLA domain of the object. |
| RubrikPolaris.Object.isPassthrough | Boolean | Whether the object is passthrough or not. |
| RubrikPolaris.Object.cluster.id | String | Cluster ID of the object. |
| RubrikPolaris.Object.cluster.name | String | Cluster name of the object. |
| RubrikPolaris.Object.primaryClusterLocation.id | String | ID of the primary cluster location of the object. |
| RubrikPolaris.Object.logicalPath.name | String | Name of the logical path of the object. |
| RubrikPolaris.Object.logicalPath.objectType | String | Object Type of the logical path of the object. |
| RubrikPolaris.Object.physicalPath.name | String | Name of the physical path of the object. |
| RubrikPolaris.Object.physicalPath.objectType | String | Object Type of the physical path of the object. |
| RubrikPolaris.Object.name | String | Name of the object. |
| RubrikPolaris.Object.objectType | String | Type of the object. |
| RubrikPolaris.PageToken.Object.has_next_page | Boolean | Whether the result has the next page or not. |
| RubrikPolaris.PageToken.Object.name | String | Name of the command. |
| RubrikPolaris.PageToken.Object.next_page_token | String | Next page token. |

#### Command Example

```!rubrik-polaris-object-list limit=1```

#### Human Readable Output

### Objects

|Object ID|Object Name|Object Type|Location|Cluster Name|SLA Domain Name|
|---|---|---|---|---|---|
| 0014037c-70ae-4c53-b1cf-df6926b88968 | Christian LeCorre | O365User | Rubrik Demo\EMEA Users\AMER Users | x | UNPROTECTED |

 Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-polaris-object-snapshot-list

***
Retrieve Rubrik snapshot(s) of an object, based on the provided object ID.

#### Base Command

`rubrik-polaris-object-snapshot-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| object_id | The object ID for which the snapshots are to be searched.<br/><br/>Note: Users can get the list of the object IDs by executing the "rubrik-polaris-object-list" command. | Required |
| start_date | The start date to get snapshots from.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.<br/><br/>Note: start_date and end_date both or none must be initialized. | Optional |
| end_date | The end date to get snapshots until.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.<br/><br/>Note: start_date and end_date both or none must be initialized. | Optional |
| limit | Number of results to retrieve in the response. Maximum size allowed is 1000. Default is 50. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |
| snapshot_type | List of snapshot types to filter snapshots. Supports comma separated values.<br/><br/>Possible values are: "SCHEDULED", "ON_DEMAND", "DOWNLOADED". | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "Asc", "Desc". Default is Asc. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.Object.id | String | ID of the object. |
| RubrikPolaris.Object.Snapshot.id | String | ID of the snapshot. |
| RubrikPolaris.Object.Snapshot.date | String | Date of the snapshot. |
| RubrikPolaris.Object.Snapshot.isArchivalCopy | Boolean | Whether the snapshot is an archival copy or not. |
| RubrikPolaris.Object.Snapshot.isReplica | Boolean | Whether the snapshot is a replica or not. |
| RubrikPolaris.Object.Snapshot.isOnDemandSnapshot | Boolean | Whether the snapshot is on demand or not. |
| RubrikPolaris.Object.Snapshot.isDownloadedSnapshot | Boolean | Whether the snapshot is downloaded or not. |
| RubrikPolaris.Object.Snapshot.cluster.id | String | Cluster ID of the snapshot. |
| RubrikPolaris.Object.Snapshot.cluster.name | String | Cluster name of the snapshot. |
| RubrikPolaris.Object.Snapshot.cluster.version | String | Cluster version of the snapshot. |
| RubrikPolaris.Object.Snapshot.cluster.status | String | Cluster status of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.name | String | Name of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.fid | String | FID of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.cluster.id | String | Cluster ID of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.cluster.name | String | Cluster name of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.slaDomain.id | String | ID of the SLA domain of the snapshot. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.name | String | Archival name of snapshot retention of the snapshot. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.isExpirationDateCalculated | String | Whether archival expiration date of snapshot retention of the snapshot is calculated or not. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.archivalInfos.expirationTime | String | Archival expiration time of snapshot retention of the snapshot. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.name | String | Name of snapshot retention of the snapshot. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.isExpirationDateCalculated | Boolean | Whether the expiration date is calculated or not. |
| RubrikPolaris.Object.Snapshot.snapshotRetentionInfo.localInfo.expirationTime | String | Expiration time of snapshot retention of the snapshot. |
| RubrikPolaris.PageToken.Object.Snapshot.has_next_page | Boolean | Whether the result has the next page or not. |
| RubrikPolaris.PageToken.Object.Snapshot.name | String | Name of the command. |
| RubrikPolaris.PageToken.Object.Snapshot.next_page_token | String | Next Page Token. |

#### Command Example

```!rubrik-polaris-object-snapshot-list object_id=06515737-388a-57aa-9c8e-54b3f1ee5d8b limit=1```

#### Human Readable Output

### Object Snapshots

|Snapshot ID|Creation Date|Cluster Name|SLA Domain Name|
|---|---|---|---|
| a7adc499-b896-5ad6-bfc2-0aae0ed99459 | 2021-10-28T19:35:52.000Z | sand2-rbk01 | 12hr-30d-AWS |

 Note: To retrieve the next set of results use, "next_page_token" = xyz

### rubrik-radar-ioc-scan

***
Triggers an IOC scan of a system.

Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command and to list the running/completed IOC scans on a cluster use the "rubrik-radar-ioc-scan-list" command.

#### Base Command

`rubrik-radar-ioc-scan`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| cluster_id | ID of the cluster on which to perform a scan.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |
| object_id | Object ID of the system on which to perform the scan. Supports comma separated values.<br/><br/>Note: Users can get the list of object IDs by executing the "rubrik-polaris-vm-objects-list" command. | Required |
| scan_name | Name of the scan. Default is PAXSOAR-1.1.0.| Optional |
| ioc_type | The type of the indicator to scan for.<br/><br/>Possible values are: "INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME", "INDICATOR_OF_COMPROMISE_TYPE_HASH", "INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE".<br/><br/>Note: To provide multiple IOCs use the argument "advance_ioc". | Optional |
| ioc_value | Value of the indicator to scan for.<br/><br/>Note: To provide multiple IOCs use the argument "advance_ioc". | Optional |
| advance_ioc | Json encoded Indicators Of Compromise to scan. Json keys signify the type of IOC and the corresponding list of values are the values of the IOC's. If provided, will ignore the ioc_type and ioc_value arguments.<br/><br/>Possible keys to indicate type of indicator: <br/>INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE<br/><br/>Format Accepted:<br/>{<br/>"&lt;ioc_type1&gt;": ["&lt;ioc_value1&gt;", "&lt;ioc_value2&gt;"],<br/>"&lt;ioc_type2&gt;": "&lt;ioc_value2&gt;"<br/>}<br/><br/>Example:<br/>{<br/>"INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME": ["C:\Users\Malware_Executible.ps1", "\bin\Malware_Executible"],<br/>"INDICATOR_OF_COMPROMISE_TYPE_HASH": ["e5c1b9c44be582f895eaea3d3738c5b4", "f541b9844be897f895eaea3d3738cfb2"],<br/>"INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE": "rule match_everything {condition:true}"<br/>}. | Optional |
| start_date | Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.<br/><br/>Examples of more supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates. | Optional |
| end_date | Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded.<br/><br/>Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.<br/><br/>Examples of more supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates. | Optional |
| max_snapshots_per_object | Maximum number of snapshots to scan per object. | Optional |
| max_file_size | Maximum size of the file in bytes that will be included in the scan. The maximum allowed size is 15000000 bytes. Default is 5000000. | Optional |
| snapshot_id | Provide comma separated snapshot IDs on which to perform a scan separated by colon for each object ID (in the same order). Supports comma separated values.<br/><br/>Format accepted:<br/>object_1_snapshot_id_1, object_1_snapshot_id_2: object_2_snapshot_id_1<br/><br/>Example:<br/>B405e8c0-1fcd-401c-a6f6-42f758aad6df, e179eb47-534b-4624-b155-f33d188902e2: 1e1681bf-4479-4339-a4bb-59901598caa5<br/><br/>Note: Users can retrieve the list of snapshot IDs by executing the "rubrik-polaris-vm-object-snapshot-list" command.<br/><br/>Note: Do not provide "snapshot_start_date", "snapshot_end_date" and, "max_snapshots_per_object" arguments if snapshot ID is provided. | Optional |
| paths_to_include | Paths to include in the scan. Supports comma separated values.<br/><br/>Format accepted:<br/>path_to_include_1, path_to_include_2. | Optional |
| paths_to_exclude | Paths to exclude from the scan. Supports comma separated values.<br/><br/>Format accepted:<br/>path_to_exclude_1, path_to_exclude_2. | Optional |
| paths_to_exempt | Paths to exempt from exclusion. Supports comma separated values.<br/><br/>Format accepted:<br/>path_to_exempt_1, path_to_exempt_2. | Optional |
| requested_hash_types | The type of hash values of the matched files to return in the result. Supports comma separated values.<br/><br/>Possible values are: "HASH_TYPE_M_D5", "HASH_TYPE_SH_A1", "HASH_TYPE_SH_A256". | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.RadarIOCScan.id | String | ID of the IOC scan. |
| RubrikPolaris.RadarIOCScan.status | String | Status of the IOC scan trigger request. |

#### Command Example

```!rubrik-radar-ioc-scan scan_name="Revil Ransomware Scan" ioc_type="INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME" ioc_value="revil.exe" cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43" object_id="868aa03d-4145-4cb1-808b-e10c4f7a3741"```

#### Human Readable Output

### Radar IOC Scan

|Scan ID|Status|
|---|---|
| dummy-ioc-id | RUNNING |

### rubrik-radar-ioc-scan-results

***
Retrieves the results of IOC scan of a system.

Note: To initiate a scan use the "rubrik-radar-ioc-scan" command and to list the running/completed scans on a cluster use the "rubrik-radar-ioc-scan-list" command.

#### Base Command

`rubrik-radar-ioc-scan-results`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| scan_id | ID of the IOC scan whose results are to be retrieved.<br/><br/>Note: Users can get the scan ID by executing the "rubrik-radar-ioc-scan" command. | Required |
| cluster_id | ID of the cluster on which the scan was performed.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.RadarIOCScan.id | String | ID of the IOC scan. |
| RubrikPolaris.RadarIOCScan.status | String | Overall status of the scan. |
| RubrikPolaris.RadarIOCScan.indicatorsOfCompromise.iocType | String | Type of IOC that was scanned. |
| RubrikPolaris.RadarIOCScan.indicatorsOfCompromise.iocValue | String | Value of the IOC that was scanned. |
| RubrikPolaris.RadarIOCScan.results.objectId | String | ID of the system that was scanned. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.status | String | Status of the scan on the snapshot. Values: MALWARE_SCAN_IN_SNAPSHOT_STATUS_PENDING, MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED, MALWARE_SCAN_IN_SNAPSHOT_STATUS_ERROR. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.snapshotDate | String | The date-time at which the snapshot was taken. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.snapshotId | String | ID of the snapshot that was scanned. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.numFiles | Number | Number of files encountered during scan. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.numFilesScanned | Number | Number of files that were scanned on that snapshot. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.scanStats.totalFilesScannedSizeBytes | Number | The total file size of the files scanned. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.indicatorIndex | Number | Index of indicator in inputs for the scan. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.aclDetails | String | JSON encoded file access control list \(ACL\) information. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.creationTime | String | File creation date-time. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.modificationTime | String | File modification date-time. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.path | String | File path that matched the malware Indicator Of Compromise. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.yaraMatchDetails.name | String | The name of the matching YARA rule. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.yaraMatchDetails.tags | Unknown | Optional YARA tags. Described in https://yara.readthedocs.io/en/latest/writingrules.html\#rule-tags. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.requestedHashDetails.hashType | String | Hash algorithm type. |
| RubrikPolaris.RadarIOCScan.results.snapshotResults.matches.paths.requestedHashDetails.hashValue | String | Hash value of the content at path. |

#### Command Example

```!rubrik-radar-ioc-scan-results scan_id="bf687fcf-84d7-47f6-8bd1-54e8cf439680" cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43"```

#### Human Readable Output

### Radar IOC Scan Results

Scan ID: bf687fcf-84d7-47f6-8bd1-54e8cf439680
Status: FINISHED

|Snapshot ID|Snapshot Date|Object ID|Snapshot Scan Status|Scan Statistics|Matches|
|---|---|---|---|---|---|
| b7d6b871-796e-4e7c-99cf-328007c9d5c1 | 2021-10-29T07:03:30.669Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-81407 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142630, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| 3779a895-94bf-437e-b63a-61e73e215901 | 2021-10-28T07:00:09.297Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-81407 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142630, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| a871683f-f4fa-475f-806c-58f06e6782dc | 2021-10-26T07:04:07.139Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-81407 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142630, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| 129f22f4-0359-4e7d-aa53-9edf4e33cff1 | 2021-10-29T12:01:43.383Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72277 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142138, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| b9264942-c71c-4b91-b9a7-74a7ba0f6166 | 2021-10-29T08:01:39.388Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72277 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142138, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |
| 9f12b533-b740-4fb9-af94-4411b0aee01d | 2021-10-29T00:01:04.357Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72277 | MALWARE_SCAN_IN_SNAPSHOT_STATUS_FINISHED | Number of Files: 142139, Number of Files Scanned: 0, Total Files Scanned In Bytes: 0 | 1 |

### rubrik-gps-async-result

***
Retrieve the result of an asynchronous request. This command will retrieve the result of requests made by commands "rubrik-gps-snapshot-files-download", "rubrik-gps-vm-livemount", "rubrik-gps-vm-export", "rubrik-gps-vm-snapshot-create", and "rubrik-gps-vm-recover-files".

#### Base Command

`rubrik-gps-async-result`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| request_id | ID of the request.<br/><br/>Note: Users can get the request ID by executing any of the commands that make a request. Possible commands are mentioned in the command description. | Required |
| cluster_id | ID of the cluster on which request was made.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |
| cluster_ip_address | IP address of the cluster node to access the download link. Only required to retrieve the results of the command "rubrik-gps-snapshot-files-download".<br/><br/>Note: Users can retrieve the list of the IP addresses by executing the "rubrik-gps-cluster-list" command. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSAsyncResult.id | String | The ID of the request. |
| RubrikPolaris.GPSAsyncResult.status | String | Status of the request. |
| RubrikPolaris.GPSAsyncResult.nodeId | String | ID of the node. |
| RubrikPolaris.GPSAsyncResult.progress | Number | Progress of the request in range 0 to 100. |
| RubrikPolaris.GPSAsyncResult.error.message | String | JSON stringified message object when an error occurs. |
| RubrikPolaris.GPSAsyncResult.links.href | String | Link to a resource. |
| RubrikPolaris.GPSAsyncResult.links.rel | String | Type of the resource pointed by the link. |

#### Command Example

```!rubrik-gps-async-result request_id="EXPORT_VMWARE_SNAPSHOT_6e101218-141f-4101-b334-3c1bf440bfee_466b7d74-0d13-4e54-9a57-2ea4d7b00a0c:::0" cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43"```

#### Human Readable Output

### GPS Asynchronous Request Result

|ID|Status|Node ID|Links|
|---|---|---|---|
| dummy_id | FAILED | cluster:::RVMHM219S004941 | [self](https://www.example.com/)<br/> |

### rubrik-gps-cluster-list

***
Retrieve the list of the available rubrik clusters.

#### Base Command

`rubrik-gps-cluster-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| type | Filter out clusters based on their type. Supports comma separated values.<br/><br/>Possible values are: "Cloud", "Robo", "ExoCompute", "OnPrem", "Polaris", "Unknown". | Optional |
| name | Filter out clusters based on name. Supports comma separated values. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Possible values are: "ClusterName", "ClusterType", "RegisteredAt", "ESTIMATED_RUNWAY". Default is ClusterName. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "Asc", "Desc". Default is Asc. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSCluster.id | String | ID of the cluster. |
| RubrikPolaris.GPSCluster.name | String | Name of the cluster. |
| RubrikPolaris.GPSCluster.type | String | Type of the cluster. Values are Cloud, Robo, ExoCompute, OnPrem, Unknown, Polaris. |
| RubrikPolaris.GPSCluster.status | String | Status of the cluster. Values are Connected, Disconnected, Initializing. |
| RubrikPolaris.GPSCluster.version | String | Version of the cluster. |
| RubrikPolaris.GPSCluster.defaultAddress | String | Default address assigned to the cluster. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.clusterStatus.message | String | Message about the cluster upgrade/current condition. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.clusterStatus.status | String | Upgrade/current status of the cluster. It provides information like -- upgrading, upgrade scheduled, stable, downloading packages, pre-checks running and many more. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.overallProgress | Number | Progress \(in percentage\) of an upgrade, if running. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.scheduleUpgradeAt | String | Shows the date-time of a scheduled upgrade. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.downloadedVersion | String | The version that was downloaded but not yet installed. |
| RubrikPolaris.GPSCluster.cdmUpgradeInfo.version | String | The current version of the cluster. |
| RubrikPolaris.GPSCluster.productType | String | The product type. Values are CDM, DATOS, POLARIS. |
| RubrikPolaris.GPSCluster.estimatedRunway | Number | Estimated number of days remaining before additional data storage space is required on the cluster. |
| RubrikPolaris.GPSCluster.snapshotCount | Number | The total number of snapshots that are taken of different objects in the cluster. |
| RubrikPolaris.GPSCluster.geoLocation.address | String | Geological address of the cluster. |
| RubrikPolaris.GPSCluster.lastConnectionTime | String | Time when the cluster was last polled. |
| RubrikPolaris.GPSCluster.metric.totalCapacity | Number | Total storage capacity of the cluster in Bytes. |
| RubrikPolaris.GPSCluster.metric.availableCapacity | Number | Available storage capacity of the cluster in Bytes. |
| RubrikPolaris.GPSCluster.snappableConnection.count | Number | The number of objects in the cluster whose snapshots can be taken. |
| RubrikPolaris.GPSCluster.state.connectedState | String | Status of the cluster. Values are Connected, Disconnected, Initializing. |
| RubrikPolaris.GPSCluster.state.clusterRemovalState | String | State of the cluster when it is being removed from the platform. Values are DATA_DELETING, WAITING_FOR_DATA_DELETION, UNREGISTERED, FAILED, DISCONNECTING, REGISTERED. |
| RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.id | String | ID of a node in a cluster. |
| RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.status | String | Status of a node in a cluster. |
| RubrikPolaris.GPSCluster.clusterNodeConnection.nodes.ipAddress | String | IP Address of a node in a cluster. |
| RubrikPolaris.GPSCluster.passesConnectivityCheck | Boolean | Whether the cluster passes the connectivity check. |
| RubrikPolaris.GPSCluster.globalManagerConnectivityStatus.urls.url | String | URL of a global manager of the cluster. |
| RubrikPolaris.GPSCluster.globalManagerConnectivityStatus.urls.isReachable | Boolean | Whether the global manager is reachable. |
| RubrikPolaris.GPSCluster.connectivityLastUpdated | String | The date-time of when the cluster was last polled for connectivity. |
| RubrikPolaris.GPSCluster.lambdaFeatureHistory.wasRadarEverEnabled | Boolean | Whether Polaris Radar was ever enabled on the cluster. |
| RubrikPolaris.GPSCluster.lambdaFeatureHistory.wasSonarEverEnabled | Boolean | Whether Polaris Sonar was ever enabled on the cluster. |

#### Command Example

```!rubrik-gps-cluster-list name="sand1"```

#### Human Readable Output

### GPS Clusters

|Cluster ID|Cluster Name|Connection Status|Cluster Location|Total Capacity|Free Space|Protected Objects|Cluster Version|IP Address|
|---|---|---|---|---|---|---|---|---|
| cc19573c-db6c-418a-9d48-067a256543ba | sand1-rbk01 | Connected | San Francisco, CA, USA | 52.605821063168 TB | 45.484602130432 TB | 205 | 7.0.0-EA1-14307 | X.X.X.X, X.X.X.X |

### rubrik-radar-ioc-scan-list

***
Lists the running/completed IOC scans on a cluster.

Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command. To initiate a scan use the "rubrik-radar-ioc-scan" command.

#### Base Command

`rubrik-radar-ioc-scan-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| cluster_id | ID of the cluster whose IOC scans are to be listed.<br/><br/>Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.RadarIOCScan.id | String | ID of the IOC scan. |
| RubrikPolaris.RadarIOCScan.startTime | String | Start time of the scan. |
| RubrikPolaris.RadarIOCScan.endTime | String | End time of the scan. |
| RubrikPolaris.RadarIOCScan.snapshots.id | String | Object ID of the system. |
| RubrikPolaris.RadarIOCScan.snapshots.snapshots | Unknown | List of snapshot IDs that are included in the scan. |

#### Command Example

```!rubrik-radar-ioc-scan-list cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43"```

#### Human Readable Output

### Radar IOC Scans

|Scan ID|Start Time|End Time|Scanned Objects|
|---|---|---|---|
| fcac511b-20b4-472d-9b65-9198cff8cd49 | 2021-10-12T04:52:08.777Z | Not Finished | VirtualMachine:::90da5ffb-432f-4dac-8c73-39260ff5493e-vm-5952003d-f95c-4ae0-bf9b-b5a80b210935 |
| ad435ff1-617b-468a-b5d3-736fa0e278b0 | 2021-10-28T06:05:53.059Z | 2021-10-28T07:16:16.715Z | VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72277, VirtualMachine:::868aa03d-4145-4cb1-808b-e10c4f7a3741-vm-72279 |

### rubrik-gps-vm-recover-files

***
Recovers files from a snapshot backup, back into a system.

Note: To know about the recovery status, use the "rubrik-gps-async-result" command.

#### Base Command

`rubrik-gps-vm-recover-files`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| cluster_id | ID of the cluster where the snapshot resides.<br/><br/>Note: Users can get the cluster ID by executing the "rubrik-gps-cluster-list" command. | Required |
| snapshot_id | ID of the snapshot from which to recover files.<br/><br/>Note: Users can get the snapshot ID by executing the "rubrik-polaris-vm-object-snapshot-list" command. | Required |
| paths_to_recover | Comma separated paths of files and directories that will be recovered from the snapshot.<br/><br/>Note: Users can get the list of paths in a snapshot by executing the "rubrik-gps-snapshot-files-list" command. | Required |
| restore_path | Path on the destination object on which recovery will be done. | Required |
| destination_object_id | ID of the object where the files will be restored into. If not provided, Rubrik will use the snapshots object.<br/><br/>Note: Users can get the object ID by executing the "rubrik-polaris-vm-objects-list" command. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.GPSVMRecoverFiles.id | String | Recover files request ID. |

#### Command Example

```!rubrik-gps-vm-recover-files cluster_id="052bf7af-93a3-44e9-a7d7-bc8dad4d6b43" snapshot_id="e2a0ffa8-82a3-518b-8532-0608a0e7380f" path_to_recover="/bin,/boot" restore_path="/tmp/backup1"```

#### Human Readable Output

### GPS VM Recover Files

|Recover Files Request ID|
|---|
| dummy_id |

### rubrik-sonar-user-access-list

***
Retrieve the user access information.

#### Base Command

`rubrik-sonar-user-access-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| user_name | The name of the user to search for. | Optional |
| user_email | The email or the UPN of the user to search for. | Optional |
| search_time_period | Specify the search time period to look for user access.<br/><br/>Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.<br/><br/>For example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z. Default is 7 days. | Optional |
| risk_levels | The comma-separated list of risk levels.<br/><br/>Supported values are: UNKNOWN_RISK, HIGH_RISK, MEDIUM_RISK, LOW_RISK, NO_RISK.<br/><br/>Note: For any other values, whether the obtained result is filtered or not, is not confirmed. | Optional |
| group_id | Specify the group ID to filter with. | Optional |
| include_whitelisted_results | The boolean indicates to include the whitelisted results.<br/><br/>Possible values are: "True", "False". Default is False. | Optional |
| principal_summary_category | Specify the principal summary category to filter with.<br/><br/>Supported values are: PRINCIPAL_SUMMARY_CATEGORY_UNSPECIFIED, USERS_WITH_SENSITIVE_ACCESS, NEW_USERS_WITH_SENSITIVE_ACCESS, USERS_WITH_RISK_LEVEL_INCREASE. Default is USERS_WITH_SENSITIVE_ACCESS.<br/><br/>Note: For any other values, whether the obtained result is filtered or not, is not confirmed. | Optional |
| limit | Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50. | Optional |
| page_number | Specify the page number to get the particular page of results in the response. Default is 1.<br/><br/>Note: This argument is only applicable when provided with the "user_email" argument. | Optional |
| sort_by | Specify the field to use for sorting the response.<br/><br/>Supported values are: RISK_LEVEL, RISK_SENSITIVE_FILES, RISK_SENSITIVE_HITS, TOTAL_SENSITIVE_HITS, TOTAL_SENSITIVE_FILES, SID, TOTAL_SENSITIVE_OBJECTS. Default is RISK_LEVEL.<br/><br/>Note: For any other values, whether the obtained result is filtered or not, is not confirmed. | Optional |
| sort_order | Specify the order to sort the data in.<br/><br/>Possible values are: "ASC", "DESC". Default is DESC. | Optional |
| next_page_token | The next page cursor to retrieve the next set of results. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| RubrikPolaris.UserAccess.principalId | String | The ID of the user. |
| RubrikPolaris.UserAccess.fullName | String | The full name of the user. |
| RubrikPolaris.UserAccess.upn | String | The user principal name. |
| RubrikPolaris.UserAccess.riskLevel | String | The risk level of the user. |
| RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.totalCount | Number | The total number of high-risk files. |
| RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.violatedCount | Number | The number of high-risk files that violate policies. |
| RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.__typename | String | The high-risk file count field type. |
| RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.totalCount | Number | Total number of medium-risk files. |
| RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.violatedCount | Number | The number of medium-risk files that violate policies. |
| RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.__typename | String | The type of the medium risk file count field. |
| RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.totalCount | Number | The total number of low-risk files. |
| RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.violatedCount | Number | The number of low-risk files that violate policies. |
| RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.__typename | String | The type of the low-risk file count field. |
| RubrikPolaris.UserAccess.sensitiveFiles.__typename | String | The type of the sensitive files field. |
| RubrikPolaris.UserAccess.totalSensitiveHits.totalHits | Number | The total number of sensitive hits. |
| RubrikPolaris.UserAccess.totalSensitiveHits.violatedHits | Number | The number of sensitive hits that violate policies. |
| RubrikPolaris.UserAccess.totalSensitiveHits.__typename | String | The type of the total sensitive hits field. |
| RubrikPolaris.UserAccess.sensitiveObjectCount.totalCount | Number | The total number of sensitive objects. |
| RubrikPolaris.UserAccess.sensitiveObjectCount.violatedCount | Number | The Number of sensitive objects that violate policies. |
| RubrikPolaris.UserAccess.sensitiveObjectCount.__typename | String | The type of the sensitive object count field. |
| RubrikPolaris.UserAccess.numDescendants | Number | The number of descendant users associated with this user. |
| RubrikPolaris.UserAccess.domainName | String | The domain name associated with this user. |
| RubrikPolaris.UserAccess.__typename | String | The type of the User Access field. |
| RubrikPolaris.PageToken.UserAccess.name | String | Name of the command. |
| RubrikPolaris.PageToken.UserAccess.startCursor | String | The start cursor for the current page. |
| RubrikPolaris.PageToken.UserAccess.endCursor | String | The end cursor for the current page. |
| RubrikPolaris.PageToken.UserAccess.hasNextPage | Boolean | Whether the result has the next page or not. |
| RubrikPolaris.PageToken.UserAccess.hasPreviousPage | Boolean | Whether the result has the previous page or not. |
| RubrikPolaris.PageToken.UserAccess.next_upn_page_number | String | The next UPN page number. |
| RubrikPolaris.PageToken.UserAccess.has_next_upn_page | Boolean | Whether the result has the next UPN page or not. |

#### Command example

```!rubrik-sonar-user-access-list user_name="Demo Rubrik" user_email="demo@rubrik.com" limit="1"```

#### Context Example

```json
{
    "RubrikPolaris": {
        "PageToken": {
            "UserAccess": {
                "endCursor": "cursor_1",
                "hasNextPage": false,
                "hasPreviousPage": false,
                "has_next_upn_page": false,
                "name": "rubrik-sonar-user-access-list",
                "next_upn_page_number": 1,
                "startCursor": "cursor_1"
            }
        },
        "UserAccess": {
            "__typename": "PrincipalSummary",
            "domainName": "rubrik.com",
            "fullName": "Demo Rubrik",
            "numDescendants": 0,
            "principalId": "S-1-0-01-0000000000-0000000000-000000000-0001",
            "riskLevel": "HIGH_RISK",
            "sensitiveFiles": {
                "__typename": "SensitiveFiles",
                "highRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 124
                },
                "lowRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 0
                },
                "mediumRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 0
                }
            },
            "sensitiveObjectCount": {
                "__typename": "SummaryCount",
                "totalCount": 0,
                "violatedCount": 1
            },
            "totalSensitiveHits": {
                "__typename": "SummaryHits",
                "totalHits": 0,
                "violatedHits": 86972
            },
            "upn": "demo@rubrik.com"
        }
    }
}

Human Readable Output

User Access (Showing Records 1-1 out of 1)

User ID User Full Name User Principal Name Risk Level Total Sensitive Objects Total Sensitive Files Total Sensitive Hits

S-1-0-01-0000000000-0000000000-000000000-0001 Demo Rubrik demo@rubrik.com HIGH_RISK 1 124 86972

Note: To retrieve the next set of results, use next_page_token = “cursor_2”.

If next_page_token is provided, then it will reset the record numbers. For the initial use of next_page_token, please avoid specifying the page_number.

User ID	User Full Name	User Principal Name	Risk Level	Total Sensitive Objects	Total Sensitive Files	Total Sensitive Hits
S-1-0-01-0000000000-0000000000-000000000-0001	Demo Rubrik	demo@rubrik.com	HIGH_RISK	1	124	86972

rubrik-sonar-user-access-get

Retrieve the user access information based on the provided user ID.

Base Command

rubrik-sonar-user-access-get

Input

Argument Name	Description	Required
user_id	Specify the user_id to retrieve the user access information. Note: Users can get the list of the user IDs by executing the “rubrik-sonar-user-access-list” command.	Required
search_time_period	Specify the search time period to look for user access. Default is 7 days. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2023, 01 Mar 2023 04:45:33, 2023-04-17T14:05:44Z.	Optional
historical_delta_days	Specify the number of days in the past to collect delta for the sensitive hits. Default is 7.	Optional
include_whitelisted_results	The boolean indicates to include the whitelisted results. Default is False. Possible values are: “True”, “False”.	Optional

Context Output

Path	Type	Description
RubrikPolaris.UserAccess.principalId	String	The ID of the user.
RubrikPolaris.UserAccess.fullName	String	The full name of the user.
RubrikPolaris.UserAccess.upn	String	The user principal name.
RubrikPolaris.UserAccess.riskLevel	String	The risk level of the user.
RubrikPolaris.UserAccess.policy_hits_summary.__typename	String	The type of object representing the policy hits summary.
RubrikPolaris.UserAccess.policy_hits_summary.policyId	String	The unique identifier of the policy associated with the hits summary.
RubrikPolaris.UserAccess.policy_hits_summary.policyName	String	The human-readable name of the policy associated with the hits summary.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.__typename	String	The type of object representing the analyzer hits for a specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.__typename	String	The type of object representing high-risk hits for the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.totalHits	Number	The total number of high-risk hits detected by the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.highRiskHits.violatedHits	Number	The number of high-risk hits that violated security policies.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.__typename	String	The type of object representing low-risk hits for the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.totalHits	Number	The total number of low-risk hits detected by the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.lowRiskHits.violatedHits	Number	The number of low-risk hits that violated security policies.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.__typename	String	The type of object representing medium-risk hits for the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.totalHits	Number	The total number of medium-risk hits detected by the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.mediumRiskHits.violatedHits	Number	The number of medium-risk hits that violated security policies.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.__typename	String	The type of object representing the total number of hits for the analyzer.
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.totalHits	Number	The total number of hits detected by the analyzer (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidAnalyzerHits.totalHits.violatedHits	Number	The number of hits detected by the analyzer that violated security policies (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.__typename	String	The type of object representing the difference in analyzer hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.__typename	String	The type of object representing the difference in high-risk hits for the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.totalHits	Number	The difference in the total number of high-risk hits detected by the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.highRiskHits.violatedHits	Number	The difference in the number of high-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.__typename	String	The type of object representing the difference in low-risk hits for the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.totalHits	Number	The difference in the total number of low-risk hits detected by the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.lowRiskHits.violatedHits	Number	The difference in the number of low-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.__typename	String	The type of object representing the difference in medium-risk hits for the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.totalHits	Number	The difference in the total number of medium-risk hits detected by the analyzer between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.mediumRiskHits.violatedHits	Number	The difference in the number of medium-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.__typename	String	The type of object representing the total difference in hits for the analyzer between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.totalHits	Number	The total difference in the number of hits detected by the analyzer between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaAnalyzerHits.totalHits.violatedHits	Number	The difference in the number of hits detected by the analyzer that violated security policies between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.__typename	String	The type of object representing the difference in risk hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.__typename	String	The type of object representing the difference in high-risk hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.totalHits	Number	The difference in the total number of high-risk hits detected between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.highRiskHits.violatedHits	Number	The difference in the number of high-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.__typename	String	The type of object representing the difference in low-risk hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.totalHits	Number	The difference in the total number of low-risk hits detected between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.lowRiskHits.violatedHits	Number	The difference in the number of low-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.__typename	String	The type of object representing the difference in medium-risk hits between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.totalHits	Number	The difference in the total number of medium-risk hits detected between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.mediumRiskHits.violatedHits	Number	The difference in the number of medium-risk hits that violated security policies between the current and previous periods.
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.__typename	String	The type of object representing the total difference in risk hits between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.totalHits	Number	The total difference in the number of risk hits detected between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidDeltaRiskHits.totalHits.violatedHits	Number	The difference in the number of risk hits detected that violated security policies between the current and previous periods (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.__typename	String	The type of object representing the risk hits for a specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.__typename	String	The type of object representing high-risk hits for the risk engine.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.totalHits	Number	The total number of high-risk hits detected by the risk engine for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.highRiskHits.violatedHits	Number	The number of high-risk hits that violated security policies for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.__typename	String	The type of object representing low-risk hits for the risk engine.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.totalHits	Number	The total number of low-risk hits detected by the risk engine for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.lowRiskHits.violatedHits	Number	The number of low-risk hits that violated security policies for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.__typename	String	The type of object representing medium-risk hits for the risk engine.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.totalHits	Number	The total number of medium-risk hits detected by the risk engine for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.mediumRiskHits.violatedHits	Number	The number of medium-risk hits that violated security policies for the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.__typename	String	The type of object representing the total number of risk hits for the specific SID (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.totalHits	Number	The total number of risk hits detected by the risk engine for the specific SID (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidRiskHits.totalHits.violatedHits	Number	The number of risk hits detected by the risk engine that violated security policies for the specific SID (all risk levels combined).
RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.__typename	String	The type of object representing the sensitive files associated with the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.__typename	String	The type of object representing the total number of sensitive files associated with the specific SID.
RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.totalCount	Number	The total number of sensitive files associated with the specific SID, including both compliant and non-compliant files.
RubrikPolaris.UserAccess.policy_hits_summary.sidSensitiveFiles.totalFileCount.violatedCount	Number	The number of sensitive files associated with the specific SID that violate security policies.
RubrikPolaris.UserAccess.riskReasons.accessRiskReasons	Unknown	The reasons why the user’s access is considered risky.
RubrikPolaris.UserAccess.riskReasons.insecureReasons	Unknown	The reasons why the user’s access is considered insecure.
RubrikPolaris.UserAccess.riskReasons.__typename	String	The type of the risk reasons field.
RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.totalCount	Number	The total number of high-risk files.
RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.violatedCount	Number	The number of high-risk files that violate policies.
RubrikPolaris.UserAccess.sensitiveFiles.highRiskFileCount.__typename	String	The high-risk file count field type.
RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.totalCount	Number	Total number of medium-risk files.
RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.violatedCount	Number	The number of medium-risk files that violate policies.
RubrikPolaris.UserAccess.sensitiveFiles.mediumRiskFileCount.__typename	String	The type of the medium risk file count field.
RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.totalCount	Number	The total number of low-risk files.
RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.violatedCount	Number	The number of low-risk files that violate policies.
RubrikPolaris.UserAccess.sensitiveFiles.lowRiskFileCount.__typename	String	The type of the low-risk file count field.
RubrikPolaris.UserAccess.sensitiveFiles.__typename	String	The type of the sensitive files field.
RubrikPolaris.UserAccess.totalSensitiveHits.totalHits	Number	The total number of sensitive hits.
RubrikPolaris.UserAccess.totalSensitiveHits.violatedHits	Number	The number of sensitive hits that violate policies.
RubrikPolaris.UserAccess.totalSensitiveHits.__typename	String	The type of the total sensitive hits field.
RubrikPolaris.UserAccess.sensitiveObjectCount.totalCount	Number	The total number of sensitive objects.
RubrikPolaris.UserAccess.sensitiveObjectCount.violatedCount	Number	The Number of sensitive objects that violate policies.
RubrikPolaris.UserAccess.sensitiveObjectCount.__typename	String	The type of the sensitive object count field.
RubrikPolaris.UserAccess.numDescendants	Number	The number of descendant users associated with this user.
RubrikPolaris.UserAccess.domainName	String	The domain name associated with this user.
RubrikPolaris.UserAccess.directGroups.name	String	The name of the direct group.
RubrikPolaris.UserAccess.directGroups.sid	String	The security identifier (SID) of the direct group.
RubrikPolaris.UserAccess.directGroups.__typename	String	The type of the direct groups field.
RubrikPolaris.UserAccess.__typename	String	The type of the User Access field.

Command example

!rubrik-sonar-user-access-get user_id="S-1-0-01-0000000000-0000000000-000000000-0001"

Context Example

{
    "RubrikPolaris": {
        "UserAccess": {
            "__typename": "PrincipalSummary",
            "directGroups": [
                {
                    "__typename": "UserAccessGroup",
                    "name": "Domain Admins",
                    "sid": "S-1-0-01-0000000000-0000000000-000000000-002"
                },
                {
                    "__typename": "UserAccessGroup",
                    "name": "Domain Users",
                    "sid": "S-1-0-01-0000000000-0000000000-000000000-003"
                }
            ],
            "domainName": "rubrik.com",
            "fullName": "DemoRubrik",
            "numDescendants": 0,
            "principalId": "S-1-0-01-0000000000-0000000000-000000000-0001",
            "riskLevel": "HIGH_RISK",
            "policy_hits_summary": [
                {
                    "policyId": "00000000-0000-0000-0000-000000000001",
                    "policyName": "Policy 1",
                    "sidSensitiveFiles": {
                        "totalFileCount": {
                            "totalCount": 164,
                            "violatedCount": 164,
                            "__typename": "SummaryCount"
                        },
                        "__typename": "SensitiveFiles"
                    },
                    "sidAnalyzerHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 138118,
                            "violatedHits": 138118,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 138118,
                            "violatedHits": 138118,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidDeltaAnalyzerHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidRiskHits": {
                        "highRiskHits": {
                            "totalHits": 138118,
                            "violatedHits": 138118,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 138118,
                            "violatedHits": 138118,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidDeltaRiskHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "__typename": "PolicyHitsSummary"
                },
                {
                    "policyId": "00000000-0000-0000-0000-000000000002",
                    "policyName": "Policy 2",
                    "sidSensitiveFiles": {
                        "totalFileCount": {
                            "totalCount": 130,
                            "violatedCount": 130,
                            "__typename": "SummaryCount"
                        },
                        "__typename": "SensitiveFiles"
                    },
                    "sidAnalyzerHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 101434,
                            "violatedHits": 101434,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 101434,
                            "violatedHits": 101434,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidDeltaAnalyzerHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidRiskHits": {
                        "highRiskHits": {
                            "totalHits": 101434,
                            "violatedHits": 101434,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 101434,
                            "violatedHits": 101434,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "sidDeltaRiskHits": {
                        "highRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "mediumRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "lowRiskHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "totalHits": {
                            "totalHits": 0,
                            "violatedHits": 0,
                            "__typename": "SummaryHits"
                        },
                        "__typename": "SensitiveHits"
                    },
                    "__typename": "PolicyHitsSummary"
                }
            ],
            "riskReasons": {
                "__typename": "PrincipalRiskReasons",
                "accessRiskReasons": [
                    "MEDIUM_RISK_ANALYZER_HITS",
                    "OPEN_ACCESS"
                ],
                "insecureReasons": [
                    "PASSWORD_NEVER_EXPIRES"
                ]
            },
            "sensitiveFiles": {
                "__typename": "SensitiveFiles",
                "highRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 250
                },
                "lowRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 0
                },
                "mediumRiskFileCount": {
                    "__typename": "SummaryCount",
                    "totalCount": 0,
                    "violatedCount": 0
                }
            },
            "sensitiveObjectCount": {
                "__typename": "SummaryCount",
                "totalCount": 0,
                "violatedCount": 2
            },
            "totalSensitiveHits": {
                "__typename": "SummaryHits",
                "totalHits": 0,
                "violatedHits": 173954
            },
            "upn": "demo@rubrik.com"
        }
    }
}

Human Readable Output

User Access

User ID User Full Name User Principal Name Risk Level Access Risk Reason(s) Insecure Reason(s) Groups Total Sensitive Objects Total Sensitive Files Total Sensitive Hits

S-1-0-01-0000000000-0000000000-000000000-0001 DemoRubrik demo@rubrik.com HIGH_RISK MEDIUM_RISK_ANALYZER_HITS, OPEN_ACCESS PASSWORD_NEVER_EXPIRES Domain Admins, Domain Users 2 250 173954

Sensitive Hits

Policy Name Total Sensitive Files Total Sensitive Hits Sensitive Hits Delta High Risk Hits Medium Risk Hits Low Risk Hits

Policy 1 164 138118 0 0 138118 0

Policy 2 130 101434 0 0 101434 0

User ID	User Full Name	User Principal Name	Risk Level	Access Risk Reason(s)	Insecure Reason(s)	Groups	Total Sensitive Objects	Total Sensitive Files	Total Sensitive Hits
S-1-0-01-0000000000-0000000000-000000000-0001	DemoRubrik	demo@rubrik.com	HIGH_RISK	MEDIUM_RISK_ANALYZER_HITS, OPEN_ACCESS	PASSWORD_NEVER_EXPIRES	Domain Admins, Domain Users	2	250	173954

Policy Name	Total Sensitive Files	Total Sensitive Hits	Sensitive Hits Delta	High Risk Hits	Medium Risk Hits	Low Risk Hits
Policy 1	164	138118	0	0	138118	0
Policy 2	130	101434	0	0	101434	0

rubrik-sonar-file-context-list

Retrieve the context of the file, folder, or file share for the provided object and the file details.

Base Command

rubrik-sonar-file-context-list

Input

Argument Name	Description	Required
object_id	The Object ID or the Snappable ID. Note: Users can get the list of the object IDs by executing the “rubrik-polaris-object-list” command.	Required
snapshot_id	The Snapshot ID of the object. Note: Users can get the list of the snapshot IDs by executing the “rubrik-polaris-object-snapshot-list” command.	Required
file_name	Specify the name of the file, folder, or file share object.	Optional
file_path	Specify the standard file path to filter with.	Optional
user_id	Specify the user ID to filter with. Note: Users can get the list of the user IDs by executing the “rubrik-sonar-user-access-list” command.	Optional
include_whitelisted_results	The boolean indicates to include the whitelisted results. Possible values are: “True”, “False”. Default is False.	Optional
limit	Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50.	Optional
sort_by	Specify the field to use for sorting the response. Supported values are: HITS, NAME, DAILY_CHANGE, LAST_ACCESS_TIME, OPEN_ACCESS_TYPE, FILES_WITH_HITS, FILES_WITH_OPEN_ACCESS_HITS, STALE_FILES_WITH_HITS, CLUSTER, OBJECT_NAME, OBJECT_LOCATION, SNAPSHOT_TIME, NUM_ACTIVITIES, NUM_ACTIVITIES_DELTA, NATIVE_PATH. Default is HITS. Note: For any other values, whether the obtained result is filtered or not, is not confirmed.	Optional
sort_order	Specify the order to sort the data in. Possible values are: “ASC”, “DESC”. Default is DESC.	Optional
next_page_token	The next page cursor to retrieve the next set of results.	Optional

Context Output

Path	Type	Description
RubrikPolaris.FileContext.nativePath	String	The native path of the file.
RubrikPolaris.FileContext.stdPath	String	The standardized path of the file.
RubrikPolaris.FileContext.filename	String	The filename.
RubrikPolaris.FileContext.mode	String	The file mode.
RubrikPolaris.FileContext.size	Number	The file size in bytes.
RubrikPolaris.FileContext.lastAccessTime	Number	The last access time of the file in milliseconds since the epoch.
RubrikPolaris.FileContext.lastModifiedTime	Number	The last modified time of the file in milliseconds since the epoch.
RubrikPolaris.FileContext.creationTime	Number	The creation time of the file in milliseconds since the epoch.
RubrikPolaris.FileContext.lastScanTime	Number	The last scan time of the file in milliseconds since the epoch.
RubrikPolaris.FileContext.directory	String	The value of Directory.
RubrikPolaris.FileContext.createdBy	String	The user who created the file.
RubrikPolaris.FileContext.modifiedBy	String	The user who last modified the file.
RubrikPolaris.FileContext.numDescendantFiles	Number	The number of descendant files of the file.
RubrikPolaris.FileContext.numDescendantErrorFiles	Number	The number of descendant files of the file that could not be processed.
RubrikPolaris.FileContext.numDescendantSkippedExtFiles	Number	The number of descendant files of the file that were skipped because of their file extension.
RubrikPolaris.FileContext.numDescendantSkippedSizeFiles	Number	The number of descendant files of the file that were skipped because of their file size.
RubrikPolaris.FileContext.errorCode	String	The error code, if any, for the file.
RubrikPolaris.FileContext.hits.totalHits	Number	The total number of hits for the file.
RubrikPolaris.FileContext.hits.violations	Number	The number of violations for the file.
RubrikPolaris.FileContext.hits.violationsDelta	Number	The change in the number of violations for the file since the last scan.
RubrikPolaris.FileContext.hits.totalHitsDelta	Number	The change in the total number of hits for the file since the last scan.
RubrikPolaris.FileContext.hits.__typename	String	The type of the hits field.
RubrikPolaris.FileContext.filesWithHits.totalHits	Number	The total number of files with hits.
RubrikPolaris.FileContext.filesWithHits.violations	Number	The number of files with violations.
RubrikPolaris.FileContext.filesWithHits.__typename	String	The type of the files with hits field.
RubrikPolaris.FileContext.openAccessFilesWithHits.totalHits	Number	The total number of open access files with hits.
RubrikPolaris.FileContext.openAccessFilesWithHits.violations	Number	The number of open access files with violations.
RubrikPolaris.FileContext.openAccessFilesWithHits.__typename	String	The type of the open access files with hits field.
RubrikPolaris.FileContext.staleFilesWithHits.totalHits	Number	The total number of stale files with hits.
RubrikPolaris.FileContext.staleFilesWithHits.violations	Number	The number of stale files with violations.
RubrikPolaris.FileContext.staleFilesWithHits.__typename	String	The type of the stale files with hits field.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.groupType	String	The type of the analyzer group.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.id	String	The ID of the analyzer group.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.name	String	The name of the analyzer group.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.__typename	String	The type of the analyzer group field.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.totalHits	Number	The total number of hits for the analyzer results.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.violations	Number	The number of violations for the analyzer results.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.__typename	String	The type of the hits field.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.id	String	The ID of the analyzer.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.name	String	The name of the analyzer.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.analyzerType	String	The type of the analyzer.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.__typename	String	The type of the analyzer field.
RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.__typename	String	The type of the analyzer results field.
RubrikPolaris.FileContext.analyzerGroupResults.hits.totalHits	Number	The total number of hits for the analyzer group results.
RubrikPolaris.FileContext.analyzerGroupResults.hits.violations	Number	The number of violations for the analyzer group results.
RubrikPolaris.FileContext.analyzerGroupResults.hits.violationsDelta	Number	The change in the number of violations for the analyzer group results since the last scan.
RubrikPolaris.FileContext.analyzerGroupResults.hits.totalHitsDelta	Number	The change in the total number of hits for the analyzer group results since the last scan.
RubrikPolaris.FileContext.analyzerGroupResults.hits.__typename	String	The type of the hits field.
RubrikPolaris.FileContext.analyzerGroupResults.__typename	String	The type of the analyzer group results field.
RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.totalCount	Number	The total number of high-risk files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.violatedCount	Number	The number of high-risk files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.__typename	String	The type of the high-risk file count field.
RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.totalCount	Number	The total number of medium-risk files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.violatedCount	Number	The number of medium-risk files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.__typename	String	The type of the medium risk file count field.
RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.totalCount	Number	The total number of low-risk files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.violatedCount	Number	The number of low-risk files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.__typename	String	The type of the low-risk file count field.
RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.totalCount	Number	The total number of no-risk files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.violatedCount	Number	The number of no-risk files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.noRiskFileCount.__typename	String	The type of the no-risk file count field.
RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.totalCount	Number	The total number of files for the policy object.
RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.violatedCount	Number	The number of files for the policy object that violates policies.
RubrikPolaris.FileContext.sensitiveFiles.totalFileCount.__typename	String	The type of the total file count field.
RubrikPolaris.FileContext.sensitiveFiles.__typename	String	The type of the sensitive files field.
RubrikPolaris.FileContext.sensitiveHits.highRiskHits.totalHits	Number	The total number of high-risk sensitive hits for the file.
RubrikPolaris.FileContext.sensitiveHits.highRiskHits.violatedHits	Number	The number of high-risk sensitive hits for the file that violates policies.
RubrikPolaris.FileContext.sensitiveHits.highRiskHits.__typename	String	The type of the high-risk hits field.
RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.totalHits	Number	The total number of medium-risk sensitive hits for the file.
RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.violatedHits	Number	The number of medium-risk sensitive hits for the file that violates policies.
RubrikPolaris.FileContext.sensitiveHits.mediumRiskHits.__typename	String	The type of the medium-risk hits field.
RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.totalHits	Number	The total number of low-risk sensitive hits for the file.
RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.violatedHits	Number	The number of low-risk sensitive hits for the file that violates policies.
RubrikPolaris.FileContext.sensitiveHits.lowRiskHits.__typename	String	The type of the low-risk hits field.
RubrikPolaris.FileContext.sensitiveHits.noRiskHits.totalHits	Number	The total number of no-risk sensitive hits for the file.
RubrikPolaris.FileContext.sensitiveHits.noRiskHits.violatedHits	Number	The number of no-risk sensitive hits for the file that violates policies.
RubrikPolaris.FileContext.sensitiveHits.noRiskHits.__typename	String	The type of the no-risk hits field.
RubrikPolaris.FileContext.sensitiveHits.__typename	String	The type of the sensitive hits field.
RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.totalHits	Number	The total number of high-risk analyzer hits for the file.
RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.violatedHits	Number	The number of high-risk analyzer hits for the file that violates policies.
RubrikPolaris.FileContext.analyzerRiskHits.highRiskHits.__typename	String	The type of the high-risk hits field.
RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.totalHits	Number	The total number of medium-risk analyzer hits for the file.
RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.violatedHits	Number	The number of medium-risk analyzer hits for the file that violates policies.
RubrikPolaris.FileContext.analyzerRiskHits.mediumRiskHits.__typename	String	The type of the medium-risk hits field.
RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.totalHits	Number	The total number of low-risk analyzer hits for the file.
RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.violatedHits	Number	The number of low-risk analyzer hits for the file that violates policies.
RubrikPolaris.FileContext.analyzerRiskHits.lowRiskHits.__typename	String	The type of the low-risk hits field.
RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.totalHits	Number	The total number of no-risk analyzer hits for the file.
RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.violatedHits	Number	The number of no-risk analyzer hits for the file that violates policies.
RubrikPolaris.FileContext.analyzerRiskHits.noRiskHits.__typename	String	The type of the no-risk hits field.
RubrikPolaris.FileContext.analyzerRiskHits.__typename	String	The type of the analyzer risk hits field.
RubrikPolaris.FileContext.analyzerResults.hits.totalHits	Number	The total number of hits for the analyzer results.
RubrikPolaris.FileContext.analyzerResults.hits.violations	Number	The number of violations for the analyzer results.
RubrikPolaris.FileContext.analyzerResults.hits.__typename	String	The type of the hits field.
RubrikPolaris.FileContext.analyzerResults.analyzer.id	String	The ID of the analyzer.
RubrikPolaris.FileContext.analyzerResults.analyzer.name	String	The name of the analyzer.
RubrikPolaris.FileContext.analyzerResults.analyzer.analyzerType	String	The type of the analyzer.
RubrikPolaris.FileContext.analyzerResults.analyzer.__typename	String	The type of the analyzer field.
RubrikPolaris.FileContext.analyzerResults.__typename	String	The type of the analyzer results field.
RubrikPolaris.FileContext.openAccessType	String	The open access type for the file.
RubrikPolaris.FileContext.stalenessType	String	The staleness type for the file.
RubrikPolaris.FileContext.numActivities	Number	The number of activities for the file.
RubrikPolaris.FileContext.numActivitiesDelta	Number	The change in the number of activities for the file since the last time it was checked.
RubrikPolaris.FileContext.exposureSummary.exposureType	String	The exposure type of the file.
RubrikPolaris.FileContext.exposureSummary.fileCount.totalCount	Number	The total number of files with this exposure type.
RubrikPolaris.FileContext.exposureSummary.fileCount.violatedCount	Number	The number of files with this exposure type that violates policies.
RubrikPolaris.FileContext.exposureSummary.fileCount.__typename	String	The type of the file count field.
RubrikPolaris.FileContext.exposureSummary.__typename	String	The type of the exposure summary field.
RubrikPolaris.FileContext.dbEntityType	String	The database entity type of the file.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.siteId	String	The site ID of the MIP label.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.labelName	String	The name of the MIP label.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.labelId	String	The ID of the MIP label.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.hasProtection	Boolean	Whether the MIP label has protection applied.
RubrikPolaris.FileContext.mipLabelsSummary.mipLabel.__typename	String	The type of the MIP label field.
RubrikPolaris.FileContext.mipLabelsSummary.filesCount.violatedCount	Number	The number of files with this MIP label that violates policies.
RubrikPolaris.FileContext.mipLabelsSummary.filesCount.totalCount	Number	The total number of files with this MIP label.
RubrikPolaris.FileContext.mipLabelsSummary.filesCount.__typename	String	The type of the files count field.
RubrikPolaris.FileContext.mipLabelsSummary.__typename	String	The type of the MIP labels summary field.
RubrikPolaris.FileContext.documentTypesSummary.id	String	The ID of the document type.
RubrikPolaris.FileContext.documentTypesSummary.name	String	The name of the document type.
RubrikPolaris.FileContext.documentTypesSummary.filesCount.totalCount	Number	The total number of files of this document type.
RubrikPolaris.FileContext.documentTypesSummary.filesCount.violatedCount	Number	The number of files of this document type that violates policies.
RubrikPolaris.FileContext.documentTypesSummary.filesCount.__typename	String	The type of the files count field.
RubrikPolaris.FileContext.documentTypesSummary.__typename	String	The type of the document types summary field.
RubrikPolaris.FileContext.__typename	String	The type of the file context field.
RubrikPolaris.PageToken.FileContext.name	String	Name of the command.
RubrikPolaris.PageToken.FileContext.startCursor	String	The start cursor for the current page.
RubrikPolaris.PageToken.FileContext.endCursor	String	The end cursor for the current page.
RubrikPolaris.PageToken.FileContext.hasNextPage	Boolean	Whether the result has the next page or not.
RubrikPolaris.PageToken.FileContext.hasPreviousPage	Boolean	Whether the result has the previous page or not.

Command example

!rubrik-sonar-file-context-list object_id="1" snapshot_id="1" limit="2"

Context Example

{
    "RubrikPolaris": {
        "FileContext": [
            {
                "__typename": "FileResult",
                "analyzerGroupResults": [
                    {
                        "__typename": "AnalyzerGroupResult",
                        "analyzerGroup": {
                            "__typename": "AnalyzerGroup",
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000001",
                            "name": "UK PII"
                        },
                        "analyzerResults": [
                            {
                                "__typename": "AnalyzerResult",
                                "analyzer": {
                                    "__typename": "Analyzer",
                                    "analyzerType": "UK_UTR",
                                    "id": "00000000-0000-0000-0000-000000000001",
                                    "name": "UK UTR"
                                },
                                "hits": {
                                    "__typename": "Hits",
                                    "totalHits": 0,
                                    "violations": 0
                                }
                            }
                        ],
                        "hits": {
                            "__typename": "Hits",
                            "totalHits": 0,
                            "totalHitsDelta": 0,
                            "violations": 2000,
                            "violationsDelta": 0
                        }
                    }
                ],
                "analyzerResults": [
                    {
                        "__typename": "AnalyzerResult",
                        "analyzer": {
                            "__typename": "Analyzer",
                            "analyzerType": "UK_UTR",
                            "id": "00000000-0000-0000-0000-000000000001",
                            "name": "UK UTR"
                        },
                        "hits": {
                            "__typename": "Hits",
                            "totalHits": 0,
                            "violations": 0
                        }
                    }
                ],
                "analyzerRiskHits": {
                    "__typename": "AnalyzerHits",
                    "highRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 1500
                    },
                    "lowRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 100
                    },
                    "mediumRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 400
                    },
                    "noRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    }
                },
                "createdBy": "admin",
                "creationTime": 1648099578,
                "dbEntityType": "NAS",
                "directory": "/C:/File Shares",
                "documentTypesSummary": [
                    {
                        "__typename": "DocumentTypeSummary",
                        "filesCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        },
                        "id": "00000000-0000-0000-0000-000000000003",
                        "name": "Spreadsheet"
                    }
                ],
                "errorCode": "NO_ERROR",
                "exposureSummary": [
                    {
                        "__typename": "ExposureSummary",
                        "exposureType": "OPEN_ACCESS",
                        "fileCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        }
                    }
                ],
                "filename": "uk_drivers_license_number.xlsx",
                "filesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "hits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "totalHitsDelta": 0,
                    "violations": 2000,
                    "violationsDelta": 0
                },
                "lastAccessTime": 1648099578,
                "lastModifiedTime": 1648099578,
                "lastScanTime": 1648099578,
                "mipLabelsSummary": [
                    {
                        "__typename": "MipLabelSummary",
                        "filesCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        },
                        "mipLabel": {
                            "__typename": "MipLabel",
                            "hasProtection": true,
                            "labelId": "00000000-0000-0000-0000-000000000002",
                            "labelName": "Confidential",
                            "siteId": "00000000-0000-0000-0000-000000000001"
                        }
                    }
                ],
                "mode": "FILE",
                "modifiedBy": "admin",
                "nativePath": "/C:/File Shares/drivers_license_number.xlsx",
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "numDescendantErrorFiles": 0,
                "numDescendantFiles": 0,
                "numDescendantSkippedExtFiles": 0,
                "numDescendantSkippedSizeFiles": 0,
                "openAccessFilesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "openAccessType": "INHERITED",
                "sensitiveFiles": {
                    "__typename": "SensitiveFiles",
                    "highRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 1
                    },
                    "lowRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "mediumRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "noRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "totalFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 1
                    }
                },
                "sensitiveHits": {
                    "__typename": "SensitiveHits",
                    "highRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 1500,
                        "violatedHits": 1500
                    },
                    "lowRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 100,
                        "violatedHits": 100
                    },
                    "mediumRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 400,
                        "violatedHits": 400
                    },
                    "noRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    }
                },
                "size": 85708,
                "staleFilesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "stalenessType": "IS_STALE",
                "stdPath": "/C:/File Shares/uk_drivers_license_number.xlsx"
            },
            {
                "__typename": "FileResult",
                "analyzerGroupResults": [
                    {
                        "__typename": "AnalyzerGroupResult",
                        "analyzerGroup": {
                            "__typename": "AnalyzerGroup",
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000001",
                            "name": "UK PII"
                        },
                        "analyzerResults": [
                            {
                                "__typename": "AnalyzerResult",
                                "analyzer": {
                                    "__typename": "Analyzer",
                                    "analyzerType": "UK_NINO",
                                    "id": "00000000-0000-0000-0000-000000000001",
                                    "name": "UK NINO"
                                },
                                "hits": {
                                    "__typename": "Hits",
                                    "totalHits": 0,
                                    "violations": 0
                                }
                            }
                        ],
                        "hits": {
                            "__typename": "Hits",
                            "totalHits": 0,
                            "totalHitsDelta": 0,
                            "violations": 1712,
                            "violationsDelta": 0
                        }
                    }
                ],
                "analyzerResults": [
                    {
                        "__typename": "AnalyzerResult",
                        "analyzer": {
                            "__typename": "Analyzer",
                            "analyzerType": "UK_NINO",
                            "id": "00000000-0000-0000-0000-000000000001",
                            "name": "UK NINO"
                        },
                        "hits": {
                            "__typename": "Hits",
                            "totalHits": 0,
                            "violations": 0
                        }
                    }
                ],
                "analyzerRiskHits": {
                    "__typename": "AnalyzerHits",
                    "highRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 1712
                    },
                    "lowRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    },
                    "mediumRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    },
                    "noRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    }
                },
                "createdBy": "admin",
                "creationTime": 1648099580,
                "dbEntityType": "NAS",
                "directory": "/C:/File Shares",
                "documentTypesSummary": [
                    {
                        "__typename": "DocumentTypeSummary",
                        "filesCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        },
                        "id": "00000000-0000-0000-0000-000000000003",
                        "name": "Spreadsheet"
                    }
                ],
                "errorCode": "NO_ERROR",
                "exposureSummary": [
                    {
                        "__typename": "ExposureSummary",
                        "exposureType": "OPEN_ACCESS",
                        "fileCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        }
                    }
                ],
                "filename": "uk_national_insurance_number.csv",
                "filesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "hits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "totalHitsDelta": 0,
                    "violations": 1712,
                    "violationsDelta": 0
                },
                "lastAccessTime": 1648099580,
                "lastModifiedTime": 1648099580,
                "lastScanTime": 1648099580,
                "mipLabelsSummary": [
                    {
                        "__typename": "MipLabelSummary",
                        "filesCount": {
                            "__typename": "SummaryCount",
                            "totalCount": 0,
                            "violatedCount": 1
                        },
                        "mipLabel": {
                            "__typename": "MipLabel",
                            "hasProtection": true,
                            "labelId": "00000000-0000-0000-0000-000000000002",
                            "labelName": "Confidential",
                            "siteId": "00000000-0000-0000-0000-000000000001"
                        }
                    }
                ],
                "mode": "FILE",
                "modifiedBy": "admin",
                "nativePath": "/C:/File Shares/uk_national_insurance_number.csv",
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "numDescendantErrorFiles": 0,
                "numDescendantFiles": 0,
                "numDescendantSkippedExtFiles": 0,
                "numDescendantSkippedSizeFiles": 0,
                "openAccessFilesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "openAccessType": "INHERITED",
                "sensitiveFiles": {
                    "__typename": "SensitiveFiles",
                    "highRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 1
                    },
                    "lowRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "mediumRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "noRiskFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 0
                    },
                    "totalFileCount": {
                        "__typename": "SummaryCount",
                        "totalCount": 0,
                        "violatedCount": 1
                    }
                },
                "sensitiveHits": {
                    "__typename": "SensitiveHits",
                    "highRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 1712,
                        "violatedHits": 1712
                    },
                    "lowRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    },
                    "mediumRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    },
                    "noRiskHits": {
                        "__typename": "SummaryHits",
                        "totalHits": 0,
                        "violatedHits": 0
                    }
                },
                "size": 120064,
                "staleFilesWithHits": {
                    "__typename": "Hits",
                    "totalHits": 0,
                    "violations": 1
                },
                "stalenessType": "IS_STALE",
                "stdPath": "/C:/File Shares/uk_national_insurance_number.csv"
            }
        ],
        "PageToken": {
            "FileContext": {
                "endCursor": "cursor_2",
                "hasNextPage": true,
                "hasPreviousPage": false,
                "name": "rubrik-sonar-file-context-list",
                "startCursor": "cursor_1"
            }
        }
    }
}

Human Readable Output

File Context

File Name File Size in Bytes Total Risk Hits Daily Hits Change High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits File Path Access Type Last Access Time Last Modified Time Data Categories

uk_drivers_license_number.xlsx 85708 2000 0 1500 400 100 0 /C:/File Shares/uk_drivers_license_number.xlsx INHERITED 2022-03-24T05:26:18Z 2022-03-24T05:26:18Z - id: 00000000-0000-0000-0000-000000000001
name: UK PII
totalViolatedHits: 2000

uk_national_insurance_number.csv 120064 1712 0 1712 0 0 0 /C:/File Shares/uk_national_insurance_number.csv INHERITED 2022-03-24T05:26:20Z 2022-03-24T05:26:20Z - id: 00000000-0000-0000-0000-000000000001
name: UK PII
totalViolatedHits: 1712

Note: To retrieve the next set of results use, “next_page_token” = cursor_2

File Name	File Size in Bytes	Total Risk Hits	Daily Hits Change	High Risk Hits	Medium Risk Hits	Low Risk Hits	No Risk Hits	File Path	Access Type	Last Access Time	Last Modified Time	Data Categories
uk_drivers_license_number.xlsx	85708	2000	0	1500	400	100	0	/C:/File Shares/uk_drivers_license_number.xlsx	INHERITED	2022-03-24T05:26:18Z	2022-03-24T05:26:18Z	- id: 00000000-0000-0000-0000-000000000001 *name: UK PII totalViolatedHits*: 2000
uk_national_insurance_number.csv	120064	1712	0	1712	0	0	0	/C:/File Shares/uk_national_insurance_number.csv	INHERITED	2022-03-24T05:26:20Z	2022-03-24T05:26:20Z	- id: 00000000-0000-0000-0000-000000000001 *name: UK PII totalViolatedHits*: 1712

rubrik-radar-suspicious-file-list

Retrieve the suspicious list of files for a snapshot ID with detected file anomalies.

Base Command

rubrik-radar-suspicious-file-list

Input

Argument Name	Description	Required
snapshot_id	The Snapshot ID of the object or Activity Series ID. Note: Users can get the list of the snapshot IDs by executing the “rubrik-polaris-object-snapshot-list” command. For the Activity Series ID, the users can execute the “rubrik-event-list” command with the “activity_type” argument set to “ANOMALY”.	Required

Context Output

Path	Type	Description
RubrikPolaris.SuspiciousFile.id	String	The anomaly result ID.
RubrikPolaris.SuspiciousFile.snapshotFid	String	The snapshot ID.
RubrikPolaris.SuspiciousFile.cluster.id	String	The cluster ID.
RubrikPolaris.SuspiciousFile.cluster.defaultAddress	String	The default address of the cluster.
RubrikPolaris.SuspiciousFile.cluster.systemStatusAffectedNodes.ipAddress	String	The IP address of the affected node.
RubrikPolaris.SuspiciousFile.cluster.name	String	The cluster name.
RubrikPolaris.SuspiciousFile.cluster.version	String	The cluster version.
RubrikPolaris.SuspiciousFile.cluster.status	String	The cluster status.
RubrikPolaris.SuspiciousFile.cluster.__typename	String	The type name of the cluster response.
RubrikPolaris.SuspiciousFile.cdmId	String	The snapshot CDM ID.
RubrikPolaris.SuspiciousFile.managedId	String	The managed object ID.
RubrikPolaris.SuspiciousFile.anomalyProbability	Number	The probability of the anomaly.
RubrikPolaris.SuspiciousFile.workloadId	String	The workload ID.
RubrikPolaris.SuspiciousFile.location	String	The location of the anomaly.
RubrikPolaris.SuspiciousFile.isAnomaly	Boolean	Indicates if the file is an anomaly.
RubrikPolaris.SuspiciousFile.objectType	String	The object type.
RubrikPolaris.SuspiciousFile.snappableNew.objectType	String	The object type of the snapshot.
RubrikPolaris.SuspiciousFile.severity	String	The severity of the anomaly.
RubrikPolaris.SuspiciousFile.detectionTime	Date	The detection time of the anomaly.
RubrikPolaris.SuspiciousFile.snapshotDate	Date	The snapshot date of the anomaly.
RubrikPolaris.SuspiciousFile.encryption	String	The encryption standard of the anomaly.
RubrikPolaris.SuspiciousFile.resolutionStatus	String	The resolution status of the anomaly.
RubrikPolaris.SuspiciousFile.anomalyType	String	The type of the anomaly.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.strainId	String	The ID of the Ransomware Strain.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalAffectedFiles	Number	The total number of affected files.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalRansomwareNotes	Number	The total number of ransomware notes.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath	String	The path of the affected file.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.lastModified	Date	The last modified time of the affected file.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.fileSizeBytes	Number	The size of the affected file in bytes.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.__typename	String	The type name of the affected file response.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath	String	The path of the ransomware note file.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.lastModified	Date	The last modified time of the ransomware note file.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.fileSizeBytes	Number	The size of the ransomware note file in bytes.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.__typename	String	The type name of the ransomware note file response.
RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.__typename	String	The type name of the strain analysis response.
RubrikPolaris.SuspiciousFile.anomalyInfo.__typename	String	The type name of the anomaly response.
RubrikPolaris.SuspiciousFile.__typename	String	The type name of the suspicious file response.

Command example

!rubrik-radar-suspicious-file-list snapshot_id="00000000-0000-0000-0000-000000000001"

Context Example

{
    "RubrikPolaris": {
      "SuspiciousFile": {
        "id": "00000000-0000-0000-0000-000000000001:::VirtualMachine:::00000000-0000-0000-0000-000000000001-vm-206:::00000000-0000-0000-0000-000000000001",
        "snapshotFid": "00000000-0000-0000-0000-000000000001",
        "cluster": {
          "id": "00000000-0000-0000-0000-000000000001",
          "defaultAddress": "cluster.rubrik",
          "systemStatusAffectedNodes": [
            {
              "ipAddress": "0.0.0.0"
            }
          ],
          "name": "Cluster_B",
          "version": "8.1.3",
          "status": "Connected",
          "__typename": "Cluster"
        },
        "snappableNew": {
          "objectType": "VmwareVirtualMachine"
        },
        "cdmId": "00000000-0000-0000-0000-000000000001",
        "managedId": "VirtualMachine:::00000000-0000-0000-0000-000000000001-vm-206",
        "anomalyProbability": 0.949999988079071,
        "workloadId": "00000000-0000-0000-0000-000000000001-vm-206",
        "location": "instance.rubrik",
        "isAnomaly": true,
        "severity": "Critical",
        "detectionTime": "2024-02-05T18:49:03.000Z",
        "snapshotDate": "2024-02-05T16:59:30.000Z",
        "encryption": "HIGH",
        "resolutionStatus": "UNRESOLVED",
        "anomalyType": "FILESYSTEM",
        "anomalyInfo": {
          "strainAnalysisInfo": [
            {
              "strainId": "LockBit",
              "totalAffectedFiles": 1,
              "totalRansomwareNotes": 1,
              "sampleAffectedFilesInfo": [
                {
                  "filePath": "/C:/Shares/Restore-My-Files.txt.lockbit",
                  "lastModified": "2024-02-05T16:00:44.000Z",
                  "fileSizeBytes": 2512,
                  "__typename": "SuspiciousFileInfo"
                }
              ],
              "sampleRansomwareNoteFilesInfo": [
                {
                  "filePath": "/C:/Users/Public/Desktop/Restore-My-Files.txt",
                  "lastModified": "2024-02-08T02:00:03.000Z",
                  "fileSizeBytes": 2484,
                  "__typename": "SuspiciousFileInfo"
                }
              ],
              "__typename": "StrainInfo"
            }
          ],
          "__typename": "AnomalyInfo"
        },
        "__typename": "GetAnomalyDetailsReply"
      }
    }
}

Human Readable Output

Anomaly Information

Anomaly ID Is Anomaly Anomaly Probability Severity Encryption Anomaly Anomaly Type Resolution Status Total Suspicious Files Total Ransomware Note Detection Time Snapshot Time

00000000-0000-0000-0000-000000000001:::VirtualMachine:::00000000-0000-0000-0000-000000000001-vm-206:::00000000-0000-0000-0000-000000000001 true 0.949999988079071 Critical HIGH LockBit FILESYSTEM UNRESOLVED 1 1 2024-02-05T18:49:03.000Z 2024-02-05T16:59:30.000Z

Suspicious Files

File Path Suspicious Activity File Size in Bytes Last Modified Time

/C:/Shares/Restore-My-Files.txt.lockbit Ransomware Encryption 2512 2024-02-05T16:00:44.000Z

/C:/Users/Public/Desktop/Restore-My-Files.txt Ransomware Note 2484 2024-02-08T02:00:03.000Z

Anomaly ID	Is Anomaly	Anomaly Probability	Severity	Encryption	Anomaly	Anomaly Type	Resolution Status	Total Suspicious Files	Total Ransomware Note	Detection Time	Snapshot Time
00000000-0000-0000-0000-000000000001:::VirtualMachine:::00000000-0000-0000-0000-000000000001-vm-206:::00000000-0000-0000-0000-000000000001	true	0.949999988079071	Critical	HIGH	LockBit	FILESYSTEM	UNRESOLVED	1	1	2024-02-05T18:49:03.000Z	2024-02-05T16:59:30.000Z

File Path	Suspicious Activity	File Size in Bytes	Last Modified Time
/C:/Shares/Restore-My-Files.txt.lockbit	Ransomware Encryption	2512	2024-02-05T16:00:44.000Z
/C:/Users/Public/Desktop/Restore-My-Files.txt	Ransomware Note	2484	2024-02-08T02:00:03.000Z

ip

Retrieve the sensitive information available for the given IP address(es).

Base Command

ip

Input

Argument Name	Description	Required
ip	The IP address(es) for which to retrieve sensitive information.	Required

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
IP.Address	String	IP address.
IP.Relationships.EntityA	String	The source of the relationship.
IP.Relationships.EntityB	String	The destination of the relationship.
IP.Relationships.Relationship	String	The name of the relationship.
IP.Relationships.EntityAType	String	The type of the source of the relationship.
IP.Relationships.EntityBType	String	The type of the destination of the relationship.
IP.ASN	String	The autonomous system name for the IP address, for example: “AS8948”.
IP.Hostname	String	The hostname that is mapped to this IP address.
IP.Geo.Location	String	The geolocation where the IP address is located, in the format: latitude:longitude.
IP.Geo.Country	String	The country in which the IP address is located.
IP.Geo.Description	String	Additional information about the location.
IP.DetectionEngines	Number	The total number of engines that checked the indicator.
IP.PositiveDetections	Number	The number of engines that positively detected the indicator as malicious.
IP.Malicious.Vendor	String	The vendor reporting the IP address as malicious.
IP.Malicious.Description	String	A description explaining why the IP address was reported as malicious.
IP.Tags	Unknown	Tags of the IP address.
IP.FeedRelatedIndicators.value	String	Indicators that are associated with the IP address.
IP.FeedRelatedIndicators.type	String	The type of the indicators that are associated with the IP address.
IP.FeedRelatedIndicators.description	String	The description of the indicators that are associated with the IP address.
IP.MalwareFamily	String	The malware family associated with the IP address.
IP.Organization.Name	String	The organization of the IP address.
IP.Organization.Type	String	The organization type of the IP address.
IP.ASOwner	String	The autonomous system owner of the IP address.
IP.Region	String	The region in which the IP address is located.
IP.Port	String	Ports that are associated with the IP address.
IP.Internal	Boolean	Whether the IP address is internal or external.
IP.UpdatedDate	Date	The date that the IP address was last updated.
IP.Registrar.Abuse.Name	String	The name of the contact for reporting abuse.
IP.Registrar.Abuse.Address	String	The address of the contact for reporting abuse.
IP.Registrar.Abuse.Country	String	The country of the contact for reporting abuse.
IP.Registrar.Abuse.Network	String	The network of the contact for reporting abuse.
IP.Registrar.Abuse.Phone	String	The phone number of the contact for reporting abuse.
IP.Registrar.Abuse.Email	String	The email address of the contact for reporting abuse.
IP.Campaign	String	The campaign associated with the IP address.
IP.TrafficLightProtocol	String	The Traffic Light Protocol (TLP) color that is suitable for the IP address.
IP.CommunityNotes.note	String	Notes on the IP address that were given by the community.
IP.CommunityNotes.timestamp	Date	The time in which the note was published.
IP.Publications.source	String	The source in which the article was published.
IP.Publications.title	String	The name of the article.
IP.Publications.link	String	A link to the original article.
IP.Publications.timestamp	Date	The time in which the article was published.
IP.ThreatTypes.threatcategory	String	The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc.
IP.ThreatTypes.threatcategoryconfidence	String	The confidence level provided by the vendor for the threat type category For example, a confidence of 90 for the threat type category ‘malware’ means that the vendor rates that this is 90% confidence of being a malware.
RubrikPolaris.IP.ip	String	IP address of the object.
RubrikPolaris.IP.generalInfo.fid	String	The foreign ID of the object.
RubrikPolaris.IP.generalInfo.name	String	The name of the object.
RubrikPolaris.IP.generalInfo.objectType	String	The type of the object.
RubrikPolaris.IP.generalInfo.protectionStatus	String	The protection status of the object.
RubrikPolaris.IP.generalInfo.lastSnapshot	Date	The timestamp of the last snapshot of the object.
RubrikPolaris.IP.generalInfo.redirectLink	String	The link to the object in the Rubrik UI.
RubrikPolaris.IP.sensitiveInfo.riskLevel	String	The risk level of the object.
RubrikPolaris.IP.sensitiveInfo.sensitiveFiles.mediumCount	String	The number of sensitive files of medium risk level.
RubrikPolaris.IP.sensitiveInfo.sensitiveHits	Number	The number of sensitive files.
RubrikPolaris.IP.sensitiveInfo.openAccessFiles	Number	The number of open access files.
RubrikPolaris.IP.sensitiveInfo.staleFiles	Number	The number of stale files.
RubrikPolaris.IP.sensitiveInfo.redirectLink	String	The link to the sensitive information in the Rubrik UI.
RubrikPolaris.IP.sensitiveInfo.policyNames	String	The names of the policies associated with the object.
RubrikPolaris.IP.anomalyInfo.severity	String	The severity of the anomaly.
RubrikPolaris.IP.anomalyInfo.detectionTime	Date	The timestamp of the anomaly detection.
RubrikPolaris.IP.anomalyInfo.createdFileCount	String	The number of created files.
RubrikPolaris.IP.anomalyInfo.deletedFileCount	String	The number of deleted files.
RubrikPolaris.IP.anomalyInfo.modifiedFileCount	String	The number of modified files.
RubrikPolaris.IP.anomalyInfo.suspiciousFileCount	String	The number of suspicious files.
RubrikPolaris.IP.anomalyInfo.redirectLink	String	The link to the anomaly information in the Rubrik UI.
RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.huntId	String	The ID of the latest threat hunt.
RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.huntStartTime	Date	The timestamp of the latest threat hunt.
RubrikPolaris.IP.threatHuntInfo.latestThreatHunt.isMalicious	String	Whether the latest threat hunt is malicious.
RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.huntId	String	The ID of the latest malicious threat hunt.
RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.huntStartTime	Date	The timestamp of the latest malicious threat hunt.
RubrikPolaris.IP.threatHuntInfo.latestMaliciousThreatHunt.isMalicious	String	Whether the latest malicious threat hunt is malicious.
RubrikPolaris.IP.threatHuntInfo.redirectLink	String	The link to the threat hunt information in the Rubrik UI.
RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.snapshotFid	String	The foreign ID of the latest threat monitoring snapshot.
RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.monitoringScanTime	Date	The timestamp of the latest threat monitoring scan.
RubrikPolaris.IP.threatMonitoringInfo.latestThreatMonitoring.isMalicious	String	Whether the latest threat monitoring snapshot is malicious.
RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.snapshotFid	String	The foreign ID of the latest malicious threat monitoring snapshot.
RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.monitoringScanTime	Date	The timestamp of the latest malicious threat monitoring scan.
RubrikPolaris.IP.threatMonitoringInfo.latestMaliciousThreatMonitoring.isMalicious	String	Whether the latest malicious threat monitoring snapshot is malicious.
RubrikPolaris.IP.threatMonitoringInfo.redirectLink	String	The link to the threat monitoring information in the Rubrik UI.

Command example

!ip ip="0.0.0.1"

Context Example

{
    "DBotScore": {
        "Indicator": "0.0.0.1",
        "Reliability": "A - Completely reliable",
        "Score": 2,
        "Type": "ip",
        "Vendor": "Rubrik Security Cloud"
    },
    "IP": {
        "Address": "0.0.0.1",
        "UpdatedDate": "2024-10-21T08:51:52Z"
    },
    "RubrikPolaris": {
        "IP": {
            "ip": "0.0.0.1",
            "generalInfo": {
                "fid": "12345678-1234-1234-1234-123456789012",
                "name": "DEMO-RADAR",
                "objectType": "Vsphere Virtual Machine",
                "protectionStatus": "Protected",
                "lastSnapshot": "2024-10-18T06:02:25Z",
                "redirectLink": "https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview"
            },
            "sensitiveInfo": {
                "riskLevel": "Medium",
                "sensitiveFiles": {
                    "mediumCount": "11"
                },
                "sensitiveHits": 2910,
                "openAccessFiles": 6,
                "staleFiles": 11,
                "redirectLink": "https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse",
                "policyNames": [
                    "U.S. PII"
                ]
            },
            "anomalyInfo": {
                "severity": "Critical",
                "detectionTime": "2024-10-14T17:57:06Z",
                "createdFileCount": "4487",
                "deletedFileCount": "4477",
                "modifiedFileCount": "32",
                "suspiciousFileCount": "4476",
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary"
            },
            "threatHuntInfo": {
                "latestThreatHunt": {
                    "huntId": "12345678-1234-1234-1234-123456789012",
                    "huntStartTime": "2024-10-11T09:23:26Z",
                    "isMalicious": "Matches Found"
                },
                "latestMaliciousThreatHunt": {
                    "huntId": "12345678-1234-1234-1234-123456789012",
                    "huntStartTime": "2024-10-11T09:23:26Z",
                    "isMalicious": "Matches Found"
                },
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details"
            },
            "threatMonitoringInfo": {
                "latestThreatMonitoring": {
                    "snapshotFid": "12345678-1234-1234-1234-123456789012",
                    "monitoringScanTime": "2024-10-18T05:51:31Z",
                    "isMalicious": "No Matches"
                },
                "latestMaliciousThreatMonitoring": {
                    "snapshotFid": "12345678-1234-1234-1234-123456789012",
                    "monitoringScanTime": "2024-10-14T04:41:15Z",
                    "isMalicious": "Matches Found"
                },
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90"
            }
        }
    }
}

Human Readable Output

General Information for the given medium risk IP: 0.0.0.1

Fid Last Snapshot Name Object Type Protection Status Redirect Link

12345678-1234-1234-1234-123456789012 2024-10-18T06:02:25Z DEMO-RADAR Vsphere Virtual Machine Protected https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview

Sensitive Information

Open Access Files Policy Names Redirect Link Risk Level Sensitive Files Sensitive Hits Stale Files

6 U.S. PII https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse Medium mediumCount: 11 2910 11

Anomaly Information

Created File Count Deleted File Count Detection Time Modified File Count Redirect Link Severity Suspicious File Count

4487 4477 2024-10-14T17:57:06Z 32 https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary Critical 4476

Threat Hunt Information

Latest Malicious Threat Hunt Latest Threat Hunt Redirect Link

huntId: 12345678-1234-1234-1234-123456789012
huntStartTime: 2024-10-11T09:23:26Z
isMalicious: Matches Found huntId: 12345678-1234-1234-1234-123456789012
huntStartTime: 2024-10-11T09:23:26Z
isMalicious: Matches Found https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details

Threat Monitoring Information

Latest Malicious Threat Monitoring Latest Threat Monitoring Redirect Link

snapshotFid: 12345678-1234-1234-1234-123456789012
monitoringScanTime: 2024-10-14T04:41:15Z
isMalicious: Matches Found snapshotFid: 12345678-1234-1234-1234-123456789012
monitoringScanTime: 2024-10-18T05:51:31Z
isMalicious: No Matches https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90

Fid	Last Snapshot	Name	Object Type	Protection Status	Redirect Link
12345678-1234-1234-1234-123456789012	2024-10-18T06:02:25Z	DEMO-RADAR	Vsphere Virtual Machine	Protected	https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview

Open Access Files	Policy Names	Redirect Link	Risk Level	Sensitive Files	Sensitive Hits	Stale Files
6	U.S. PII	https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse	Medium	mediumCount: 11	2910	11

Created File Count	Deleted File Count	Detection Time	Modified File Count	Redirect Link	Severity	Suspicious File Count
4487	4477	2024-10-14T17:57:06Z	32	https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary	Critical	4476

Latest Malicious Threat Hunt	Latest Threat Hunt	Redirect Link
huntId: 12345678-1234-1234-1234-123456789012 huntStartTime: 2024-10-11T09:23:26Z isMalicious: Matches Found	huntId: 12345678-1234-1234-1234-123456789012 huntStartTime: 2024-10-11T09:23:26Z isMalicious: Matches Found	https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details

Latest Malicious Threat Monitoring	Latest Threat Monitoring	Redirect Link
snapshotFid: 12345678-1234-1234-1234-123456789012 monitoringScanTime: 2024-10-14T04:41:15Z isMalicious: Matches Found	snapshotFid: 12345678-1234-1234-1234-123456789012 monitoringScanTime: 2024-10-18T05:51:31Z isMalicious: No Matches	https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90

domain

Retrieve the sensitive information available for the given domain(s).

Base Command

domain

Input

Argument Name	Description	Required
domain	The domain(s) for which to retrieve sensitive information.	Required

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Domain.Name	String	The domain name, for example: “google.com”.
Domain.Relationships.EntityA	string	The source of the relationship.
Domain.Relationships.EntityB	string	The destination of the relationship.
Domain.Relationships.Relationship	string	The name of the relationship.
Domain.Relationships.EntityAType	string	The type of the source of the relationship.
Domain.Relationships.EntityBType	string	The type of the destination of the relationship.
Domain.DNS	String	A list of IP objects resolved by DNS.
Domain.DetectionEngines	Number	The total number of engines that checked the indicator.
Domain.PositiveDetections	Number	The number of engines that positively detected the indicator as malicious.
Domain.CreationDate	Date	The date that the domain was created.
Domain.UpdatedDate	String	The date that the domain was last updated.
Domain.ExpirationDate	Date	The expiration date of the domain.
Domain.DomainStatus	Datte	The status of the domain.
Domain.NameServers	Unknown	(List<String>) Name servers of the domain.
Domain.Organization	String	The organization of the domain.
Domain.Subdomains	Unknown	(List<String>) Subdomains of the domain.
Domain.Admin.Country	String	The country of the domain administrator.
Domain.Admin.Email	String	The email address of the domain administrator.
Domain.Admin.Name	String	The name of the domain administrator.
Domain.Admin.Phone	String	The phone number of the domain administrator.
Domain.Registrant.Country	String	The country of the registrant.
Domain.Registrant.Email	String	The email address of the registrant.
Domain.Registrant.Name	String	The name of the registrant.
Domain.Registrant.Phone	String	The phone number for receiving abuse reports.
Domain.Tags	Unknown	Tags of the domain.
Domain.FeedRelatedIndicators.value	String	Indicators that are associated with the domain.
Domain.FeedRelatedIndicators.type	String	The type of the indicators that are associated with the domain.
Domain.FeedRelatedIndicators.description	String	The description of the indicators that are associated with the domain.
Domain.MalwareFamily	String	The malware family associated with the domain.
Domain.WHOIS.DomainStatus	String	The status of the domain.
Domain.WHOIS.NameServers	String	(List<String>) Name servers of the domain.
Domain.WHOIS.CreationDate	Date	The date that the domain was created.
Domain.WHOIS.UpdatedDate	Date	The date that the domain was last updated.
Domain.WHOIS.ExpirationDate	Date	The expiration date of the domain.
Domain.WHOIS.Registrant.Name	String	The name of the registrant.
Domain.WHOIS.Registrant.Email	String	The email address of the registrant.
Domain.WHOIS.Registrant.Phone	String	The phone number of the registrant.
Domain.WHOIS.Registrar.Name	String	The name of the registrar, for example: “GoDaddy”.
Domain.WHOIS.Registrar.AbuseEmail	String	The email address of the contact for reporting abuse.
Domain.WHOIS.Registrar.AbusePhone	String	The phone number of contact for reporting abuse.
Domain.WHOIS.Admin.Name	String	The name of the domain administrator.
Domain.WHOIS.Admin.Email	String	The email address of the domain administrator.
Domain.WHOIS.Admin.Phone	String	The phone number of the domain administrator.
Domain.WHOIS/History	String	List of Whois objects.
Domain.Malicious.Vendor	String	The vendor reporting the domain as malicious.
Domain.Malicious.Description	String	A description explaining why the domain was reported as malicious.
Domain.DomainIDNName	String	The internationalized domain name (IDN) of the domain.
Domain.Port	String	Ports that are associated with the domain.
Domain.Internal	Bool	Whether or not the domain is internal or external.
Domain.Category	String	The category associated with the indicator.
Domain.Campaign	String	The campaign associated with the domain.
Domain.TrafficLightProtocol	String	The Traffic Light Protocol (TLP) color that is suitable for the domain.
Domain.ThreatTypes.threatcategory	String	The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc.
Domain.ThreatTypes.threatcategoryconfidence	String	Threat Category Confidence is the confidence level provided by the vendor for the threat type category For example a confidence of 90 for threat type category ‘malware’ means that the vendor rates that this is 90% confidence of being a malware.
Domain.Geo.Location	String	The geolocation where the domain address is located, in the format: latitude:longitude.
Domain.Geo.Country	String	The country in which the domain address is located.
Domain.Geo.Description	String	Additional information about the location.
Domain.Tech.Country	String	The country of the domain technical contact.
Domain.Tech.Name	String	The name of the domain technical contact.
Domain.Tech.Organization	String	The organization of the domain technical contact.
Domain.Tech.Email	String	The email address of the domain technical contact.
Domain.CommunityNotes.note	String	Notes on the domain that were given by the community.
Domain.CommunityNotes.timestamp	Date	The time in which the note was published.
Domain.Publications.source	String	The source in which the article was published.
Domain.Publications.title	String	The name of the article.
Domain.Publications.link	String	A link to the original article.
Domain.Publications.timestamp	Date	The time in which the article was published.
Domain.Billing	String	The billing address of the domain.
RubrikPolaris.Domain.domain	String	The domain of the object.
RubrikPolaris.Domain.generalInfo.fid	String	The foreign ID of the object.
RubrikPolaris.Domain.generalInfo.name	String	The name of the object.
RubrikPolaris.Domain.generalInfo.objectType	String	The type of the object.
RubrikPolaris.Domain.generalInfo.protectionStatus	String	The protection status of the object.
RubrikPolaris.Domain.generalInfo.lastSnapshot	Date	The timestamp of the last snapshot of the object.
RubrikPolaris.Domain.generalInfo.redirectLink	String	The link to the object in the Rubrik UI.
RubrikPolaris.Domain.sensitiveInfo.riskLevel	String	The risk level of the object.
RubrikPolaris.Domain.sensitiveInfo.sensitiveFiles.mediumCount	String	The number of sensitive files of medium risk level.
RubrikPolaris.Domain.sensitiveInfo.sensitiveHits	Number	The number of sensitive files.
RubrikPolaris.Domain.sensitiveInfo.openAccessFiles	Number	The number of open access files.
RubrikPolaris.Domain.sensitiveInfo.staleFiles	Number	The number of stale files.
RubrikPolaris.Domain.sensitiveInfo.redirectLink	String	The link to the sensitive information in the Rubrik UI.
RubrikPolaris.Domain.sensitiveInfo.policyNames	String	The names of the policies associated with the object.
RubrikPolaris.Domain.anomalyInfo.severity	String	The severity of the anomaly.
RubrikPolaris.Domain.anomalyInfo.detectionTime	Date	The timestamp of the anomaly detection.
RubrikPolaris.Domain.anomalyInfo.createdFileCount	String	The number of created files.
RubrikPolaris.Domain.anomalyInfo.deletedFileCount	String	The number of deleted files.
RubrikPolaris.Domain.anomalyInfo.modifiedFileCount	String	The number of modified files.
RubrikPolaris.Domain.anomalyInfo.suspiciousFileCount	String	The number of suspicious files.
RubrikPolaris.Domain.anomalyInfo.redirectLink	String	The link to the anomaly information in the Rubrik UI.
RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.huntId	String	The ID of the latest threat hunt.
RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.huntStartTime	Date	The timestamp of the latest threat hunt.
RubrikPolaris.Domain.threatHuntInfo.latestThreatHunt.isMalicious	String	Whether the latest threat hunt is malicious.
RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.huntId	String	The ID of the latest malicious threat hunt.
RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.huntStartTime	Date	The timestamp of the latest malicious threat hunt.
RubrikPolaris.Domain.threatHuntInfo.latestMaliciousThreatHunt.isMalicious	String	Whether the latest malicious threat hunt is malicious.
RubrikPolaris.Domain.threatHuntInfo.redirectLink	String	The link to the threat hunt information in the Rubrik UI.
RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.snapshotFid	String	The foreign ID of the latest threat monitoring snapshot.
RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.monitoringScanTime	Date	The timestamp of the latest threat monitoring scan.
RubrikPolaris.Domain.threatMonitoringInfo.latestThreatMonitoring.isMalicious	String	Whether the latest threat monitoring snapshot is malicious.
RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.snapshotFid	String	The foreign ID of the latest malicious threat monitoring snapshot.
RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.monitoringScanTime	Date	The timestamp of the latest malicious threat monitoring scan.
RubrikPolaris.Domain.threatMonitoringInfo.latestMaliciousThreatMonitoring.isMalicious	String	Whether the latest malicious threat monitoring snapshot is malicious.
RubrikPolaris.Domain.threatMonitoringInfo.redirectLink	String	The link to the threat monitoring information in the Rubrik UI.

Command example

!domain domain="DEMO-RADAR" using-brand=RubrikPolaris

Context Example

{
    "DBotScore": {
        "Indicator": "DEMO-RADAR",
        "Reliability": "A - Completely reliable",
        "Score": 2,
        "Type": "domain",
        "Vendor": "Rubrik Security Cloud"
    },
    "Domain": {
        "Name": "DEMO-RADAR",
        "UpdatedDate": "2024-11-05T04:34:47Z",
        "WHOIS": {
            "UpdatedDate": "2024-11-05T04:34:47Z"
        }
    },
    "RubrikPolaris": {
        "Domain": {
            "domain": "DEMO-RADAR",
            "generalInfo": {
                "fid": "12345678-1234-1234-1234-123456789012",
                "name": "DEMO-RADAR",
                "objectType": "Vsphere Virtual Machine",
                "protectionStatus": "Protected",
                "lastSnapshot": "2024-10-18T06:02:25Z",
                "redirectLink": "https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview"
            },
            "anomalyInfo": {
                "severity": "Critical",
                "detectionTime": "2024-10-14T17:57:06Z",
                "createdFileCount": "4487",
                "deletedFileCount": "4477",
                "modifiedFileCount": "32",
                "suspiciousFileCount": "4476",
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary"
            },
            "sensitiveInfo": {
                "riskLevel": "Medium",
                "sensitiveFiles": {
                    "mediumCount": "11"
                },
                "sensitiveHits": 2910,
                "openAccessFiles": 6,
                "staleFiles": 11,
                "redirectLink": "https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse",
                "policyNames": [
                    "U.S. PII"
                ]
            },
            "threatHuntInfo": {
                "latestThreatHunt": {
                    "huntId": "12345678-1234-1234-1234-123456789012",
                    "huntStartTime": "2024-10-11T09:23:26Z",
                    "isMalicious": "Matches Found"
                },
                "latestMaliciousThreatHunt": {
                    "huntId": "12345678-1234-1234-1234-123456789012",
                    "huntStartTime": "2024-10-11T09:23:26Z",
                    "isMalicious": "Matches Found"
                },
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details"
            },
            "threatMonitoringInfo": {
                "latestThreatMonitoring": {
                    "snapshotFid": "12345678-1234-1234-1234-123456789012",
                    "monitoringScanTime": "2024-10-18T05:51:31Z",
                    "isMalicious": "No Matches"
                },
                "latestMaliciousThreatMonitoring": {
                    "snapshotFid": "12345678-1234-1234-1234-123456789012",
                    "monitoringScanTime": "2024-10-14T04:41:15Z",
                    "isMalicious": "Matches Found"
                },
                "redirectLink": "https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90"
            }
        }
    }
}

Human Readable Output

General Information for the given medium risk domain: DEMO-RADAR

Fid Last Snapshot Name Object Type Protection Status Redirect Link

12345678-1234-1234-1234-123456789012 2024-10-18T06:02:25Z DEMO-RADAR Vsphere Virtual Machine Protected https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview

Sensitive Information

Open Access Files Policy Names Redirect Link Risk Level Sensitive Files Sensitive Hits Stale Files

6 U.S. PII https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse Medium mediumCount: 11 2910 11

Anomaly Information

Created File Count Deleted File Count Detection Time Modified File Count Redirect Link Severity Suspicious File Count

4487 4477 2024-10-14T17:57:06Z 32 https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary Critical 4476

Threat Hunt Information

Latest Malicious Threat Hunt Latest Threat Hunt Redirect Link

huntId: 12345678-1234-1234-1234-123456789012
huntStartTime: 2024-10-11T09:23:26Z
isMalicious: Matches Found huntId: 12345678-1234-1234-1234-123456789012
huntStartTime: 2024-10-11T09:23:26Z
isMalicious: Matches Found https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details

Threat Monitoring Information

Latest Malicious Threat Monitoring Latest Threat Monitoring Redirect Link

snapshotFid: 12345678-1234-1234-1234-123456789012
monitoringScanTime: 2024-10-14T04:41:15Z
isMalicious: Matches Found snapshotFid: 12345678-1234-1234-1234-123456789012
monitoringScanTime: 2024-10-18T05:51:31Z
isMalicious: No Matches https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90

Fid	Last Snapshot	Name	Object Type	Protection Status	Redirect Link
12345678-1234-1234-1234-123456789012	2024-10-18T06:02:25Z	DEMO-RADAR	Vsphere Virtual Machine	Protected	https://rubrik-test.my.rubrik.com/inventory_hierarchy/vsphere/12345678-1234-1234-1234-123456789012/overview

Open Access Files	Policy Names	Redirect Link	Risk Level	Sensitive Files	Sensitive Hits	Stale Files
6	U.S. PII	https://rubrik-test.my.rubrik.com/sonar/objects/detail/12345678-1234-1234-1234-123456789012/12345678-1234-1234-1234-123456789012/browse	Medium	mediumCount: 11	2910	11

Created File Count	Deleted File Count	Detection Time	Modified File Count	Redirect Link	Severity	Suspicious File Count
4487	4477	2024-10-14T17:57:06Z	32	https://rubrik-test.my.rubrik.com/radar/investigations/vsphere/12345678-1234-1234-1234-123456789012/snapshot/77dc1474-a654-5f20-bcac-348a0f83cd3a/summary	Critical	4476

Latest Malicious Threat Hunt	Latest Threat Hunt	Redirect Link
huntId: 12345678-1234-1234-1234-123456789012 huntStartTime: 2024-10-11T09:23:26Z isMalicious: Matches Found	huntId: 12345678-1234-1234-1234-123456789012 huntStartTime: 2024-10-11T09:23:26Z isMalicious: Matches Found	https://rubrik-test.my.rubrik.com/radar/investigations/threat_hunts/12345678-1234-1234-1234-123456789012/details

Latest Malicious Threat Monitoring	Latest Threat Monitoring	Redirect Link
snapshotFid: 12345678-1234-1234-1234-123456789012 monitoringScanTime: 2024-10-14T04:41:15Z isMalicious: Matches Found	snapshotFid: 12345678-1234-1234-1234-123456789012 monitoringScanTime: 2024-10-18T05:51:31Z isMalicious: No Matches	https://rubrik-test.my.rubrik.com/radar/threat_monitoring/12345678-1234-1234-1234-123456789012/Cluster_B/8b4fe6f6-cc87-4354-a125-b65e23cf8c90

rubrik-radar-anomaly-status-update

Updates the status of the Anomaly detection.

Note: Run the “rubrik-radar-suspicious-file-list” command first to check the resolution status of the Anomaly Detection snapshot before executing this command.

Base Command

rubrik-radar-anomaly-status-update

Input

Argument Name	Description	Required
anomaly_type	The type of the anomaly. Note: For Anomaly Type, users can execute the “rubrik-radar-suspicious-file-list” command. Possible values are: FILESYSTEM, HYPERVISOR.	Required
anomaly_id	The ID of the Anomaly or Activity Series ID. Note: For Activity Series ID, users can execute the “rubrik-event-list” command with the “activity_type” argument set to “ANOMALY”.	Required
workload_id	The workload ID (Snappable ID). Note: Users can execute the “rubrik-event-list” command with the “activity_type” argument set to “ANOMALY” and get the value of “fid” from the context.	Required
false_positive_type	The type for marking the anomaly as a false positive. Possible values are: FP_TYPE_UNSPECIFIED, OS_UPDATE, APPLICATION_UPDATE, LOG_ROTATION, OTHER, NFA_SCHEDULED_MAINTENANCE, NFA_UNSCHEDULED_MAINTENANCE.	Optional
false_positive_reason	The reason for marking the anomaly as a false positive when the “false_positive_type” argument is set to OTHER.	Optional

Context Output

Path	Type	Description
RubrikPolaris.AnomalyStatus.command_name	String	The name of the command.
RubrikPolaris.AnomalyStatus.anomaly_type	String	The type of the Anomaly.
RubrikPolaris.AnomalyStatus.anomaly_id	String	The ID of the Anomaly.
RubrikPolaris.AnomalyStatus.workload_id	String	The workload ID.
RubrikPolaris.AnomalyStatus.is_resloved	Boolean	Whether the Anomaly is resolved.
RubrikPolaris.AnomalyStatus.false_positive_type	String	The type of the false positive.
RubrikPolaris.AnomalyStatus.false_positive_reason	String	The reason for marking the Anomaly detection snapshot as a false positive.

Command example

!rubrik-radar-anomaly-status-update anomaly_id=00000000-0000-0000-0000-000000000001 anomaly_type=FILESYSTEM workload_id=00000000-0000-0000-0000-000000000002

Context Example

{
    "RubrikPolaris": {
        "AnomalyStatus": {
            "anomaly_id": "00000000-0000-0000-0000-000000000001",
            "anomaly_type": "FILESYSTEM",
            "command_name": "rubrik-radar-anomaly-update-status",
            "is_resloved": true,
            "workload_id": "00000000-0000-0000-0000-000000000002"
        }
    }
}

Human Readable Output

Anomaly detection with the ID 00000000-0000-0000-0000-000000000001 resolved successfully

rubrik-threat-monitoring-matched-object-list

List the matched objects for Threat Monitoring.

Base Command

rubrik-threat-monitoring-matched-object-list

Input

Argument Name	Description	Required
cluster_id	The unique ID of the cluster. Supports comma separated values. Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.	Optional
object_type	Filter the objects based on the provided object types. Supports comma separated values. Note: Values not included in the predefined options can be found in the documentation.	Optional
object_name	Filter objects by their name. Supports partial matches.	Optional
match_type	Filter the objects by the match type. Supports comma separated values. Possible values are: INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE.	Optional
start_time	Filter the objects detected after this time. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z. Default is 7 days.	Optional
limit	Number of results to retrieve in the response. The maximum allowed size is 1000.	Optional
next_page_token	The next page cursor to retrieve the next set of results.	Optional

Context Output

Path	Type	Description
RubrikPolaris.ThreatMonitoring.objectFid	String	The unique identifier (FID) of the object.
RubrikPolaris.ThreatMonitoring.objectName	String	The name of the matched object.
RubrikPolaris.ThreatMonitoring.objectType	String	The type of the matched object.
RubrikPolaris.ThreatMonitoring.matchType	Unknown	A list of match types found for the object.
RubrikPolaris.ThreatMonitoring.filesMatched	Number	The number of files matched with the threat monitoring object.
RubrikPolaris.ThreatMonitoring.lastDetection	Date	The timestamp of the most recent detection.
RubrikPolaris.ThreatMonitoring.cluster.name	String	The name of the cluster the object belongs to.
RubrikPolaris.ThreatMonitoring.cluster.id	String	The unique identifier of the cluster.
RubrikPolaris.ThreatMonitoring.cluster.__typename	String	The GraphQL typename of the cluster object.
RubrikPolaris.ThreatMonitoring.__typename	String	The GraphQL typename of the matched object.
RubrikPolaris.PageToken.ThreatMonitoring.endCursor	String	The end cursor of the threat monitoring data.
RubrikPolaris.PageToken.ThreatMonitoring.hasNextPage	Boolean	A flag indicating if there is a next page of threat monitoring data.
RubrikPolaris.PageToken.ThreatMonitoring.hasPreviousPage	Boolean	A flag indicating if there is a previous page of threat monitoring data.
RubrikPolaris.PageToken.ThreatMonitoring.name	String	The name of the threat monitoring data.
RubrikPolaris.PageToken.ThreatMonitoring.total_matched_count	Number	The total number of matched objects.
RubrikPolaris.PageToken.ThreatMonitoring.startCursor	String	The start cursor of the threat monitoring data.

Command example

!rubrik-threat-monitoring-matched-object-list begin_time="3 days"

Context Example

{
    "RubrikPolaris": {
        "ThreatMonitoring": [
            {   
                "__typename": "dummy-typename",
                "cluster": {
                    "__typename": "dummy-typename",
                    "id": "dummy-cluster-id-123",
                    "name": "dummy-cluster-name"
                },
                "filesMatched": 1,
                "lastDetection": "2025-01-01T00:00:00.000Z",
                "matchType": [
                    "dummy-match-type"
                ],
                "objectFid": "dummy-fid-789012",
                "objectName": "dummy-object-name-456",
                "objectType": "dummy-object-type"
            }
        ],
        "PageToken": {
            "ThreatMonitoring": {
                "endCursor": "dummy-end-cursor",
                "hasNextPage": true,
                "hasPreviousPage": false,
                "name": "rubrik-threat-monitoring-matched-object-list",
                "startCursor": "dummy-start-cursor",
                "total_matched_count": 2
            }
        }
    }
}

Human Readable Output

Threat Monitoring Object List

Object ID Object Name Object Type Total Files Matched Match Types Last Detection Time Cluster ID Cluster Name

dummy-fid-789012 dummy-object-name-456 dummy-object-type 0 dummy-match-type 2025-01-01T00:00:00.000Z dummy-cluster-id-123 dummy-cluster-name

Note: To retrieve the next set of results use, “next_page_token” = dummy-end-cursor

Object ID	Object Name	Object Type	Total Files Matched	Match Types	Last Detection Time	Cluster ID	Cluster Name
dummy-fid-789012	dummy-object-name-456	dummy-object-type	0	dummy-match-type	2025-01-01T00:00:00.000Z	dummy-cluster-id-123	dummy-cluster-name

rubrik-threat-monitoring-matched-object-get

Get the matched object for Threat Monitoring.

Base Command

rubrik-threat-monitoring-matched-object-get

Input

Argument Name	Description	Required
object_id	The object ID for the threat monitoring object. Note: Users can retrieve the object ID by executing the “rubrik-threat-monitoring-matched-object-list” command.	Required

Context Output

Path	Type	Description
RubrikPolaris.ThreatMonitoring.id	String	The ID of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.name	String	The name of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.objectType	String	The object type of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.slaAssignment	String	The SLA assignment of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.slaPauseStatus	String	The SLA pause status of the threat monitoring data.
RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.id	String	The ID of the effective SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.name	String	The name of the effective SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.version	String	The version of the effective SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveSlaDomain.__typename	String	The type name of the effective SLA domain.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.id	String	The ID of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.totalCount	Integer	The total count of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.scheduledCount	Integer	The scheduled count of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.onDemandCount	Integer	The on-demand count of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.retrievedCount	Integer	The retrieved count of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.snapshotDistribution.__typename	String	The type name of the snapshot distribution.
RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.id	String	The ID of the effective retention SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.name	String	The name of the effective retention SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.version	String	The version of the effective retention SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveRetentionSlaDomain.__typename	String	The type name of the effective retention SLA domain.
RubrikPolaris.ThreatMonitoring.configuredSlaDomain.id	String	The ID of the configured SLA domain.
RubrikPolaris.ThreatMonitoring.configuredSlaDomain.name	String	The name of the configured SLA domain.
RubrikPolaris.ThreatMonitoring.configuredSlaDomain.version	String	The version of the configured SLA domain.
RubrikPolaris.ThreatMonitoring.configuredSlaDomain.__typename	String	The type name of the configured SLA domain.
RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.fid	String	The FID of the effective SLA source object.
RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.name	String	The name of the effective SLA source object.
RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.objectType	String	The object type of the effective SLA source object.
RubrikPolaris.ThreatMonitoring.effectiveSlaSourceObject.__typename	String	The type name of the effective SLA source object.
RubrikPolaris.ThreatMonitoring.logicalPath.fid	String	The FID of the logical path.
RubrikPolaris.ThreatMonitoring.logicalPath.name	String	The name of the logical path.
RubrikPolaris.ThreatMonitoring.logicalPath.objectType	String	The object type of the logical path.
RubrikPolaris.ThreatMonitoring.logicalPath.__typename	String	The type name of the logical path.
RubrikPolaris.ThreatMonitoring.physicalPath.fid	String	The FID of the physical path.
RubrikPolaris.ThreatMonitoring.physicalPath.name	String	The name of the physical path.
RubrikPolaris.ThreatMonitoring.physicalPath.objectType	String	The object type of the physical path.
RubrikPolaris.ThreatMonitoring.physicalPath.__typename	String	The type name of the physical path.
RubrikPolaris.ThreatMonitoring.numWorkloadDescendants	Integer	The number of workload descendants.
RubrikPolaris.ThreatMonitoring.allOrgs.id	String	The ID of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.name	String	The name of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.description	String	The description of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.mfaStatus	String	The MFA status of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.allUrls	String	The all URLs of the organization.
RubrikPolaris.ThreatMonitoring.allOrgs.__typename	String	The type name of the organization.
RubrikPolaris.ThreatMonitoring.securityMetadata.lowSensitiveHits	Integer	The low sensitive hits of the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.mediumSensitiveHits	Integer	The medium sensitive hits of the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.highSensitiveHits	Integer	The high sensitive hits of the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.sensitivityStatus	String	The sensitivity status of the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.isLaminarEnabled	Boolean	A flag indicating whether laminar is enabled for the security metadata.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.id	String	The ID of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.name	String	The name of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.totalHits	Integer	The total hits of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.totalViolatedHits	Integer	The total violated hits of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.dataTypeResults.__typename	String	The type name of the data type result.
RubrikPolaris.ThreatMonitoring.securityMetadata.__typename	String	The type name of the security metadata.
RubrikPolaris.ThreatMonitoring.__typename	String	The type name of the threat monitoring data.

Command example

!rubrik-threat-monitoring-matched-object-get object_id="00000000-0000-0000-0000-000000000001"

Context Example

{
    "RubrikPolaris": {
        "ThreatMonitoring": {
            "id": "00000000-0000-0000-0000-000000000001",
            "name": "DUMMY-NAME",
            "objectType": "Dummy_Object_Type",
            "slaAssignment": "Dummy_Assignment",
            "slaPauseStatus": false,
            "effectiveSlaDomain": {
                "id": "dummy-sla-id",
                "name": "Dummy_SLA_Domain",
                "version": "v0",
                "__typename": "Global_Sla_Reply"
            },
            "Snapshot_Distribution": {
                "id": "dummy-snapshot-id",
                "totalCount": 0,
                "scheduledCount": 0,
                "onDemandCount": 0,
                "retrievedCount": 0,
                "__typename": "Snapshot_Distribution"
            },
            "effectiveRetentionSlaDomain": null,
            "configuredSlaDomain": {
                "id": "dummy-configured-sla-id",
                "name": "Dummy_Configured_SLA",
                "version": "v0",
                "__typename": "Global_Sla_Reply"
            },
            "effectiveSlaSourceObject": {
                "fid": "dummy-fid-001",
                "name": "DUMMY-SOURCE-NAME",
                "objectType": "Dummy_Source_Type",
                "__typename": "Path_Node"
            },
            "logicalPath": [
                {
                    "fid": "dummy-logical-fid-001",
                    "name": "Dummy_Logical_Name1",
                    "objectType": "Dummy_Logical_Type1",
                    "__typename": "Path_Node"
                },
                {
                    "fid": "dummy-logical-fid-002",
                    "name": "Dummy_Logical_Name2",
                    "objectType": "Dummy_Logical_Type2",
                    "__typename": "Path_Node"
                }
            ],
            "physicalPath": [
                {
                    "fid": "dummy-physical-fid-001",
                    "name": "Dummy_Physical_Name1",
                    "objectType": "Dummy_Physical_Type1",
                    "__typename": "Path_Node"
                },
                {
                    "fid": "dummy-physical-fid-002",
                    "name": "Dummy_Physical_Name2",
                    "objectType": "Dummy_Physical_Type2",
                    "__typename": "Path_Node"
                }
            ],
            "numWorkloadDescendants": 0,
            "allOrgs": [],
            "securityMetadata": null,
            "__typename": "Vsphere_Vm"
        }
    }
}

Human Readable Output

Threat Monitoring Object Details

ID Name Object Type SLA Assignment Effective SLA Domain SLA Pause Status Configured SLA Domain Effective SLA Source Object Logical Path Physical Path NumWorkload Descendants

dummy-id-001 DUMMY-NAME Dummy_Object_Type Dummy_Assignment id: dummy-sla-id
name: Dummy_SLA_Domain
version: v0 false id: dummy-configured-sla-id
name: Dummy_Configured_SLA
version: v0 fid: dummy-fid-001
name: DUMMY-SOURCE-NAME
objectType: Dummy_Source_Type - fid: dummy-logical-fid-001
name: Dummy_Logical_Name1
objectType: Dummy_Logical_Type1
- fid: dummy-logical-fid-002
name: Dummy_Logical_Name2
objectType: Dummy_Logical_Type2 - fid: dummy-physical-fid-001
name: Dummy_Physical_Name1
objectType: Dummy_Physical_Type1
- fid: dummy-physical-fid-002
name: Dummy_Physical_Name2
objectType: Dummy_Physical_Type2 0

rubrik-threat-monitoring-matched-file-list

List the matched files for the Threat Monitoring object.

Base Command

rubrik-threat-monitoring-matched-file-list

Input

Argument Name	Description	Required
object_id	The object ID for the threat monitoring object. Note: Users can retrieve the object ID by executing the “rubrik-threat-monitoring-matched-object-list” command.	Required
file_name	Filter files by their name. Supports partial matches.	Optional
limit	Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50.	Optional
next_page_token	The next page cursor to retrieve the next set of results.	Optional

Context Output

Path	Type	Description
RubrikPolaris.ThreatMonitoringFile.filepath	String	The full path of the matched file.
RubrikPolaris.ThreatMonitoringFile.detectedTime	Date	The timestamp when the file was detected.
RubrikPolaris.ThreatMonitoringFile.fileName	String	The name of the matched file.
RubrikPolaris.ThreatMonitoringFile.fileSize	Number	The size of the matched file in bytes.
RubrikPolaris.ThreatMonitoringFile.matchedSnapshotDate	Date	The date of the snapshot where the match occurred.
RubrikPolaris.ThreatMonitoringFile.matchedSnapshotFid	String	The FID of the snapshot where the match occurred.
RubrikPolaris.ThreatMonitoringFile.isMatchedSnapshotExpired	Boolean	A flag indicating whether the matched snapshot has expired.
RubrikPolaris.ThreatMonitoringFile.isFirstObservedSnapshotExpired	Boolean	A flag indicating whether the first observed snapshot has expired.
RubrikPolaris.ThreatMonitoringFile.matchType	String	The type of indicator match.
RubrikPolaris.ThreatMonitoringFile.isQuarantinedInFirstObservedSnapshot	Boolean	A flag indicating whether the file is quarantined in the first observed snapshot.
RubrikPolaris.ThreatMonitoringFile.objectFid	String	The FID of the associated object.
RubrikPolaris.ThreatMonitoringFile.firstObservedSnapshotFid	String	The FID of the first observed snapshot.
RubrikPolaris.ThreatMonitoringFile.firstObservedSnapshotDate	Date	The date of the first observed snapshot.
RubrikPolaris.ThreatMonitoringFile.objectType	String	The type of the associated object.
RubrikPolaris.ThreatMonitoringFile.objectName	String	The name of the associated object.
RubrikPolaris.ThreatMonitoringFile.matchId	Number	The ID of the match event.
RubrikPolaris.ThreatMonitoringFile.__typename	String	The GraphQL typename of the file match object.
RubrikPolaris.PageToken.ThreatMonitoringFile.endCursor	String	The end cursor of the threat monitoring file data.
RubrikPolaris.PageToken.ThreatMonitoringFile.hasNextPage	Boolean	A flag indicating if there is a next page of threat monitoring file data.
RubrikPolaris.PageToken.ThreatMonitoringFile.hasPreviousPage	Boolean	A flag indicating if there is a previous page of threat monitoring file data.
RubrikPolaris.PageToken.ThreatMonitoringFile.name	String	The name of the threat monitoring file data.
RubrikPolaris.PageToken.ThreatMonitoringFile.total_matched_count	Number	The total number of matched files.
RubrikPolaris.PageToken.ThreatMonitoringFile.startCursor	String	The start cursor of the threat monitoring file data.

Command example

!rubrik-threat-monitoring-matched-file-list object_id="dummy-object-id"

Context Example

{
    "RubrikPolaris": {
        "ThreatMonitoringFile": [
            {
                "filepath": "/dummy/path/file1.txt",
                "detectedTime": "2025-01-01T00:00:00.000Z",
                "fileName": "file1.txt",
                "fileSize": 1234,
                "matchedSnapshotDate": "2025-01-02T00:00:00.000Z",
                "matchedSnapshotFid": "dummy-snapshot-fid-1",
                "isMatchedSnapshotExpired": false,
                "isFirstObservedSnapshotExpired": false,
                "matchType": "DUMMY_TYPE",
                "isQuarantinedInFirstObservedSnapshot": true,
                "objectFid": "dummy-object-id",
                "firstObservedSnapshotFid": "dummy-first-snapshot-fid-1",
                "firstObservedSnapshotDate": "2025-01-02T00:00:00.000Z",
                "objectType": "DummyObjectType",
                "objectName": "dummy-object-name-1",
                "matchId": 1111,
                "__typename": "FileMatch"
            },
            {
                "filepath": "/dummy/path/file2.txt",
                "detectedTime": "2025-01-03T00:00:00.000Z",
                "fileName": "file2.txt",
                "fileSize": 5678,
                "matchedSnapshotDate": "2025-01-04T00:00:00.000Z",
                "matchedSnapshotFid": "dummy-snapshot-fid-2",
                "isMatchedSnapshotExpired": true,
                "isFirstObservedSnapshotExpired": true,
                "matchType": "DUMMY_TYPE",
                "isQuarantinedInFirstObservedSnapshot": false,
                "objectFid": "dummy-object-id",
                "firstObservedSnapshotFid": "dummy-first-snapshot-fid-2",
                "firstObservedSnapshotDate": "2025-01-04T00:00:00.000Z",
                "objectType": "DummyObjectType",
                "objectName": "dummy-object-name-2",
                "matchId": 2222,
                "__typename": "FileMatch"
            }
        ],
        "PageToken": {
            "ThreatMonitoringFile": {
                "startCursor": "dummy-start-cursor",
                "endCursor": "dummy-end-cursor",
                "hasNextPage": true,
                "hasPreviousPage": false,
                "name": "rubrik-threat-monitoring-matched-file-list",
                "total_matched_count": 99
            }
        }
    }
}

Human Readable Output

Threat Monitoring File List

File Name File Path File Size Matched Snapshot ID Matched Snapshot Date Matched Snapshot Expired

file1.txt /dummy/path/file1.txt 1234 dummy-snapshot-fid-1 2025-01-02T00:00:00.000Z false

file2.txt /dummy/path/file2.txt 5678 dummy-snapshot-fid-2 2025-01-04T00:00:00.000Z true

Note: To retrieve the next set of results use, “next_page_token” = dummy-end-cursor

rubrik-threat-monitoring-matched-file-get

Get the matched file for the Threat Monitoring object.

Base Command

rubrik-threat-monitoring-matched-file-get

Input

Argument Name	Description	Required
matched_snapshot_id	ID of the snapshot where the threat monitoring match was found. Note: Users can retrieve the matched snapshot ID by executing the “rubrik-threat-monitoring-matched-file-list” command.	Required
file_path	Path of the file. Note: Users can retrieve the file path by executing the “rubrik-threat-monitoring-matched-file-list” command.	Required

Context Output

Path	Type	Description
RubrikPolaris.ThreatMonitoringFile.matchedFileMd5	String	The MD5 hash of the matched file.
RubrikPolaris.ThreatMonitoringFile.matchedFileSha1	String	The SHA1 hash of the matched file.
RubrikPolaris.ThreatMonitoringFile.matchedFileSha256	String	The SHA256 hash of the matched file.
RubrikPolaris.ThreatMonitoringFile.iocDetails.matchType	String	The type of IOC match.
RubrikPolaris.ThreatMonitoringFile.iocDetails.intelFeedName	String	The name of the intelligence feed that provided the IOC.
RubrikPolaris.ThreatMonitoringFile.iocDetails.malwareName	String	The name of the malware associated with the IOC.
RubrikPolaris.ThreatMonitoringFile.iocDetails.iocRuleAuthor	String	The author of the IOC rule.
RubrikPolaris.ThreatMonitoringFile.iocDetails.malwareDescription	String	The description of the malware associated with the IOC.
RubrikPolaris.ThreatMonitoringFile.iocDetails.iocHashHex	String	The hash value of the IOC in hexadecimal format.
RubrikPolaris.ThreatMonitoringFile.iocDetails.iocStatus	String	The status of the IOC.
RubrikPolaris.ThreatMonitoringFile.iocDetails.__typename	String	The GraphQL typename of the IOC details.
RubrikPolaris.ThreatMonitoringFile.isQuarantinedInFirstObservedSnapshot	Boolean	A flag indicating whether the file was quarantined in the first observed snapshot.
RubrikPolaris.ThreatMonitoringFile.detectedSnapshotDate	String	The date when the file was detected in the snapshot.
RubrikPolaris.ThreatMonitoringFile.firstDetectedSnapshotFid	String	The ID of the first snapshot where the file was detected.
RubrikPolaris.ThreatMonitoringFile.filePath	String	The full path of the file.
RubrikPolaris.ThreatMonitoringFile.fileName	String	The name of the file.
RubrikPolaris.ThreatMonitoringFile.__typename	String	The GraphQL typename of the threat monitoring file.

Command example

!rubrik-threat-monitoring-matched-file-get matched_snapshot_id="test-id" file_path="/dummy/path/file1.txt"

Context Example

{
    "RubrikPolaris": {
        "ThreatMonitoringFile": {
            "matchedFileMd5": "00000000000000001",
            "matchedFileSha1": "0000000000000000000000001",
            "matchedFileSha256": "0000000000000000000000000000000000000000000000000000000000001",
            "iocDetails": [
                {
                    "matchType": "IOC_HASH",
                    "intelFeedName": "Dummy_Feed",
                    "malwareName": "Dummy_Malware",
                    "iocRuleAuthor": "Dummy_Author",
                    "malwareDescription": "Dummy description for testing purposes",
                    "iocHashHex": "00000000000000001",
                    "iocStatus": "ACTIVE",
                    "__typename": "IOCDetails"
                }
            ],
            "isQuarantinedInFirstObservedSnapshot": false,
            "detectedSnapshotDate": "2025-01-01T00:00:00.000Z",
            "firstDetectedSnapshotFid": "00000000-0000-0000-0000-000000000001",
            "filePath": "/dummy/path/file1.txt",
            "fileName": "dummyfile.com",
            "__typename": "ThreatMonitoringFileMatchDetailsV2"
        }
    }
}

Human Readable Output

Threat Monitoring File Details

File Name File Path File Hashes IOC Details First Detected Snapshot FID Detected Snapshot Date Quarantined In First Observed Snapshot

dummyfile.com /dummy/path/file1.txt MD5: 00000000000000001
SHA1: 0000000000000000000000001
SHA256: 0000000000000000000000000000000000000000000000000000000000001 - matchType: IOC_HASH
intelFeedName: Dummy_Feed
malwareName: Dummy_Malware
iocRuleAuthor: Dummy_Author
malwareDescription: Dummy description for testing purposes
iocHashHex: 00000000000000001
iocStatus: ACTIVE 00000000-0000-0000-0000-000000000001 2025-01-01T00:00:00.000Z false

rubrik-ioc-scan-list-v2

List details of the Turbo and Advance Threat Hunt.

Base Command

rubrik-ioc-scan-list-v2

Input

Argument Name	Description	Required
cluster_id	The ID of the cluster whose IOC scans are to be listed. Supports comma separated values. Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.	Optional
ioc_match	Filter hunts on any matches. Possible values are: MATCHES_FOUND, NO_MATCHES, UNSCANNED.	Optional
hunt_status	Filter by hunt status. Possible values are: ABORTED, CANCELED, CANCELING, FAILED, IN_PROGRESS, PARTIALLY_SUCCEEDED, PENDING, SUCCEEDED.	Optional
quarantine_status	Filter by quarantine matches. Possible values are: QUARANTINED_MATCHES, NO_QUARANTINED_MATCHES.	Optional
start_time	Filter the threat hunts that started after this time. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z. Default is 7 days.	Optional
end_time	Filter the threat hunts that ended before this time. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.	Optional
limit	Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50.	Optional
next_page_token	The next page cursor to retrieve the next set of results.	Optional

Context Output

Path	Type	Description
RubrikPolaris.IOCScan.huntId	string	The unique identifier for the threat hunt.
RubrikPolaris.IOCScan.name	string	The name of the threat hunt.
RubrikPolaris.IOCScan.createdBy.id	string	The ID of the user who initiated the hunt.
RubrikPolaris.IOCScan.createdBy.username	string	The username of the user who initiated the hunt.
RubrikPolaris.IOCScan.createdBy.email	string	The email of the user who initiated the hunt.
RubrikPolaris.IOCScan.createdBy.__typename	string	The GraphQL typename of the user object.
RubrikPolaris.IOCScan.huntType	string	The type of the threat hunt.
RubrikPolaris.IOCScan.startTime	date	The start time of the threat hunt.
RubrikPolaris.IOCScan.status	string	The current status of the threat hunt.
RubrikPolaris.IOCScan.stats.totalProcessedSnapshots	number	The total number of processed snapshots.
RubrikPolaris.IOCScan.stats.totalAffectedObjects	number	The total number of affected objects.
RubrikPolaris.IOCScan.stats.totalAffectedSnapshots	number	The total number of affected snapshots.
RubrikPolaris.IOCScan.stats.totalUniqueMatchedPaths	number	The total number of unique matched file paths.
RubrikPolaris.IOCScan.stats.totalSucceededScans	number	The total number of successful scans.
RubrikPolaris.IOCScan.stats.totalSnapshotsScanned	number	The total number of snapshots scanned.
RubrikPolaris.IOCScan.stats.totalUniqueQuarantinedPaths	number	The total number of unique quarantined file paths.
RubrikPolaris.IOCScan.stats.totalObjectsScanned	number	The total number of objects scanned.
RubrikPolaris.IOCScan.stats.totalIocs	number	The total number of IOCs used in the scan.
RubrikPolaris.IOCScan.stats.__typename	string	The GraphQL typename of the stats object.
RubrikPolaris.IOCScan.huntDetails.startTime	date	The start time of the detailed threat hunt process.
RubrikPolaris.IOCScan.huntDetails.endTime	date	The end time of the detailed threat hunt process.
RubrikPolaris.IOCScan.huntDetails.cluster.id	string	The ID of the cluster used in the hunt.
RubrikPolaris.IOCScan.huntDetails.cluster.name	string	The name of the cluster used in the hunt.
RubrikPolaris.IOCScan.huntDetails.cluster.__typename	string	The GraphQL typename of the cluster object.
RubrikPolaris.IOCScan.huntDetails.config.name	string	The name of the configuration used in the hunt.
RubrikPolaris.IOCScan.huntDetails.config.indicatorsOfCompromise	unknown	The list of indicators of compromise.
RubrikPolaris.IOCScan.huntDetails.config.__typename	string	The GraphQL typename of the hunt config object.
RubrikPolaris.IOCScan.huntDetails.__typename	string	The GraphQL typename of the hunt details object.
RubrikPolaris.IOCScan.__typename	string	The GraphQL typename of the top-level threat hunt object.
RubrikPolaris.PageToken.IOCScan.endCursor	string	The end cursor of the IOC scan data.
RubrikPolaris.PageToken.IOCScan.hasNextPage	boolean	A flag indicating if there is a next page of IOC scan data.
RubrikPolaris.PageToken.IOCScan.hasPreviousPage	boolean	A flag indicating if there is a previous page of IOC scan data.
RubrikPolaris.PageToken.IOCScan.name	string	The name of the IOC scan data.
RubrikPolaris.PageToken.IOCScan.startCursor	string	The start cursor of the IOC scan data.
RubrikPolaris.PageToken.IOCScan.total_matched_count	number	The total number of matched IOC scans.

Command example

!rubrik-ioc-scan-list-v2 limit=1

Context Example

{
    "RubrikPolaris": {
        "IOCScan": [
            {
                "huntId": "dummy-hunt-id-0001",
                "name": "Dummy Threat Hunt",
                "createdBy": {
                    "id": "client|dummy-user-id",
                    "username": "dummyuser",
                    "email": "dummyuser@example.com",
                    "__typename": "User"
                },
                "huntType": "THREAT_HUNT_V2",
                "startTime": "2025-07-01T00:00:00.000Z",
                "status": "SUCCEEDED",
                "stats": {
                    "totalProcessedSnapshots": 10,
                    "totalAffectedObjects": 2,
                    "totalAffectedSnapshots": 1,
                    "totalUniqueMatchedPaths": 3,
                    "totalSucceededScans": 10,
                    "totalSnapshotsScanned": 12,
                    "totalUniqueQuarantinedPaths": 1,
                    "totalObjectsScanned": 20,
                    "totalIocs": 5,
                    "__typename": "ThreatHuntStats"
                },
                "huntDetails": {
                    "startTime": "2025-07-01T00:00:00.000Z",
                    "endTime": "2025-07-01T01:00:00.000Z",
                    "cluster": {
                        "id": "dummy-cluster-id",
                        "name": "Dummy Cluster",
                        "__typename": "Cluster"
                    },
                    "config": {
                        "name": "Dummy Hunt Config",
                        "indicatorsOfCompromise": [],
                        "__typename": "ThreatHuntConfig"
                    },
                    "__typename": "ThreatHuntDetails"
                },
                "__typename": "ThreatHunt"
            }
        ],
        "PageToken": {
            "IOCScan": {
                "endCursor": "dummy-end-cursor",
                "hasNextPage": true,
                "hasPreviousPage": false,
                "startCursor": "dummy-start-cursor",
                "name": "rubrik-ioc-scan-list-v2",
                "total_matched_count": 2
            }
        }
    }
}

Human Readable Output

IOC Scan List

Hunt ID Hunt Type Status Start Time

dummy-hunt-id-0001 THREAT_HUNT_V2 SUCCEEDED 2025-07-01T00:00:00.000Z

Note: To retrieve the next set of results use, “next_page_token” = dummy-end-cursor

rubrik-ioc-scan-results-v2

Retrieve details of the Turbo and Advance Threat Hunt.

Base Command

rubrik-ioc-scan-results-v2

Input

Argument Name	Description	Required
hunt_id	The ID of the threat hunt. Note: Users can retrieve the hunt ID by executing the “rubrik-ioc-scan-list-v2” command.	Required

Context Output

Path	Type	Description
RubrikPolaris.IOCScan.hunt_id	string	The ID of the threat hunt.
RubrikPolaris.IOCScan.totalObjectFids	number	The total number of object FIDs involved in the threat hunt.
RubrikPolaris.IOCScan.startTime	date	The start time of the threat hunt.
RubrikPolaris.IOCScan.endTime	date	The end time of the threat hunt.
RubrikPolaris.IOCScan.status	string	The current status of the threat hunt.
RubrikPolaris.IOCScan.totalMatchedSnapshots	number	The total number of matched snapshots.
RubrikPolaris.IOCScan.totalScannedSnapshots	number	The total number of scanned snapshots.
RubrikPolaris.IOCScan.totalUniqueFileMatches	number	The total number of unique file matches.
RubrikPolaris.IOCScan.clusters.id	string	The ID of the cluster.
RubrikPolaris.IOCScan.clusters.name	string	The name of the cluster.
RubrikPolaris.IOCScan.clusters.type	string	The type of the cluster.
RubrikPolaris.IOCScan.clusters.__typename	string	The GraphQL typename of the cluster object.
RubrikPolaris.IOCScan.baseConfig.name	string	The name of the base configuration used in the threat hunt.
RubrikPolaris.IOCScan.baseConfig.notes	string	The notes added to the hunt configuration.
RubrikPolaris.IOCScan.baseConfig.maxMatchesPerSnapshot	number	The maximum number of matches allowed per snapshot.
RubrikPolaris.IOCScan.baseConfig.threatHuntType	string	The type of the threat hunt.
RubrikPolaris.IOCScan.baseConfig.__typename	string	The GraphQL typename of the base configuration object.
RubrikPolaris.IOCScan.baseConfig.ioc.__typename	string	The GraphQL typename of the IOC object.
RubrikPolaris.IOCScan.baseConfig.ioc.iocList.__typename	string	The GraphQL typename of the IOC list container.
RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.iocKind	string	The type of IOC.
RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.iocValue	string	The value of the IOC indicator.
RubrikPolaris.IOCScan.baseConfig.ioc.iocList.indicatorsOfCompromise.__typename	string	The GraphQL typename of the IOC indicator.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.__typename	string	The GraphQL typename of the snapshot scan limit object.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.__typename	string	The GraphQL typename of the scan limit configuration.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.maxSnapshotsPerObject	number	The maximum snapshots to scan per object.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.startTime	date	The start time for the snapshot scan window.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.endTime	date	The end time for the snapshot scan window.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.scanConfig.__typename	string	The GraphQL typename of the scan limit configuration.
RubrikPolaris.IOCScan.baseConfig.snapshotScanLimit.scanLimit.objectSnapshotConfig	string	An object snapshot configuration.
RubrikPolaris.IOCScan.baseConfig.fileScanCriteria	string	A file scan criteria.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalObjectsScanned	number	The total number of objects scanned during the hunt.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalAffectedObjects	number	The total number of affected objects.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalUnaffectedObjects	number	The total number of unaffected objects.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.totalObjectsUnscannable	number	The total number of objects that couldn’t be scanned.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.unaffectedObjectsFromDb	number	The number of clean objects retrieved from the database.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.cleanRecoverableObjectLimit	number	The maximum number of clean recoverable objects allowed.
RubrikPolaris.IOCScan.threatHuntObjectMetrics.__typename	string	The GraphQL typename of the object metrics reply.
RubrikPolaris.IOCScan.__typename	string	The GraphQL typename of the root hunt details object.

Command example

!rubrik-ioc-scan-results-v2 hunt_id="test-hunt-id"

Context Example

{
    "RubrikPolaris": {
        "IOCScan": {
            "hunt_id": "test-hunt-id",
            "totalObjectFids": 100,
            "startTime": "2025-01-01T08:00:00.000Z",
            "endTime": "2025-01-01T09:00:00.000Z",
            "status": "SUCCEEDED",
            "totalMatchedSnapshots": 10,
            "totalScannedSnapshots": 200,
            "totalUniqueFileMatches": 3,
            "clusters": [
                {
                    "id": "dummy-cluster-id-123",
                    "name": "Dummy_Cluster",
                    "type": "DummyType",
                    "__typename": "Cluster"
                }
            ],
            "baseConfig": {
                "name": "Dummy Threat Hunt Config",
                "notes": "Dummy note here.",
                "maxMatchesPerSnapshot": 0,
                "threatHuntType": "TURBO_THREAT_HUNT",
                "ioc": {
                    "iocList": {
                        "indicatorsOfCompromise": [
                            {
                                "iocKind": "IOC_HASH",
                                "iocValue": "dummyhashvalue0000000000000000000001",
                                "__typename": "IndicatorOfCompromise"
                            },
                            {
                                "iocKind": "IOC_HASH",
                                "iocValue": "dummyhashvalue0000000000000000000002",
                                "__typename": "IndicatorOfCompromise"
                            }
                        ],
                        "__typename": "IndicatorOfCompromiseInputOutputListType"
                    },
                    "__typename": "Ioc"
                },
                "snapshotScanLimit": {
                    "scanLimit": {
                        "scanConfig": {
                            "maxSnapshotsPerObject": 5,
                            "startTime": "2025-01-01T00:00:00.000Z",
                            "endTime": "2025-01-10T00:00:00.000Z",
                            "__typename": "SnapshotScanConfig"
                        },
                        "__typename": "ScanLimit"
                    },
                    "__typename": "HuntScanSnapshotLimit"
                },
                "__typename": "ThreatHuntBaseConfig"
            },
            "__typename": "ThreatHuntDetailsV2",
            "threatHuntObjectMetrics": {
                "totalObjectsScanned": 100,
                "totalAffectedObjects": 5,
                "totalUnaffectedObjects": 95,
                "totalObjectsUnscannable": 0,
                "unaffectedObjectsFromDb": 95,
                "cleanRecoverableObjectLimit": 999,
                "__typename": "ThreatHuntObjectMetricsReply"
            }
        }
    }
}

Human Readable Output

IOC Scan Data

Hunt Name Hunt Type Status IOC Details Object Metrics Scan Metrics Start Time End Time

Dummy Threat Hunt Config TURBO_THREAT_HUNT SUCCEEDED - iocKind: IOC_HASH
iocValue: dummyhashvalue0000000000000000000001
- iocKind: IOC_HASH
iocValue: dummyhashvalue0000000000000000000002 totalObjectsScanned: 100
totalAffectedObjects: 5
totalUnaffectedObjects: 95
totalObjectsUnscannable: 0
unaffectedObjectsFromDb: 95
cleanRecoverableObjectLimit: 999 totalMatchedSnapshots: 10
totalScannedSnapshots: 200
totalUniqueFileMatches: 3 2025-01-01T08:00:00.000Z 2025-01-01T09:00:00.000Z

rubrik-turbo-ioc-scan

Start a new turbo threat hunt.

Base Command

rubrik-turbo-ioc-scan

Input

Argument Name	Description	Required
ioc	The value of the indicator to scan for. Supports comma separated values. Note: Users can retrieve the Md5, SHA1 or SHA256 by executing the “rubrik-threat-monitoring-matched-file-get” command.	Required
scan_name	Name of the new turbo threat hunt scan. Default is PAXSOAR-1.6.0.	Optional
cluster_id	The ID of the cluster on which to perform a scan. If not provided, all the clusters will be scanned. Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.	Optional
start_time	Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.	Optional
end_time	Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.	Optional
max_snapshots_per_object	Maximum number of snapshots to scan per object.	Optional

Context Output

Path	Type	Description
RubrikPolaris.TurboIOCScan.huntId	String	The ID of the new turbo threat hunt.
RubrikPolaris.TurboIOCScan.__typename	String	The type of the new turbo threat hunt.

Command example

!rubrik-turbo-ioc-scan ioc="00000000000000000001"

Context Example

{
    "RubrikPolaris": {
        "TurboIOCScan": {
            "huntId": "000000000-0000-0000-0000-000000001",
            "__typename": "StartTurboThreatHuntReply"
        }
    }
}

Human Readable Output

The new Turbo Threat Hunt started with ID: 000000000-0000-0000-0000-000000001

rubrik-advance-ioc-scan

Start a new advance threat hunt.

Base Command

rubrik-advance-ioc-scan

Input

Argument Name	Description	Required
object_id	The Object ID of the system on which to perform the scan. Supports comma separated values. Note: Users can get the list of object IDs by executing the “rubrik-polaris-object-list” command.	Required
ioc_type	The type of the indicator to scan. Note: To provide multiple IOCs use the argument “advance_ioc”. Possible values are: INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE.	Optional
ioc_value	The value of the indicator to scan. Note: To provide multiple IOCs use the argument “advance_ioc”.	Optional
scan_name	Name of the new advanced threat hunt scan. Default is PAXSOAR-1.6.0.	Optional
advance_ioc	Json encoded Indicators Of Compromise to scan. Json keys signify the type of IOC and the corresponding list of values are the values of the IOC’s. If provided, will ignore the ioc_type and ioc_value arguments. Possible keys to indicate type of indicator: INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE Format Accepted: { “<ioc_type1>”: [“<ioc_value1>”, “<ioc_value2>”], “<ioc_type2>”: “<ioc_value3>“ } Example: { “INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME”: [“C:\\Users\\Malware_Executible.ps1”, “\\bin\\Malware_Executible”], “INDICATOR_OF_COMPROMISE_TYPE_HASH”: [“e5c1b9c44be582f895eaea3d3738c5b4”, “f541b9844be897f895eaea3d3738cfb2”], “INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE”: “rule match_everything {condition:true}” }.	Optional
max_matches_per_snapshot	Maximum number of IOC matches allowed per snapshot.	Optional
start_date	Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.	Optional
end_date	Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. For example: 01 June 2025, 01 June 2025 04:45:33, 2025-06-17T14:05:44Z.	Optional
max_snapshots_per_object	Maximum number of snapshots to scan per object.	Optional
min_file_size	Minimum size of the file in bytes that will be included in the scan.	Optional
max_file_size	Maximum size of the file in bytes that will be included in the scan.	Optional
paths_to_include	Paths to include in the scan. Supports comma separated values. Format accepted: “path_to_include_1, path_to_include_2”.	Optional
paths_to_exclude	Paths to exclude from the scan. Supports comma separated values. Format accepted: “path_to_exclude_1, path_to_exclude_2”.	Optional
paths_to_exempt	Paths to exempt from exclusion. Supports comma separated values. Format accepted: “path_to_exempt_1, path_to_exempt_2”.	Optional

Context Output

Path	Type	Description
RubrikPolaris.AdvanceIOCScan.huntId	string	The ID of the new advance threat hunt.
RubrikPolaris.AdvanceIOCScan.huntName	string	The name or label of the advanced threat hunt.
RubrikPolaris.AdvanceIOCScan.config.huntType	string	The type of threat hunt configuration.
RubrikPolaris.AdvanceIOCScan.config.clusterUuids	unknown	The list of cluster UUIDs included in the hunt config.
RubrikPolaris.AdvanceIOCScan.config.objectFids	unknown	The list of object FIDs targeted by the hunt.
RubrikPolaris.AdvanceIOCScan.config.__typename	string	The GraphQL typename for the HuntConfig object.
RubrikPolaris.AdvanceIOCScan.status	string	The status of the threat hunt execution.
RubrikPolaris.AdvanceIOCScan.__typename	string	The GraphQL typename for the HuntResponse object.

Command example

!rubrik-advance-ioc-scan object_id="obj-123" ioc_type="INDICATOR_OF_COMPROMISE_TYPE_HASH" ioc_value="test-ioc-value"

Context Example

{
    "RubrikPolaris": {
        "AdvanceIOCScan": {
            "huntId": "hunt-abc",
            "huntName": "Test Hunt",
            "config": {
                "huntType": "THREAT_HUNT_V2",
                "clusterUuids": ["cluster-1"],
                "objectFids": ["obj-123"],
                "__typename": "HuntConfig"
            },
            "status": "HUNT_TRIGGER_SUCCEEDED",
            "__typename": "HuntResponse"
        }
    }
}

Human Readable Output

The new advance Threat Hunt started with ID: hunt-abc

rubrik-anomaly-csv-analysis-v2

Request for the analysis and directly download the anomaly CSV analyzed file.

Base Command

rubrik-anomaly-csv-analysis-v2

Input

Argument Name	Description	Required
cluster_id	The unique ID of the cluster. Note: Users can retrieve the list of the cluster IDs by executing the “rubrik-gps-cluster-list” command.	Required
snapshot_id	The CDM snapshot ID. Note: Use the “rubrik-radar-suspicious-file-list” command to retrieve the actual CDM ID from the Anomaly ID. Example format to get the snapshot CDM ID from Anomaly ID: “<Cluster-ID>:::VirtualMachine:::<Snappable-ID>:::<CDM-ID>”.	Required
object_id	The VM object ID (Snappable ID). Note: Users can retrieve the list of Snappable IDs by executing the “rubrik-polaris-vm-objects-list” command. Example format to get the Snappable ID: “VirtualMachine:::<Snappable-ID>”.	Required

Context Output

Path	Type	Description
RubrikPolaris.AnomalyCSVv2.clusterId	String	The ID of the cluster.
RubrikPolaris.AnomalyCSVv2.snapshotId	String	The ID of the snapshot.
RubrikPolaris.AnomalyCSVv2.objectId	String	The ID of the object.
RubrikPolaris.AnomalyCSVv2.externalId	String	The external ID of the CSV file.
RubrikPolaris.AnomalyCSVv2.isSuccessful	Boolean	Whether the CSV analysis was successful or not.
InfoFile.Name	string	FileName.
InfoFile.EntryID	string	The EntryID of the report.
InfoFile.Size	number	File Size.
InfoFile.Type	string	File type e.g. “PE”.
InfoFile.Info	string	Basic information of the file.

Command example

!rubrik-anomaly-csv-analysis-v2 cluster_id="00000000-0000-0000-0000-000000000000" snapshot_id="00000000-0000-0000-0000-000000000000" object_id="00000000-0000-0000-0000-000000000000-vm-000"

Context Example

{
    "InfoFile": {
        "EntryID": "10000@00000000-0000-0000-0000-000000000001",
        "Extension": "csv",
        "Info": "text/csv; charset=utf-8",
        "Name": "snapshot_00000000-0000-0000-0000-000000000000.csv",
        "Size": 1771317,
        "Type": "ASCII text, with very long lines"
    },
    "RubrikPolaris": {
        "AnomalyCSVv2": {
            "clusterId": "00000000-0000-0000-0000-000000000000",
            "externalId": "00000000-0000-0000-0000-000000000000",
            "isSuccessful": true,
            "objectId": "00000000-0000-0000-0000-000000000000-vm-000",
            "snapshotId": "00000000-0000-0000-0000-000000000000"
        }
    }
}

Human Readable Output

Successfully downloaded the analyzed CSV file

rubrik-data-security-violation-list

Retrieve the list of DSPM violations.

Base Command

rubrik-data-security-violation-list

Input

Argument Name	Description	Required
object_type	Filter the violations based on object types. Supports comma separated values. Note: Values not included in the options can be found in the documentation. Possible values are: AWS_NATIVE_DYNAMODB_TABLE, AWS_NATIVE_EBS_VOLUME, AWS_NATIVE_RDS_INSTANCE, AWS_NATIVE_S3_BUCKET, AZURE_MANAGED_DISK, AZURE_SQL_DATABASE_DB, AZURE_SQL_MANAGED_INSTANCE_DB, AZURE_STORAGE_ACCOUNT, AZURE_VIRTUAL_MACHINE, GCP_NATIVE_DISK, GCP_NATIVE_GCE_INSTANCE, HYPERV_VIRTUAL_MACHINE, K8S_PROTECTION_SET, K8S_VIRTUAL_MACHINE, LINUX_FILESET, NAS_FILESET, NUTANIX_VIRTUAL_MACHINE, O365_ONEDRIVE, O365_SITE, ORACLE_DATA_GUARD_GROUP, ORACLE_DATABASE, SHARE_FILESET, VOLUME_GROUP, VSPHERE_VIRTUAL_MACHINE, WINDOWS_FILESET.	Optional
detection_start_date	Filter the violations detected after this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: detection_start_date and detection_end_date both or none of them should be initialized.	Optional
detection_end_date	Filter the violations detected before this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: detection_start_date and detection_end_date both or none of them should be initialized.	Optional
resolved_start_date	Filter the violations resolved after this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: resolved_start_date and resolved_end_date both or none of them should be initialized.	Optional
resolved_end_date	Filter the violations resolved before this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: resolved_start_date and resolved_end_date both or none of them should be initialized.	Optional
category	Filter the violations by category. Supports comma separated values. Possible values are: CATEGORY_UNSPECIFIED, MISPLACED, REDUNDANT, OVEREXPOSED, UNPROTECTED.	Optional
status	Filter the violations by status. Supports comma separated values. Possible values are: OPEN, IN_PROGRESS, REMEDIATED, DISMISSED, CLOSED.	Optional
severity	Filter the violations by severity level. Supports comma separated values. Possible values are: SEVERITY_UNSPECIFIED, LOW, MEDIUM, HIGH, CRITICAL.	Optional
sensitivity	Filter the violations by sensitivity level. Supports comma separated values. Possible values are: HIGH, MEDIUM, LOW, NO.	Optional
limit	Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50.	Optional
next_page_token	The next page cursor to retrieve the next set of results.	Optional
sort_by	Specify the field to use for sorting the response. Possible values are: SEVERITY, HITS, DETECTION_TIME, UPDATE_TIME, IDENTITY_TYPE, FILES_AT_RISK, TOTAL_HITS, ACCESSIBLE_OBJECTS, ORIGIN, EVENT_TIME, NAME, TYPE. Default is DETECTION_TIME.	Optional
sort_order	Specify the order to sort the data in. Possible values are: ASC, DESC. Default is DESC.	Optional

Context Output

Path	Type	Description
RubrikPolaris.DSPMViolation.policyViolationId	String	The unique identifier for the policy violation.
RubrikPolaris.DSPMViolation.status	String	The current status of the policy violation.
RubrikPolaris.DSPMViolation.__typename	String	The GraphQL typename for the violation object.
RubrikPolaris.DSPMViolation.createdAt	Date	The date and time when the policy violation was created.
RubrikPolaris.DSPMViolation.lastUpdatedAt	Date	The date and time when the policy violation was last updated.
RubrikPolaris.DSPMViolation.policy.policyId	String	The unique identifier of the policy associated with the violation.
RubrikPolaris.DSPMViolation.policy.name	String	The name of the policy associated with the violation.
RubrikPolaris.DSPMViolation.policy.policySeverity	String	The severity level assigned to the policy.
RubrikPolaris.DSPMViolation.policy.__typename	String	The GraphQL typename for the policy object.
RubrikPolaris.DSPMViolation.resourceId	String	The unique identifier of the resource associated with the violation.
RubrikPolaris.DSPMViolation.resourceType	String	The type of the resource associated with the violation.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.name	String	The name of the resource where the violation occurred.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.objectType	String	The object type of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.platform	String	The platform of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.physicalHost	String	The physical host where the resource resides.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.accountName	String	The name of the associated cloud account.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.__typename	String	The GraphQL typename for the cloud account info object.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.__typename	String	The GraphQL typename for the resource metadata details object.
RubrikPolaris.DSPMViolation.resourceMetadata.__typename	String	The GraphQL typename for the resource metadata object.
RubrikPolaris.DSPMViolation.details.dataCategories.id	String	The ID of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.name	String	The name of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.totalViolatedHits	Integer	The total violated hits of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.__typename	String	The type name of the data category.
RubrikPolaris.DSPMViolation.details.dataTypes.id	String	The ID of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.name	String	The name of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.totalViolatedHits	Integer	The total violated hits of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.__typename	String	The type name of the data type.
RubrikPolaris.DSPMViolation.details.violatedNoRiskSensitiveHits	Number	The number of no-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedLowRiskSensitiveHits	Number	The number of low-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedMediumRiskSensitiveHits	Number	The number of medium-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedHighRiskSensitiveHits	Number	The number of high-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.snapshotId	String	The ID of the snapshot associated with the violation details.
RubrikPolaris.DSPMViolation.details.__typename	String	The GraphQL typename for the violation details object.
RubrikPolaris.DSPMViolation.remediations.type	String	The type of the remediation action.
RubrikPolaris.DSPMViolation.remediations.state	String	The state of the remediation action.
RubrikPolaris.DSPMViolation.remediations.remediationDetails	Unknown	Detailed information about the remediation action.
RubrikPolaris.DSPMViolation.remediations.__typename	String	The GraphQL typename for the remediation object.
RubrikPolaris.DSPMViolation.remediations	Unknown	The list of remediations associated with the violation.
RubrikPolaris.PageToken.DSPMViolation.next_page_token	String	Next page token.
RubrikPolaris.PageToken.DSPMViolation.name	String	Name of the command.
RubrikPolaris.PageToken.DSPMViolation.has_next_page	Boolean	Whether the result has the next page or not.

Command example

!rubrik-data-security-violation-list status="OPEN" severity="MEDIUM" limit="50"

Context Example

{
    "RubrikPolaris": {
        "DSPMViolation": [
            {
                "policyViolationId": "00000000-0000-0000-0000-000000000001",
                "status": "POLICY_VIOLATION_STATUS_OPEN",
                "__typename": "PolicyViolation",
                "createdAt": "2026-03-06T06:30:45.000Z",
                "lastUpdatedAt": "2026-03-24T05:30:07.000Z",
                "name": "Secrets stored outside of vault",
                "violationSeverity": "MEDIUM",
                "policy": {
                    "policyId": "00000000-0000-0000-0000-000000000010",
                    "name": "Secrets stored outside of vault",
                    "policySeverity": "MEDIUM",
                    "policyCategory": "MISPLACED",
                    "description": "Detects secrets stored outside of vault",
                    "__typename": "DSPMPolicy"
                },
                "resourceId": "00000000-0000-0000-0000-000000000020",
                "resourceType": "RESOURCE_TYPE_OBJECT",
                "resourceMetadata": {
                    "metadata": {
                        "name": "DEMO-RADAR02",
                        "objectType": "VSPHERE_VIRTUAL_MACHINE",
                        "platform": "PLATFORM_DATA_CENTER",
                        "physicalHost": "rubrikdemo.com/Datacenters/Data Center/vm/Discovered virtual machine",
                        "__typename": "CommonAssetMetadata"
                    },
                    "__typename": "ResourceMetadata"
                },
                "details": {
                    "dataCategories": [
                        {
                            "__typename": "DataCategoryStats",
                            "id": "00000000-0000-0000-0000-000000000010",
                            "name": "",
                            "totalViolatedHits": 1
                        },
                        {
                            "__typename": "DataCategoryStats",
                            "id": "00000000-0000-0000-0000-000000000020",
                            "name": "",
                            "totalViolatedHits": 1
                        }
                    ],
                    "dataTypes": [
                        {
                            "__typename": "DataTypeStats",
                            "id": "00000000-0000-0000-0000-000000000010",
                            "name": "",
                            "totalViolatedHits": 1
                        },
                        {
                            "__typename": "DataTypeStats",
                            "id": "00000000-0000-0000-0000-000000000020",
                            "name": "",
                            "totalViolatedHits": 1
                        }
                    ],
                    "violatedNoRiskSensitiveHits": 37,
                    "violatedLowRiskSensitiveHits": 2,
                    "violatedMediumRiskSensitiveHits": 1,
                    "violatedHighRiskSensitiveHits": 0,
                    "snapshotId": "00000000-0000-0000-0000-000000000030",
                    "__typename": "DataGovViolationDetails"
                },
                "remediations": [
                    {
                        "type": "REMEDIATION_TYPE_EXPORT_ACTIONS_LOG_TO_CSV",
                        "state": "REMEDIATION_STATE_SUCCESS",
                        "__typename": "RemediationMetadata"
                    }
                ]
            },
            {
                "policyViolationId": "00000000-0000-0000-0000-000000000002",
                "status": "POLICY_VIOLATION_STATUS_OPEN",
                "__typename": "PolicyViolation",
                "createdAt": "2026-02-25T15:30:25.000Z",
                "lastUpdatedAt": "2026-03-23T16:30:05.000Z",
                "name": "Stale sensitive data",
                "violationSeverity": "LOW",
                "policy": {
                    "policyId": "00000000-0000-0000-0000-000000000011",
                    "name": "Stale sensitive data - not modified for over a year",
                    "policySeverity": "LOW",
                    "policyCategory": "REDUNDANT",
                    "description": "Detects stale sensitive data",
                    "__typename": "DSPMPolicy"
                },
                "resourceId": "00000000-0000-0000-0000-000000000021",
                "resourceType": "RESOURCE_TYPE_OBJECT",
                "resourceMetadata": {
                    "metadata": {
                        "name": "file-store",
                        "objectType": "AWS_NATIVE_S3_BUCKET",
                        "platform": "PLATFORM_AWS",
                        "physicalHost": "rubrik-lab/us-east-1",
                        "cloudAccountInfo": {
                            "accountName": "rubrik-lab",
                            "__typename": "CloudAccountInfo"
                        },
                        "__typename": "CommonAssetMetadata"
                    },
                    "__typename": "ResourceMetadata"
                },
                "details": {
                    "violatedNoRiskSensitiveHits": 83,
                    "violatedLowRiskSensitiveHits": 0,
                    "violatedMediumRiskSensitiveHits": 0,
                    "violatedHighRiskSensitiveHits": 7,
                    "snapshotId": "00000000-0000-0000-0000-000000000031",
                    "__typename": "DataGovViolationDetails"
                }
            }
        ]
    },
    "RubrikPolaris": {
        "PageToken": {
            "DSPMViolation": {
                "name": "rubrik-data-security-violation-list",
                "next_page_token": "hash_token",
                "has_next_page": true
            }
        }
    }
}

Human Readable Output

DSPM Violations List

ID Violation Name Severity Object Name Violation Status High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Detection On

00000000-0000-0000-0000-000000000001 Secrets stored outside of vault Medium DEMO-RADAR02 Open 0 1 2 37 2026-03-06T06:30:45.000Z

00000000-0000-0000-0000-000000000002 Stale sensitive data - not modified for over a year Low file-store Open 7 0 0 83 2026-02-25T15:30:25.000Z

Note: To retrieve the next set of results use, “next_page_token” = hash_token

rubrik-data-security-violation-get

Retrieve the details of DSPM violation based on the provided violation ID.

Base Command

rubrik-data-security-violation-get

Input

Argument Name	Description	Required
violation_id	The ID of the DSPM violation. Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.	Required

Context Output

Path	Type	Description
RubrikPolaris.DSPMViolation.policyViolationId	String	The unique identifier for the policy violation.
RubrikPolaris.DSPMViolation.status	String	The current status of the policy violation.
RubrikPolaris.DSPMViolation.__typename	String	The GraphQL typename for the violation object.
RubrikPolaris.DSPMViolation.createdAt	Date	The date and time when the policy violation was created.
RubrikPolaris.DSPMViolation.lastUpdatedAt	Date	The date and time when the policy violation was last updated.
RubrikPolaris.DSPMViolation.policy.policyId	String	The unique identifier of the policy associated with the violation.
RubrikPolaris.DSPMViolation.policy.name	String	The name of the policy associated with the violation.
RubrikPolaris.DSPMViolation.policy.policySeverity	String	The severity level assigned to the policy.
RubrikPolaris.DSPMViolation.policy.__typename	String	The GraphQL typename for the policy object.
RubrikPolaris.DSPMViolation.resourceId	String	The unique identifier of the resource associated with the violation.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.name	String	The name of the resource where the violation occurred.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.objectType	String	The object type of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.platform	String	The platform of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.physicalHost	String	The physical host where the resource resides.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.accountName	String	The name of the associated cloud account.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.cloudAccountInfo.__typename	String	The GraphQL typename for the cloud account info object.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.__typename	String	The GraphQL typename for the resource metadata details object.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.clusterName	String	The name of the cluster.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.clusterUuid	String	The UUID of the cluster.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.clusterInfo.__typename	String	The GraphQL typename for the cluster info object.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.creationTime	Number	The creation time of the metadata.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.lastAccessTime	Number	The last access time of the metadata.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.snapshotTimestamp	Number	The snapshot timestamp.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.isDeleted	Boolean	Whether the resource is deleted.
RubrikPolaris.DSPMViolation.resourceMetadata.metadata.region	String	The region of the resource.
RubrikPolaris.DSPMViolation.resourceMetadata.__typename	String	The GraphQL typename for the resource metadata object.
RubrikPolaris.DSPMViolation.details.violatedNoRiskSensitiveHits	Number	The number of no-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedLowRiskSensitiveHits	Number	The number of low-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedMediumRiskSensitiveHits	Number	The number of medium-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedHighRiskSensitiveHits	Number	The number of high-risk sensitive hits involved in the violation.
RubrikPolaris.DSPMViolation.details.violatedSensitiveHits	Number	The total number of violated sensitive hits.
RubrikPolaris.DSPMViolation.details.dataTypes.id	String	The ID of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.name	String	The name of the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.totalViolatedHits	Number	The total violated hits for the data type.
RubrikPolaris.DSPMViolation.details.dataTypes.__typename	String	The GraphQL typename for the data type stats.
RubrikPolaris.DSPMViolation.details.mipLabels	Unknown	The MIP labels associated with the details.
RubrikPolaris.DSPMViolation.details.documentTypes	Unknown	The document types associated with the details.
RubrikPolaris.DSPMViolation.details.dataCategories.id	String	The ID of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.name	String	The name of the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.totalViolatedHits	Number	The total violated hits for the data category.
RubrikPolaris.DSPMViolation.details.dataCategories.__typename	String	The GraphQL typename for the data category stats.
RubrikPolaris.DSPMViolation.details.snapshotId	String	The ID of the snapshot associated with the violation details.
RubrikPolaris.DSPMViolation.details.__typename	String	The GraphQL typename for the violation details object.
RubrikPolaris.DSPMViolation.policy.description	String	The description of the policy.
RubrikPolaris.DSPMViolation.policy.policyCategory	String	The category of the policy.
RubrikPolaris.DSPMViolation.policy.containsAccessFilters	Boolean	Whether the policy contains access filters.
RubrikPolaris.DSPMViolation.remediations.state	String	The state of the remediation action.
RubrikPolaris.DSPMViolation.remediations.remediationId	String	The ID of the remediation.
RubrikPolaris.DSPMViolation.remediations.remediationDetails	Unknown	Detailed information about the remediation action.
RubrikPolaris.DSPMViolation.remediations.__typename	String	The GraphQL typename for the remediation object.

Command example

!rubrik-data-security-violation-get violation_id="00000000-0000-0000-0000-000000000001"

Context Example

{
    "RubrikPolaris": {
        "DSPMViolation": {
            "policyViolationId": "00000000-0000-0000-0000-000000000001",
            "status": "POLICY_VIOLATION_STATUS_OPEN",
            "violationSeverity": "MEDIUM",
            "createdAt": "2026-03-06T06:30:45.000Z",
            "lastUpdatedAt": "2026-03-24T05:30:07.000Z",
            "resourceId": "00000000-0000-0000-0000-000000000002",
            "__typename": "PolicyViolation",
            "policy": {
                "policyId": "00000000-0000-0000-0000-000000000003",
                "name": "Secrets stored outside of vault",
                "description": "Storing secrets outside vaults can lead to privilege escalation and unauthorized access. Store secrets in a secure vault to limit exposure.",
                "policyCategory": "MISPLACED",
                "policySeverity": "MEDIUM",
                "containsAccessFilters": false,
                "__typename": "DSPMPolicy"
            },
            "resourceMetadata": {
                "metadata": {
                    "name": "DEMO-RADAR02",
                    "objectType": "VSPHERE_VIRTUAL_MACHINE",
                    "platform": "PLATFORM_DATA_CENTER",
                    "physicalHost": "vcsa.rubrikdemo.com/Datacenters/Data Center/vm/Discovered virtual machine",
                    "clusterInfo": {
                        "clusterName": "Cluster_C",
                        "clusterUuid": "00000000-0000-0000-0000-000000000004",
                        "__typename": "ClusterInfo"
                    },
                    "creationTime": 0,
                    "lastAccessTime": 0,
                    "snapshotTimestamp": 1774329080131,
                    "isDeleted": false,
                    "region": "",
                    "cloudAccountInfo": {
                        "accountName": "",
                        "__typename": "CloudAccountInfo"
                    },
                    "__typename": "CommonAssetMetadata"
                },
                "__typename": "ResourceMetadata"
            },
            "details": {
                "snapshotId": "00000000-0000-0000-0000-000000000005",
                "violatedSensitiveHits": 40,
                "violatedNoRiskSensitiveHits": 37,
                "violatedLowRiskSensitiveHits": 2,
                "violatedMediumRiskSensitiveHits": 1,
                "violatedHighRiskSensitiveHits": 0,
                "__typename": "DataGovViolationDetails",
                "dataTypes": [
                    {
                        "id": "00000000-0000-0000-0000-000000000006",
                        "name": "Country",
                        "totalViolatedHits": 35,
                        "__typename": "DataTypeStats"
                    },
                    {
                        "id": "00000000-0000-0000-0000-000000000007",
                        "name": "US State",
                        "totalViolatedHits": 2,
                        "__typename": "DataTypeStats"
                    }
                ],
                "dataCategories": [
                    {
                        "id": "00000000-0000-0000-0000-000000000008",
                        "name": "Geographical",
                        "totalViolatedHits": 37,
                        "__typename": "DataCategoryStats"
                    }
                ]
            },
            "remediations": [
                {
                    "remediationId": "00000000-0000-0000-0000-000000000009",
                    "state": "REMEDIATION_STATE_SUCCESS",
                    "__typename": "RemediationMetadata"
                }
            ]
        }
    }
}

Human Readable Output

DSPM Violation Data

ID Violation Name Severity Violation Status Detection Time Last Updated Policy ID Policy Description Policy Category Policy Severity Total Risk Hits High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Snapshot ID Object ID Object Name Object Type Object Location Object Platform Cluster ID Cluster Name Data Types Data Categories

00000000-0000-0000-0000-000000000001 Secrets stored outside of vault Medium Open 2026-03-06T06:30:45.000Z 2026-03-24T05:30:07.000Z 00000000-0000-0000-0000-000000000003 Storing secrets outside vaults can lead to privilege escalation and unauthorized access. Store secrets in a secure vault to limit exposure. MISPLACED Medium 40 0 1 2 37 00000000-0000-0000-0000-000000000005 00000000-0000-0000-0000-000000000002 DEMO-RADAR02 VSPHERE_VIRTUAL_MACHINE vcsa.rubrikdemo.com/Datacenters/Data Center/vm/Discovered virtual machine PLATFORM_DATA_CENTER 00000000-0000-0000-0000-000000000004 Cluster_C - id: 00000000-0000-0000-0000-000000000006
name: Country
totalViolatedHits: 35
- id: 00000000-0000-0000-0000-000000000007
name: US State
totalViolatedHits: 2 - id: 00000000-0000-0000-0000-000000000008
name: Geographical
totalViolatedHits: 37

rubrik-data-security-violation-status-update

Updates the status of the DSPM violation.

Base Command

rubrik-data-security-violation-status-update

Input

Argument Name	Description	Required
violation_id	The ID of the DSPM violation. Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.	Required
status	The status to update for violation. Possible values are: OPEN, IN_PROGRESS, REMEDIATED, DISMISSED, CLOSED.	Required

Context Output

Path	Type	Description
RubrikPolaris.DSPMViolation.policyViolationId	String	The ID of the violation.
RubrikPolaris.DSPMViolation.status	String	The status of the violation.

Command example

!rubrik-data-security-violation-status-update violation_id="00000000-0000-0000-0000-000000000001" status="IN_PROGRESS"

Context Example

{
    "RubrikPolaris": {
        "DSPMViolation": {
            "policyViolationId": "00000000-0000-0000-0000-000000000001",
            "status": "POLICY_VIOLATION_STATUS_IN_PROGRESS"
        }
    }
}

Human Readable Output

Successfully updated the DSPM violation status to In Progress

rubrik-data-security-violation-file-list

Retrieve the file information of data security violation based on the provided violation ID.

Base Command

rubrik-data-security-violation-file-list

Input

Argument Name	Description	Required
violation_id	The ID of the DSPM violation. Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.	Required
snapshot_id	The snapshot ID. Note: Users can get the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.	Required
object_id	The object ID. Note: Users can get the Object ID by executing the “rubrik-polaris-objects-list” command.	Required
limit	Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 25.	Optional
next_page_token	The next page cursor to retrieve the next set of results.	Optional
file_name	Filter files by their name.	Optional
last_access_start_date	Filter files with last access after this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: last_access_start_date and last_access_end_date both or none of them should be initialized.	Optional
last_access_end_date	Filter files with last access before this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: last_access_start_date and last_access_end_date both or none of them should be initialized.	Optional
last_modified_start_date	Filter files with last modified after this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: last_modified_start_date and last_modified_end_date both or none of them should be initialized.	Optional
last_modified_end_date	Filter files with last modified before this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: last_modified_start_date and last_modified_end_date both or none of them should be initialized.	Optional
creation_start_date	Filter files created after this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: creation_date_start_date and creation_date_start_date both or none of them should be initialized.	Optional
creation_end_date	Filter files created before this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: creation_date_start_date and creation_date_start_date both or none of them should be initialized.	Optional
last_scan_start_date	Filter files with last scan after this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: last_scan_start_date and last_scan_end_date both or none of them should be initialized.	Optional
last_scan_end_date	Filter files with last scan before this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: last_scan_start_date and last_scan_end_date both or none of them should be initialized.	Optional
sensitivity	Filter files by sensitivity level. Supports comma separated values. Possible values are: HIGH, MEDIUM, LOW, NO.	Optional
exposure	Filter files by exposure type. Supports comma separated values. Possible values are: EXPLICIT, INHERITED, NOT_OPEN, PUBLIC.	Optional
access_via	Filter files by access type. Possible values are: ACCESS_TYPE_UNSPECIFIED, DIRECT, GROUP, ROLE. Default is ACCESS_TYPE_UNSPECIFIED.	Optional
sort_order	Specify the order to sort the data in. Possible values are: ASC, DESC. Default is DESC.	Optional
sort_by	Specify the field to use for sorting the response. Possible values are: CLUSTER, CREATION_TIME, DAILY_CHANGE, DATA_CATEGORY, DATA_TYPE, DOCUMENT_TYPE, EXPOSED_FILES, FILES_WITH_HITS, FILES_WITH_OPEN_ACCESS_HITS, HITS, HITS_BY_SENSITIVITY, LAST_ACCESS_TIME, LAST_MODIFIED, LAST_SCAN_TIME, NAME, NATIVE_PATH, NUM_ACTIVITIES, NUM_ACTIVITIES_DELTA, OBJECT_LOCATION, OBJECT_NAME, OPEN_ACCESS_TYPE, SNAPSHOT_TIME, STALE_FILES_WITH_HITS, TOTAL_SENSITIVE_HITS. Default is HITS.	Optional

Context Output

Path	Type	Description
Rubrik.DSPMViolationFile.nativePath	String	The native path of the file.
Rubrik.DSPMViolationFile.stdPath	String	The standardized path of the file.
Rubrik.DSPMViolationFile.filename	String	The name of the file.
Rubrik.DSPMViolationFile.mode	String	The file mode.
Rubrik.DSPMViolationFile.size	Number	The file size in bytes.
Rubrik.DSPMViolationFile.lastAccessTime	Number	The last access time of the file.
Rubrik.DSPMViolationFile.lastModifiedTime	Number	The last modified time of the file.
Rubrik.DSPMViolationFile.creationTime	Number	The creation time of the file.
Rubrik.DSPMViolationFile.lastScanTime	Number	The last scan time of the file.
Rubrik.DSPMViolationFile.directory	String	The directory of the file.
Rubrik.DSPMViolationFile.createdBy	String	The user who created the file.
Rubrik.DSPMViolationFile.modifiedBy	String	The user who last modified the file.
Rubrik.DSPMViolationFile.numDescendantFiles	Number	The number of descendant files.
Rubrik.DSPMViolationFile.numDescendantErrorFiles	Number	The number of descendant files with errors.
Rubrik.DSPMViolationFile.numDescendantSkippedExtFiles	Number	The number of descendant files skipped due to extension.
Rubrik.DSPMViolationFile.numDescendantSkippedSizeFiles	Number	The number of descendant files skipped due to size.
Rubrik.DSPMViolationFile.errorCode	String	The error code.
Rubrik.DSPMViolationFile.hits.totalHits	Number	The total number of hits.
Rubrik.DSPMViolationFile.hits.violations	Number	The number of violations.
Rubrik.DSPMViolationFile.hits.violationsDelta	Number	The change in the number of violations.
Rubrik.DSPMViolationFile.hits.totalHitsDelta	Number	The change in the total number of hits.
Rubrik.DSPMViolationFile.hits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.filesWithHits.totalHits	Number	The total number of hits in files.
Rubrik.DSPMViolationFile.filesWithHits.violations	Number	The number of violations in files.
Rubrik.DSPMViolationFile.filesWithHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.openAccessFilesWithHits.totalHits	Number	The total number of hits in open access files.
Rubrik.DSPMViolationFile.openAccessFilesWithHits.violations	Number	The number of violations in open access files.
Rubrik.DSPMViolationFile.openAccessFilesWithHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.staleFilesWithHits.totalHits	Number	The total number of hits in stale files.
Rubrik.DSPMViolationFile.staleFilesWithHits.violations	Number	The number of violations in stale files.
Rubrik.DSPMViolationFile.staleFilesWithHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.groupType	String	The type of the analyzer group.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.id	String	The ID of the analyzer group.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.name	String	The name of the analyzer group.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerGroup.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.totalHits	Number	The total number of hits.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.violations	Number	The number of violations.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.hits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.id	String	The ID of the analyzer.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.name	String	The name of the analyzer.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.analyzerType	String	The type of the analyzer.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.analyzer.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.analyzerResults.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.totalHits	Number	The total number of hits.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.violations	Number	The number of violations.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.violationsDelta	Number	The change in the number of violations.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.totalHitsDelta	Number	The change in the total number of hits.
Rubrik.DSPMViolationFile.analyzerGroupResults.hits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerGroupResults.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.totalCount	Number	The total count of high risk files.
Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.violatedCount	Number	The count of high risk files with violations.
Rubrik.DSPMViolationFile.sensitiveFiles.highRiskFileCount.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.totalCount	Number	The total count of medium risk files.
Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.violatedCount	Number	The count of medium risk files with violations.
Rubrik.DSPMViolationFile.sensitiveFiles.mediumRiskFileCount.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.totalCount	Number	The total count of low risk files.
Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.violatedCount	Number	The count of low risk files with violations.
Rubrik.DSPMViolationFile.sensitiveFiles.lowRiskFileCount.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.noRiskFileCount	Unknown	The count of files with no risk.
Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.totalCount	Number	The total count of files.
Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.violatedCount	Number	The count of files with violations.
Rubrik.DSPMViolationFile.sensitiveFiles.totalFileCount.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveFiles.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.totalHits	Number	The total number of high risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.violatedHits	Number	The number of violated high risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.highRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.totalHits	Number	The total number of medium risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.violatedHits	Number	The number of violated medium risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.mediumRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.totalHits	Number	The total number of low risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.violatedHits	Number	The number of violated low risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.lowRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.totalHits	Number	The total number of no risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.violatedHits	Number	The number of violated no risk hits.
Rubrik.DSPMViolationFile.sensitiveHits.noRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.sensitiveHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.totalHits	Number	The total number of high risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.violatedHits	Number	The number of violated high risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.highRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.totalHits	Number	The total number of medium risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.violatedHits	Number	The number of violated medium risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.mediumRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.totalHits	Number	The total number of low risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.violatedHits	Number	The number of violated low risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.lowRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.totalHits	Number	The total number of no risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.violatedHits	Number	The number of violated no risk analyzer hits.
Rubrik.DSPMViolationFile.analyzerRiskHits.noRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerRiskHits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerResults.hits.totalHits	Number	The total number of hits.
Rubrik.DSPMViolationFile.analyzerResults.hits.violations	Number	The number of violations.
Rubrik.DSPMViolationFile.analyzerResults.hits.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerResults.analyzer.id	String	The ID of the analyzer.
Rubrik.DSPMViolationFile.analyzerResults.analyzer.name	String	The name of the analyzer.
Rubrik.DSPMViolationFile.analyzerResults.analyzer.analyzerType	String	The type of the analyzer.
Rubrik.DSPMViolationFile.analyzerResults.analyzer.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.analyzerResults.__typename	String	The GraphQL type name.
Rubrik.DSPMViolationFile.openAccessType	String	The open access type.
Rubrik.DSPMViolationFile.stalenessType	String	The staleness type.
Rubrik.DSPMViolationFile.numActivities	Number	The number of activities.
Rubrik.DSPMViolationFile.numActivitiesDelta	Number	The change in the number of activities.
Rubrik.DSPMViolationFile.exposureSummary	Unknown	The exposure summary.
Rubrik.DSPMViolationFile.dbEntityType	String	The database entity type.
Rubrik.DSPMViolationFile.mipLabelsSummary	Unknown	The MIP labels summary.
Rubrik.DSPMViolationFile.documentTypesSummary	Unknown	The document types summary.
Rubrik.DSPMViolationFile.__typename	String	The GraphQL type name.

Command example

!rubrik-data-security-violation-file-list violation_id="00000000-0000-0000-0000-000000000001" snapshot_id="00000000-0000-0000-0000-000000010001" object_id="00000000-0000-0000-0000-000000000002"

Context Example

{
    "RubrikPolaris": {
        "DSPMViolationFile": [
            {
                "nativePath": "/Sales Department/fileName.txt",
                "stdPath": "/Sales Department/fileName.txt",
                "filename": "fileName.txt",
                "mode": "FILE",
                "size": 67615,
                "lastAccessTime": 0,
                "lastModifiedTime": 1684957676,
                "creationTime": 0,
                "lastScanTime": 1775406966,
                "directory": "/Sales Department",
                "createdBy": "",
                "modifiedBy": "",
                "numDescendantFiles": 0,
                "numDescendantErrorFiles": 0,
                "numDescendantSkippedExtFiles": 0,
                "numDescendantSkippedSizeFiles": 0,
                "errorCode": "NOERROR",
                "hits": {
                    "totalHits": 0,
                    "violations": 3022,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "filesWithHits": {
                    "totalHits": 0,
                    "violations": 1,
                    "__typename": "Hits"
                },
                "openAccessFilesWithHits": {
                    "totalHits": 0,
                    "violations": 0,
                    "__typename": "Hits"
                },
                "staleFilesWithHits": {
                    "totalHits": 0,
                    "violations": 1,
                    "__typename": "Hits"
                },
                "analyzerGroupResults": [
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000008",
                            "name": "Personal",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000003",
                                    "name": "Italy Passport Number",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "ITIN",
                                    "analyzerType": "US_ITIN",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 0,
                            "violations": 1533,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    },
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000007",
                            "name": "Geographical",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000005",
                                    "name": "Country",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000006",
                                    "name": "County",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 0,
                            "violations": 1489,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    }
                ],
                "sensitiveFiles": {
                    "highRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "mediumRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 1,
                        "__typename": "SummaryCount"
                    },
                    "lowRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "totalFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "__typename": "SensitiveFiles"
                },
                "sensitiveHits": {
                    "highRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 1533,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 1489,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "SensitiveHits"
                },
                "analyzerRiskHits": {
                    "highRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 1533,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "AnalyzerHits"
                },
                "analyzerResults": [
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 758,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000013",
                            "name": "First Name",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    },
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 9,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000009",
                            "name": "EU Country",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    },
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 765,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000010",
                            "name": "City",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    },
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 715,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000011",
                            "name": "US State",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    },
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 775,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000012",
                            "name": "Last Name",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    }
                ],
                "openAccessType": "UNKNOWN_ACCESS",
                "stalenessType": "IS_STALE",
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "dbEntityType": "UNDEFINED_ENTITY",
                "__typename": "FileResult"
            },
            {
                "nativePath": "/Sales Department/fileName1.txt",
                "stdPath": "/Sales Department/fileName1.txt",
                "filename": "fileName1.txt",
                "mode": "FILE",
                "size": 25653,
                "lastAccessTime": 0,
                "lastModifiedTime": 1684957355,
                "creationTime": 0,
                "lastScanTime": 1775406966,
                "directory": "/Sales Department",
                "createdBy": "",
                "modifiedBy": "",
                "numDescendantFiles": 0,
                "numDescendantErrorFiles": 0,
                "numDescendantSkippedExtFiles": 0,
                "numDescendantSkippedSizeFiles": 0,
                "errorCode": "NOERROR",
                "hits": {
                    "totalHits": 0,
                    "violations": 790,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "filesWithHits": {
                    "totalHits": 0,
                    "violations": 1,
                    "__typename": "Hits"
                },
                "openAccessFilesWithHits": {
                    "totalHits": 0,
                    "violations": 0,
                    "__typename": "Hits"
                },
                "staleFilesWithHits": {
                    "totalHits": 0,
                    "violations": 1,
                    "__typename": "Hits"
                },
                "analyzerGroupResults": [
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000007",
                            "name": "Geographical",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 21,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000005",
                                    "name": "Country",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000006",
                                    "name": "County",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 0,
                            "violations": 397,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    },
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000008",
                            "name": "Personal",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000003",
                                    "name": "Italy Passport Number",
                                    "analyzerType": "UNDEFINED",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 0,
                                    "violations": 0,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "ITIN",
                                    "analyzerType": "US_ITIN",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 0,
                            "violations": 393,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    }
                ],
                "sensitiveFiles": {
                    "highRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "mediumRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 1,
                        "__typename": "SummaryCount"
                    },
                    "lowRiskFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "totalFileCount": {
                        "totalCount": 0,
                        "violatedCount": 0,
                        "__typename": "SummaryCount"
                    },
                    "__typename": "SensitiveFiles"
                },
                "sensitiveHits": {
                    "highRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 393,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 397,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "SensitiveHits"
                },
                "analyzerRiskHits": {
                    "highRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 393,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 0,
                        "violatedHits": 0,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "AnalyzerHits"
                },
                "analyzerResults": [
                    {
                        "hits": {
                            "totalHits": 0,
                            "violations": 192,
                            "__typename": "Hits"
                        },
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000010",
                            "name": "City",
                            "analyzerType": "UNDEFINED",
                            "__typename": "Analyzer"
                        },
                        "__typename": "AnalyzerResult"
                    }
                ],
                "openAccessType": "UNKNOWN_ACCESS",
                "stalenessType": "IS_STALE",
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "dbEntityType": "UNDEFINED_ENTITY",
                "__typename": "FileResult"
            }
        ]
    },
    "RubrikPolaris": {
        "PageToken": {
            "DSPMViolationFile": {
                "name": "rubrik-data-security-violation-file-list",
                "next_page_token": "end_hash_cursor",
                "has_next_page": true
            }
        }
    }
}

Human Readable Output

DSPM Violation File List

File Path File Size in Bytes Total Risk Hits High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Last Access Time Last Modified Time Data Categories

/Sales Department/fileName.txt 67615 3022 0 1533 0 1489 1970-01-01T00:00:00Z 2023-05-24T19:47:56Z - id: 00000000-0000-0000-0000-000000000008
name: Personal
totalViolatedHits: 1533
- id: 00000000-0000-0000-0000-000000000007
name: Geographical
totalViolatedHits: 1489

/Sales Department/fileName1.txt 25653 790 0 393 0 397 1970-01-01T00:00:00Z 2023-05-24T19:42:35Z - id: 00000000-0000-0000-0000-000000000007
name: Geographical
totalViolatedHits: 397
- id: 00000000-0000-0000-0000-000000000008
name: Personal
totalViolatedHits: 393

Note: To retrieve the next set of results use, “next_page_token” = end_hash_cursor

rubrik-data-security-violation-csv-download

Download all files at risk as CSV file for the specified data security violation.

Base Command

rubrik-data-security-violation-csv-download

Input

Argument Name	Description	Required
violation_id	The ID of the DSPM violation. Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.	Required
snapshot_id	The snapshot ID. Note: Users can retrieve the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.	Required
object_id	The object ID. Note: Users can retrieve the object ID by executing the “rubrik-polaris-objects-list” command.	Required
object_name	The object Name. Note: If not specified command will retrieve it using the “rubrik-data-security-violation-get” command.	Optional

Context Output

Path	Type	Description
RubrikPolaris.DSPMViolationCSVDownload.violationId	String	The ID of the violation.
RubrikPolaris.DSPMViolationCSVDownload.snapshotId	String	The ID of the snapshot.
RubrikPolaris.DSPMViolationCSVDownload.objectId	String	The ID of the object.
RubrikPolaris.DSPMViolationCSVDownload.objectName	String	The Name of the object.
RubrikPolaris.DSPMViolationCSVDownload.externalId	String	The external ID of the CSV file.
RubrikPolaris.DSPMViolationCSVDownload.isSuccessful	Boolean	Whether the CSV analysis was successful or not.
InfoFile.Name	string	FileName.
InfoFile.EntryID	string	The EntryID of the report.
InfoFile.Size	number	File Size.
InfoFile.Type	string	File type e.g. “PE”.
InfoFile.Info	string	Basic information of the file.

Command example

!rubrik-data-security-violation-csv-download violation_id="00000000-0000-0000-0000-000000000001" snapshot_id="00000000-0000-0000-0000-000000010001" object_id="00000000-0000-0000-0000-000000000002"

Context Example

{
    "InfoFile": {
        "EntryID": "10000@00000000-0000-0000-0000-000000000001",
        "Extension": "csv",
        "Info": "text/csv; charset=utf-8",
        "Name": "test_object-violating-files_file_results_1775629027.csv",
        "Size": 1771317,
        "Type": "ASCII text, with very long lines"
    },
    "RubrikPolaris": {
        "DSPMViolationCSVDownload": {
            "violationId": "00000000-0000-0000-0000-000000000001",
            "objectId": "00000000-0000-0000-0000-000000000002",
            "snapshotId": "00000000-0000-0000-0000-000000010001",
            "objectName": "test_object",
            "externalId": "00000000-0000-0000-0000-000000000011",
            "isSuccessful": true
        }
    }
}

Human Readable Output

Successfully downloaded the Files at Risk CSV file

rubrik-data-security-violation-log-download

Download remediation logs as CSV file for the specified data security violation.

Base Command

rubrik-data-security-violation-log-download

Input

Argument Name	Description	Required
violation_id	The ID of the DSPM violation. Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.	Required
object_id	The object ID. Note: Users can retrieve the object ID by executing the “rubrik-polaris-objects-list” command.	Required
object_name	The object Name. Note: If not specified command will retrieve it using the “rubrik-data-security-violation-get” command.	Optional

Context Output

Path	Type	Description
RubrikPolaris.DSPMViolationRemediationLogDownload.violationId	String	The ID of the violation.
RubrikPolaris.DSPMViolationRemediationLogDownload.objectId	String	The ID of the object.
RubrikPolaris.DSPMViolationRemediationLogDownload.remediationId	String	The ID of the remediation.
RubrikPolaris.DSPMViolationRemediationLogDownload.objectName	String	The Name of the object.
RubrikPolaris.DSPMViolationRemediationLogDownload.externalId	String	The external ID of the file.
RubrikPolaris.DSPMViolationRemediationLogDownload.isSuccessful	Boolean	Whether the command was successful or not.
InfoFile.Name	string	FileName.
InfoFile.EntryID	string	The EntryID of the report.
InfoFile.Size	number	File Size.
InfoFile.Type	string	File type e.g. “PE”.
InfoFile.Info	string	Basic information of the file.

Command example

!rubrik-data-security-violation-log-download violation_id="00000000-0000-0000-0000-000000000001" object_id="00000000-0000-0000-0000-000000000002"

Context Example

{
    "InfoFile": {
        "EntryID": "10000@00000000-0000-0000-0000-000000000001",
        "Extension": "csv",
        "Info": "text/csv; charset=utf-8",
        "Name": "test_object actions log.csv",
        "Size": 1771317,
        "Type": "ASCII text, with very long lines"
    },
    "RubrikPolaris": {
        "DSPMViolationRemediationLogDownload": {
            "violationId": "00000000-0000-0000-0000-000000000001",
            "objectId": "00000000-0000-0000-0000-000000000002",
            "remediationId": "00000000-0000-0000-0000-000000010001",
            "externalId": "00000000-0000-0000-0000-000000000011",
            "objectName": "test_object",
            "isSuccessful": true
        }
    }
}

Human Readable Output

Successfully downloaded the Remediation Log file

rubrik-identity-resilience-violation-list

Retrieves the list of Identity Resilience (IR) violations.

Base Command

rubrik-identity-resilience-violation-list

Input

Argument Name	Description	Required
policy_type	Filter the violations by policy type. Supports comma separated values. Possible values are: IDENTITY, IDP, IDENTITY_EVENT, CROWDSTRIKE, MICROSOFT_DEFENDER.	Optional
detection_start_date	Filter the violations detected after this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: detection_start_date and detection_end_date both or none of them should be initialized.	Optional
detection_end_date	Filter the violations detected before this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: detection_start_date and detection_end_date both or none of them should be initialized.	Optional
resolved_start_date	Filter the violations resolved after this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: resolved_start_date and resolved_end_date both or none of them should be initialized.	Optional
resolved_end_date	Filter the violations resolved before this date. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Jan 2026, 01 Jan 2026 04:45:33, 2026-01-01T14:05:44Z. Note: resolved_start_date and resolved_end_date both or none of them should be initialized.	Optional
category	Filter the violations by category. Supports comma separated values. Possible values are: CATEGORY_UNSPECIFIED, AUTHENTICATION_AND_SECRET_MANAGEMENT, IDENTITY_HYGIENE, EXCESSIVE_IDENTITY_RIGHTS, IDENTITY_PROVIDER_SECURITY, PRIVILEGED_ACCOUNT_RISK, IDENTITY_RISK, INFRASTRUCTURE_SECURITY, CONFIGURATION_SECURITY, MEMBERSHIP_CHANGE, GPO_CHANGE.	Optional
status	Filter the violations by status. Supports comma separated values. Possible values are: OPEN, IN_PROGRESS, REMEDIATED, DISMISSED, CLOSED.	Optional
severity	Filter the violations by severity level. Supports comma separated values. Possible values are: SEVERITY_UNSPECIFIED, LOW, MEDIUM, HIGH, CRITICAL.	Optional
identity_provider	Filter the violations by identity provider type. Supports comma separated values. Possible values are: IDP_UNSPECIFIED, ON_PREM_AD, ENTRA_ID, AWS, LOCAL_AD, SHAREPOINT, SYSTEM, OKTA.	Optional
identity_tag	Filter the violations by identity tag. Supports comma separated values. Possible values are: IDENTITY_TAG_UNSPECIFIED, PRIVILEGED, AT_RISK, SENSITIVE.	Optional
limit	Number of results to retrieve in the response. The maximum allowed size is 1000. Default is 50.	Optional
next_page_token	The next page cursor to retrieve the next set of results.	Optional
sort_by	Specify the field to use for sorting the response. Possible values are: SEVERITY, HITS, DETECTION_TIME, UPDATE_TIME, IDENTITY_TYPE, TOTAL_HITS, EVENT_TIME, NAME, TYPE. Default is DETECTION_TIME.	Optional
sort_order	Specify the order to sort the data in. Possible values are: ASC, DESC. Default is DESC.	Optional

Context Output

Path	Type	Description
RubrikPolaris.IRViolation.policyViolationId	String	The unique identifier for the policy violation.
RubrikPolaris.IRViolation.name	String	The name of the policy violation.
RubrikPolaris.IRViolation.violationSeverity	String	The severity level of the policy violation.
RubrikPolaris.IRViolation.status	String	The current status of the policy violation.
RubrikPolaris.IRViolation.createdAt	Date	The date and time when the policy violation was created.
RubrikPolaris.IRViolation.lastUpdatedAt	Date	The date and time when the policy violation was last updated.
RubrikPolaris.IRViolation.resourceId	String	The unique identifier of the resource associated with the violation.
RubrikPolaris.IRViolation.resourceType	String	The type of the resource associated with the violation.
RubrikPolaris.IRViolation.policy.policyId	String	The unique identifier of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.name	String	The name of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.description	String	The description of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.policySeverity	String	The severity level assigned to the policy.
RubrikPolaris.IRViolation.policy.policyCategory	String	The category of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.policyType	String	The type of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.frameworks	String	The compliance frameworks associated with the policy.
RubrikPolaris.IRViolation.policy.manualRemediationProcess	String	The manual remediation process recommended for the policy violation.
RubrikPolaris.IRViolation.details.domainUniqueId	String	The unique identifier of the domain associated with the violation details.
RubrikPolaris.IRViolation.details.detectionTime	Date	The time at which the threat was detected.
RubrikPolaris.IRViolation.details.startTime	Date	The start time of the alert event.
RubrikPolaris.IRViolation.details.endTime	Date	The end time of the alert event.
RubrikPolaris.IRViolation.details.mitreTactic	String	The MITRE ATT&CK tactic associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.displayName	String	The display name of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.domainName	String	The domain name of the resource associated with the violation.
RubrikPolaris.IRViolation.resourceMetadata.metadata.domainUniqueId	String	The unique identifier of the domain of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.idpType	String	The identity provider type of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.principalType	String	The principal type of the identity resource (e.g. USER, COMPUTER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.privilegeType	String	The privilege type of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.userPrincipalName	String	The user principal name of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.status	String	The status of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.title	String	The job title of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.source	String	The source of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.identityTags	String	The list of tags associated with the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.uniqueId	String	The unique identifier of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.nativeType	String	The native type of the identity resource (e.g. User).
RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainName	String	The root domain name of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainId	String	The unique identifier of the root domain of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityId	String	The unique identifier of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityName	String	The name of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityType	String	The type of the actor identity involved in the alert (e.g. USER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorPrivilegeType	String	The privilege type of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorState	String	The state of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.entityName	String	The name of the entity associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.entityId	String	The unique identifier of the entity associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityUniqueIdentifier	String	The unique identifier of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityName	String	The name of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentitySource	String	The source domain of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityStatus	String	The status of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityType	String	The type of the target identity involved in the alert (e.g. COMPUTER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdpType	String	The identity provider type of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetPrivilegeType	String	The privilege type of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.eventTime	Date	The time at which the identity event occurred.
RubrikPolaris.PageToken.IRViolation.next_page_token	String	The next page token.
RubrikPolaris.PageToken.IRViolation.name	String	The name of the command.
RubrikPolaris.PageToken.IRViolation.has_next_page	Boolean	Whether the result has the next page or not.

Command example

!rubrik-identity-resilience-violation-list limit=2

Context Example

{
    "RubrikPolaris": {
        "IRViolation": [
            {
                "policyViolationId": "00000000-0000-0000-0000-000000000001",
                "status": "POLICY_VIOLATION_STATUS_OPEN",
                "violationSeverity": "HIGH",
                "createdAt": "2026-03-25T09:29:55.000Z",
                "lastUpdatedAt": "2026-03-25T13:29:54.000Z",
                "resourceId": "00000000-0000-0000-0000-000000000101",
                "resourceType": "RESOURCE_TYPE_IDENTITY",
                "policy": {
                    "policyId": "00000000-0000-0000-0000-000000000201",
                    "name": "Excessive admin privileges",
                    "description": "Users with excessive admin privileges pose a risk of privilege escalation.",
                    "policySeverity": "HIGH",
                    "policyCategory": "IDENTITY_HYGIENE",
                    "policyType": "POLICY_TYPE_IDENTITY",
                    "frameworks": [
                        "MITRE ATT&CK: TA0006",
                        "CIS Controls: 14.2, 14.6",
                        "NIST CSF: PR.AC-1, PR.PT-3",
                        "NIST SP 800-53: AC-3, AC-6, IA-5",
                        "Regulations: GDPR, HIPAA, PCI DSS, SOC 2, CMMC"
                    ],
                    "manualRemediationProcess": "Disable delegation for privileged identities. For users, it's recommended to assign them to the \"Protected Users\" group. Alternatively, you can enable the setting \"This account is sensitive and can't be delegated\". For computers and service accounts, disable delegation by disabling the setting \"Trust this computer/user for delegation to any service\". If delegation is required, convert to constrained delegation that limits which services an identity can delegate to.",
                    "__typename": "IRPolicy"
                },
                "details": {
                    "domainUniqueId": "00000000-0000-0000-0000-000000000301",
                    "__typename": "IdentityViolationDetails"
                },
                "resourceMetadata": {
                    "metadata": {
                        "displayName": "John Doe",
                        "domainName": "rubrikdemo.com",
                        "idpType": "ENTRA_ID",
                        "principalType": "USER",
                        "privilegeType": "PRIVILEGED",
                        "userPrincipalName": "demo@rubrik.com",
                        "status": "ACTIVE",
                        "source": "ON_PREM_AD",
                        "identityTags": [
                            "PRIVILEGED"
                        ],
                        "uniqueId": "00000000-0000-0000-0000-000000000401",
                        "nativeType": "User",
                        "__typename": "IdentityMetadata"
                    },
                    "__typename": "ResourceMetadata"
                },
                "__typename": "PolicyViolation"
            },
            {
                "policyViolationId": "00000000-0000-0000-0000-000000000003",
                "status": "POLICY_VIOLATION_STATUS_OPEN",
                "name": "",
                "violationSeverity": "MEDIUM",
                "createdAt": "2026-03-25T16:45:30.000Z",
                "lastUpdatedAt": "2026-03-25T18:30:15.000Z",
                "resourceId": "00000000-0000-0000-0000-000000000103",
                "resourceType": "RESOURCE_TYPE_IDP",
                "policy": {
                    "policyId": "00000000-0000-0000-0000-000000000203",
                    "name": "Overly permissive IDP configuration",
                    "description": "Identity provider with overly permissive configuration.",
                    "policySeverity": "MEDIUM",
                    "policyCategory": "IDENTITY_PROVIDER_SECURITY",
                    "policyType": "POLICY_TYPE_IDP",
                    "frameworks": [
                        "MITRE ATT&CK: TA0006",
                        "CIS Controls: 6.7; NIST CSF: PR.AC-6",
                        "NIST SP 800-53: IA-5",
                        "Regulations: GDPR, HIPAA, PCI DSS, SOC 2, CMMC"
                    ],
                    "manualRemediationProcess": "Deploy a Conditional Access policy that enforces MFA for all users.",
                    "__typename": "IRPolicy"
                },
                "details": {
                    "domainUniqueId": "00000000-0000-0000-0000-000000000303",
                    "__typename": "IdpViolationDetails"
                },
                "resourceMetadata": {
                    "metadata": {
                        "domainName": "rubrikdemo.com",
                        "domainUniqueId": "00000000-0000-0000-0000-000000000303",
                        "idpType": "OKTA",
                        "rootDomainName": "rubrikdemo.com",
                        "rootDomainId": "00000000-0000-0000-0000-000000000501",
                        "__typename": "IdpMetadata"
                    },
                    "__typename": "ResourceMetadata"
                },
                "__typename": "PolicyViolation"
            }
        ],
        "PageToken": {
            "IRViolation": {
                "name": "rubrik-identity-resilience-violation-list",
                "next_page_token": "hash_token_ir",
                "has_next_page": true
            }
        }
    }
}

Human Readable Output

IR Violations List

ID Policy Name Display Name Domain Status Severity Policy Type Category Root Domain Detected On

00000000-0000-0000-0000-000000000001 Excessive admin privileges John Doe rubrikdemo.com Open High Identity Identity Hygiene 2026-03-25T09:29:55.000Z

00000000-0000-0000-0000-000000000003 Overly permissive IDP configuration rubrikdemo.com Open Medium Idp Identity Provider Security rubrikdemo.com 2026-03-25T16:45:30.000Z

Note: To retrieve the next set of results use, “next_page_token” = hash_token_ir

rubrik-identity-resilience-violation-get

Retrieves the details of the Identity Resilience (IR) violation based on the provided violation ID.

Base Command

rubrik-identity-resilience-violation-get

Input

Argument Name	Description	Required
violation_id	The ID of the IR violation. Note: Users can get the violation ID by executing the “rubrik-identity-resilience-violation-list” command.	Required
policy_type	The policy type of the IR violation. Possible values are: IDENTITY, IDP, IDENTITY_EVENT, CROWDSTRIKE, MICROSOFT_DEFENDER.	Optional

Context Output

Path	Type	Description
RubrikPolaris.IRViolation.policyViolationId	String	The unique identifier for the policy violation.
RubrikPolaris.IRViolation.name	String	The name of the policy violation.
RubrikPolaris.IRViolation.violationSeverity	String	The severity level of the policy violation.
RubrikPolaris.IRViolation.status	String	The current status of the policy violation.
RubrikPolaris.IRViolation.createdAt	Date	The date and time when the policy violation was created.
RubrikPolaris.IRViolation.lastUpdatedAt	Date	The date and time when the policy violation was last updated.
RubrikPolaris.IRViolation.resourceId	String	The unique identifier of the resource associated with the violation.
RubrikPolaris.IRViolation.resourceType	String	The type of the resource associated with the violation.
RubrikPolaris.IRViolation.policy.policyId	String	The unique identifier of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.name	String	The name of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.description	String	The description of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.policySeverity	String	The severity level assigned to the policy.
RubrikPolaris.IRViolation.policy.policyCategory	String	The category of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.policyType	String	The type of the policy associated with the violation.
RubrikPolaris.IRViolation.policy.frameworks	String	The compliance frameworks associated with the policy.
RubrikPolaris.IRViolation.policy.manualRemediationProcess	String	The manual remediation process recommended for the policy violation.
RubrikPolaris.IRViolation.details.domainUniqueId	String	The unique identifier of the domain associated with the violation details.
RubrikPolaris.IRViolation.details.detectionTime	Date	The time at which the threat was detected.
RubrikPolaris.IRViolation.details.startTime	Date	The start time of the alert event.
RubrikPolaris.IRViolation.details.endTime	Date	The end time of the alert event.
RubrikPolaris.IRViolation.details.mitreTactic	String	The MITRE ATT&CK tactic associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.displayName	String	The display name of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.domainName	String	The domain name of the resource associated with the violation.
RubrikPolaris.IRViolation.resourceMetadata.metadata.domainUniqueId	String	The unique identifier of the domain of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.idpType	String	The identity provider type of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.principalType	String	The principal type of the identity resource (e.g. USER, COMPUTER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.privilegeType	String	The privilege type of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.userPrincipalName	String	The user principal name of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.status	String	The status of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.title	String	The job title of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.source	String	The source of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.identityTags	String	The list of tags associated with the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.uniqueId	String	The unique identifier of the identity resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.nativeType	String	The native type of the identity resource (e.g. User).
RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainName	String	The root domain name of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.rootDomainId	String	The unique identifier of the root domain of the resource.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityId	String	The unique identifier of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityName	String	The name of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorIdentityType	String	The type of the actor identity involved in the alert (e.g. USER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorPrivilegeType	String	The privilege type of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.actorState	String	The state of the actor identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.entityName	String	The name of the entity associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.entityId	String	The unique identifier of the entity associated with the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityUniqueIdentifier	String	The unique identifier of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityName	String	The name of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentitySource	String	The source domain of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityStatus	String	The status of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdentityType	String	The type of the target identity involved in the alert (e.g. COMPUTER).
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetIdpType	String	The identity provider type of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.targetPrivilegeType	String	The privilege type of the target identity involved in the alert.
RubrikPolaris.IRViolation.resourceMetadata.metadata.eventTime	Date	The time at which the identity event occurred.
RubrikPolaris.IRViolation.sensitiveHits.highRiskHits.violatedHits	Number	The number of high risk sensitive hits violated by the identity.
RubrikPolaris.IRViolation.sensitiveHits.mediumRiskHits.violatedHits	Number	The number of medium risk sensitive hits violated by the identity.
RubrikPolaris.IRViolation.sensitiveHits.lowRiskHits.violatedHits	Number	The number of low risk sensitive hits violated by the identity.
RubrikPolaris.IRViolation.sensitiveHits.noRiskHits.violatedHits	Number	The number of no risk sensitive hits violated by the identity.
RubrikPolaris.IRViolation.sensitiveHits.totalHits.violatedHits	Number	The total number of sensitive hits violated by the identity.
RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryName	String	The name of the data category associated with the sensitive hits.
RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryHits.dataCategoryId	String	The unique identifier of the data category.
RubrikPolaris.IRViolation.dataCategoryResults.dataCategoryHits.totalViolatedHits	Number	The total number of violated hits for the data category.

Command example

!rubrik-identity-resilience-violation-get violation_id="00000000-0000-0000-0000-000000000001" policy_type="IDENTITY"

Context Example

{
    "RubrikPolaris": {
        "IRViolation": {
            "policyViolationId": "00000000-0000-0000-0000-000000000001",
            "status": "POLICY_VIOLATION_STATUS_OPEN",
            "violationSeverity": "HIGH",
            "createdAt": "2026-03-25T09:29:55.000Z",
            "lastUpdatedAt": "2026-03-25T13:29:54.000Z",
            "resourceId": "00000000-0000-0000-0000-000000000101",
            "resourceType": "RESOURCE_TYPE_IDENTITY",
            "__typename": "PolicyViolation",
            "policy": {
                "policyId": "00000000-0000-0000-0000-000000000201",
                "name": "Excessive admin privileges",
                "description": "Users with excessive admin privileges pose a risk of privilege escalation.",
                "policyCategory": "IDENTITY_HYGIENE",
                "policySeverity": "HIGH",
                "policyType": "POLICY_TYPE_IDENTITY",
                "frameworks": [
                    "NIST",
                    "CIS"
                ],
                "manualRemediationProcess": "Review and revoke excess admin roles.",
                "__typename": "IRPolicy"
            },
            "details": {
                "domainUniqueId": "00000000-0000-0000-0000-000000000301",
                "mitreTactic": "Privilege Escalation",
                "__typename": "IdentityViolationDetails"
            },
            "resourceMetadata": {
                "metadata": {
                    "displayName": "John Doe",
                    "domainName": "rubrikdemo.com",
                    "idpType": "ENTRA_ID",
                    "principalType": "USER",
                    "privilegeType": "PRIVILEGED",
                    "userPrincipalName": "demo@rubrik.com",
                    "status": "ACTIVE",
                    "title": "Engineer",
                    "source": "ON_PREM_AD",
                    "nativeType": "User",
                    "__typename": "IdentityMetadata"
                },
                "__typename": "ResourceMetadata"
            },
            "identityTags": [
                "PRIVILEGED"
            ],
            "sensitiveHits": {
                "highRiskHits": {
                    "violatedHits": 5,
                    "__typename": "SensitiveHits"
                },
                "mediumRiskHits": {
                    "violatedHits": 3,
                    "__typename": "SensitiveHits"
                },
                "lowRiskHits": {
                    "violatedHits": 2,
                    "__typename": "SensitiveHits"
                },
                "noRiskHits": {
                    "violatedHits": 10,
                    "__typename": "SensitiveHits"
                },
                "totalHits": {
                    "violatedHits": 20,
                    "__typename": "SensitiveHits"
                },
                "__typename": "SensitiveHitsInfo"
            },
            "dataCategoryResults": [
                {
                    "dataCategoryName": "Financial",
                    "dataCategoryHits": {
                        "dataCategoryId": "00000000-0000-0000-0000-000000000601",
                        "totalViolatedHits": 8,
                        "__typename": "DataCategoryHits"
                    },
                    "__typename": "DataCategoryResult"
                }
            ]
        }
    }
}

Human Readable Output

IR Violation Information

ID Violation Name Severity Violation Status Detection Time Last Updated Policy ID Policy Name Policy Type Policy Description Policy Category Policy Severity Frameworks Manual Remediation Process Identity Status Resource ID Resource Type Title Display Name Domain Name Source Identity Provider Principal Type Privilege Type User Principal Name Identity Tags Native Type Domain Unique ID MITRE Tactic Total Risk Hits High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Data Categories

00000000-0000-0000-0000-000000000001 Excessive admin privileges High Open 2026-03-25T09:29:55.000Z 2026-03-25T13:29:54.000Z 00000000-0000-0000-0000-000000000201 Excessive admin privileges Identity Users with excessive admin privileges pose a risk of privilege escalation. IDENTITY_HYGIENE High NIST,
CIS Review and revoke excess admin roles. ACTIVE 00000000-0000-0000-0000-000000000101 Identity Engineer John Doe rubrikdemo.com ON_PREM_AD ENTRA_ID USER PRIVILEGED demo@rubrik.com PRIVILEGED User 00000000-0000-0000-0000-000000000301 Privilege Escalation 20 5 3 2 10 - id: 00000000-0000-0000-0000-000000000601
name: Financial
totalViolatedHits: 8

rubrik-identity-resilience-violation-status-update

Updates the status of the Identity Resilience (IR) violation.

Base Command

rubrik-identity-resilience-violation-status-update

Input

Argument Name	Description	Required
violation_id	The ID of the IR violation. Note: Users can get the violation ID by executing the “rubrik-identity-resilience-violation-list” command.	Required
status	The status to update for the violation. Possible values are: OPEN, IN_PROGRESS, REMEDIATED, DISMISSED, CLOSED.	Required

Context Output

Path	Type	Description
RubrikPolaris.IRViolation.policyViolationId	String	The ID of the violation.
RubrikPolaris.IRViolation.status	String	The status of the violation.

Command example

!rubrik-identity-resilience-violation-status-update violation_id="00000000-0000-0000-0000-000000000001" status="IN_PROGRESS"

Context Example

{
    "RubrikPolaris": {
        "IRViolation": {
            "policyViolationId": "00000000-0000-0000-0000-000000000001",
            "status": "POLICY_VIOLATION_STATUS_IN_PROGRESS"
        }
    }
}

Human Readable Output

Successfully updated the Identity Resilience violation status to In Progress

rubrik-sensitive-data-object-get

Retrieve the details of the object based on the provided object ID and snapshot ID.

Base Command

rubrik-sensitive-data-object-get

Input

Argument Name	Description	Required
object_id	The ID of the object (snappable FID). Note: Users can get the object ID by executing the “rubrik-polaris-object-list” command.	Required
snapshot_id	The Snapshot ID of the object. Note: Users can get the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.	Required
include_whitelisted_results	The boolean indicates to include the whitelisted results. Possible values are: True, False. Default is False.	Optional

Context Output

Path	Type	Description
RubrikPolaris.SensitiveDataObject.id	String	The ID of the sensitive data object.
RubrikPolaris.SensitiveDataObject.snapshotFid	String	The FID of the snapshot associated with the object.
RubrikPolaris.SensitiveDataObject.snapshotTimestamp	Number	The timestamp of the snapshot.
RubrikPolaris.SensitiveDataObject.shareType	String	The share type of the object.
RubrikPolaris.SensitiveDataObject.riskLevel	String	The risk level of the object.
RubrikPolaris.SensitiveDataObject.osType	String	The OS type of the object.
RubrikPolaris.SensitiveDataObject.isUserAccessEnabledObject	Boolean	Whether user access is enabled for the object.
RubrikPolaris.SensitiveDataObject.__typename	String	The GraphQL type name of the sensitive data object.
RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.snapshotTime	Number	The time of the latest snapshot result.
RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.snapshotFid	String	The FID of the latest snapshot result.
RubrikPolaris.SensitiveDataObject.objectStatus.policyStatuses.status	String	The status of the policy for the object.
RubrikPolaris.SensitiveDataObject.objectStatus.__typename	String	The GraphQL type name of the object status.
RubrikPolaris.SensitiveDataObject.objectStatus.latestSnapshotResult.__typename	String	The GraphQL type name of the latest snapshot result.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.totalHits	Number	The total number of sensitive data hits in the object.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.violations	Number	The total number of violations in the object.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.violationsDelta	Number	The change in violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.totalHitsDelta	Number	The change in total hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.__typename	String	The GraphQL type name of the root file result.
RubrikPolaris.SensitiveDataObject.rootFileResult.hits.__typename	String	The GraphQL type name of the root file result hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.groupType	String	The type of the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.id	String	The ID of the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.name	String	The name of the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.totalHits	Number	The total hits for the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.violations	Number	The violations for the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.violationsDelta	Number	The change in violations for the analyzer group since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.totalHitsDelta	Number	The change in total hits for the analyzer group since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.__typename	String	The GraphQL type name of the analyzer group result.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.analyzerGroup.__typename	String	The GraphQL type name of the analyzer group.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerGroupResults.hits.__typename	String	The GraphQL type name of the analyzer group hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.analyzer.id	String	The ID of the analyzer.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.analyzer.name	String	The name of the analyzer.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.totalHits	Number	The total hits for the analyzer.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.violations	Number	The violations for the analyzer.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.violationsDelta	Number	The change in violations for the analyzer since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.totalHitsDelta	Number	The change in total hits for the analyzer since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.analyzerResults.hits.__typename	String	The GraphQL type name of the analyzer result hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.totalHits	Number	The total number of files with sensitive data hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.violations	Number	The number of files with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.violationsDelta	Number	The change in files with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.totalHitsDelta	Number	The change in files with hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.filesWithHits.__typename	String	The GraphQL type name of the files with hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.totalHits	Number	The total number of open-access files.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.violations	Number	The number of open-access files with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.violationsDelta	Number	The change in open-access files with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.totalHitsDelta	Number	The change in open-access files hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFiles.__typename	String	The GraphQL type name of the open access files.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.totalHits	Number	The total number of open-access folders.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.violations	Number	The number of open-access folders with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.violationsDelta	Number	The change in open-access folders with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.totalHitsDelta	Number	The change in open-access folders hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFolders.__typename	String	The GraphQL type name of the open access folders.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.totalHits	Number	The total number of open-access files with sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.violations	Number	The number of open-access files with hits and violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.violationsDelta	Number	The change in open-access files with hits violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.totalHitsDelta	Number	The change in open-access files with hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessFilesWithHits.__typename	String	The GraphQL type name of the open access files with hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.totalHits	Number	The total number of stale files.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.violations	Number	The number of stale files with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.violationsDelta	Number	The change in stale files with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.totalHitsDelta	Number	The change in stale files hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFiles.__typename	String	The GraphQL type name of the stale files.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.totalHits	Number	The total number of stale files with sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.violations	Number	The number of stale files with hits and violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.violationsDelta	Number	The change in stale files with hits violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.totalHitsDelta	Number	The change in stale files with hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.staleFilesWithHits.__typename	String	The GraphQL type name of the stale files with hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.totalHits	Number	The total number of open-access stale files.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.violations	Number	The number of open-access stale files with violations.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.violationsDelta	Number	The change in open-access stale files with violations since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.totalHitsDelta	Number	The change in open-access stale files hits since last scan.
RubrikPolaris.SensitiveDataObject.rootFileResult.openAccessStaleFiles.__typename	String	The GraphQL type name of the open access stale files.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.totalHits	Number	The total high risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.violatedHits	Number	The violated high risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.highRiskHits.__typename	String	The GraphQL type name of the high risk hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.totalHits	Number	The total medium risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.violatedHits	Number	The violated medium risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.mediumRiskHits.__typename	String	The GraphQL type name of the medium risk hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.totalHits	Number	The total low risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.violatedHits	Number	The violated low risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.lowRiskHits.__typename	String	The GraphQL type name of the low risk hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.totalHits	Number	The total no-risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.violatedHits	Number	The violated no-risk sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.noRiskHits.__typename	String	The GraphQL type name of the no-risk hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.totalHits	Number	The total sensitive hits across all risk levels.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.violatedHits	Number	The total violated sensitive hits across all risk levels.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.totalHits.__typename	String	The GraphQL type name of the total sensitive hits summary.
RubrikPolaris.SensitiveDataObject.rootFileResult.sensitiveHits.__typename	String	The GraphQL type name of the sensitive hits.
RubrikPolaris.SensitiveDataObject.rootFileResult.numActivities	Number	The number of activities associated with the file result.
RubrikPolaris.SensitiveDataObject.rootFileResult.numActivitiesDelta	Number	The change in number of activities since last scan.
RubrikPolaris.SensitiveDataObject.snappable.id	String	The ID of the snappable object.
RubrikPolaris.SensitiveDataObject.snappable.name	String	The name of the snappable object.
RubrikPolaris.SensitiveDataObject.snappable.objectType	String	The type of the snappable object.
RubrikPolaris.SensitiveDataObject.snappable.slaAssignment	String	The SLA assignment of the snappable object.
RubrikPolaris.SensitiveDataObject.snappable.logicalPath.fid	String	The FID of the logical path node.
RubrikPolaris.SensitiveDataObject.snappable.logicalPath.name	String	The name of the logical path node.
RubrikPolaris.SensitiveDataObject.snappable.logicalPath.objectType	String	The object type of the logical path node.
RubrikPolaris.SensitiveDataObject.snappable.logicalPath.__typename	String	The GraphQL type name of the logical path node.
RubrikPolaris.SensitiveDataObject.snappable.physicalPath.fid	String	The FID of the physical path node.
RubrikPolaris.SensitiveDataObject.snappable.physicalPath.name	String	The name of the physical path node.
RubrikPolaris.SensitiveDataObject.snappable.physicalPath.objectType	String	The object type of the physical path node.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.id	String	The ID of the effective SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.name	String	The name of the effective SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.isRetentionLockedSla	Boolean	Whether the SLA domain has retention lock enabled.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.retentionLockMode	String	The retention lock mode of the SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.description	String	The description of the effective SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.effectiveSlaDomain.__typename	String	The GraphQL type name of the effective SLA domain.
RubrikPolaris.SensitiveDataObject.snappable.rscNativeObjectPendingSla.id	String	The ID of the pending SLA for the native object.
RubrikPolaris.SensitiveDataObject.snappable.rscNativeObjectPendingSla.name	String	The name of the pending SLA for the native object.
RubrikPolaris.SensitiveDataObject.snappable.__typename	String	The GraphQL type name of the snappable object.
RubrikPolaris.SensitiveDataObject.policySummaries.id	String	The ID of the classification policy.
RubrikPolaris.SensitiveDataObject.policySummaries.name	String	The name of the classification policy.
RubrikPolaris.SensitiveDataObject.policySummaries.colorEnum	String	The color enum of the classification policy.
RubrikPolaris.SensitiveDataObject.policySummaries.__typename	String	The GraphQL type name of the classification policy summary.

Context Example

{
    "RubrikPolaris": {
        "SensitiveDataObject": {
            "id": "00000000-0000-0000-0000-000000000001",
            "snapshotFid": "00000000-0000-0000-0000-000000000001",
            "snapshotTimestamp": 1782272126524,
            "shareType": "UNKNOWN_SHARE_TYPE",
            "riskLevel": "HIGH_RISK",
            "objectStatus": {
                "policyStatuses": [
                    {
                        "status": "UP_TO_DATE",
                        "__typename": "PolicyStatus"
                    },
                    {
                        "status": "UP_TO_DATE",
                        "__typename": "PolicyStatus"
                    }
                ],
                "latestSnapshotResult": {
                    "snapshotTime": 1782444911010,
                    "snapshotFid": "00000000-0000-0000-0000-000000000002",
                    "__typename": "SnapshotResult"
                },
                "__typename": "ObjectStatus"
            },
            "rootFileResult": {
                "hits": {
                    "totalHits": 40,
                    "violations": 40,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "analyzerGroupResults": [
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000003",
                            "name": "GLBA",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 2,
                                    "violations": 2,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "Bank Account Number",
                                    "analyzerType": "US_BANK_ACCT",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 2,
                            "violations": 2,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    },
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000005",
                            "name": "Financial",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 1,
                                    "violations": 1,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000006",
                                    "name": "ABA Routing Number",
                                    "analyzerType": "ABA_ROUTING_NUMBER",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 2,
                                    "violations": 2,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "Bank Account Number",
                                    "analyzerType": "US_BANK_ACCT",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 3,
                            "violations": 3,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    },
                    {
                        "analyzerGroup": {
                            "groupType": "CUSTOM",
                            "id": "00000000-0000-0000-0000-000000000007",
                            "name": "U.S. Financials",
                            "__typename": "AnalyzerGroup"
                        },
                        "analyzerResults": [
                            {
                                "hits": {
                                    "totalHits": 1,
                                    "violations": 1,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000006",
                                    "name": "ABA Routing Number",
                                    "analyzerType": "ABA_ROUTING_NUMBER",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            },
                            {
                                "hits": {
                                    "totalHits": 2,
                                    "violations": 2,
                                    "__typename": "Hits"
                                },
                                "analyzer": {
                                    "id": "00000000-0000-0000-0000-000000000004",
                                    "name": "Bank Account Number",
                                    "analyzerType": "US_BANK_ACCT",
                                    "__typename": "Analyzer"
                                },
                                "__typename": "AnalyzerResult"
                            }
                        ],
                        "hits": {
                            "totalHits": 3,
                            "violations": 3,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        },
                        "__typename": "AnalyzerGroupResult"
                    }
                ],
                "filesWithHits": {
                    "totalHits": 11,
                    "violations": 11,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "openAccessFilesWithHits": {
                    "totalHits": 0,
                    "violations": 0,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "staleFilesWithHits": {
                    "totalHits": 8,
                    "violations": 8,
                    "violationsDelta": 0,
                    "totalHitsDelta": 0,
                    "__typename": "Hits"
                },
                "analyzerResults": [
                    {
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000004",
                            "name": "Bank Account Number"
                        },
                        "hits": {
                            "totalHits": 2,
                            "violations": 2,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        }
                    },
                    {
                        "analyzer": {
                            "id": "00000000-0000-0000-0000-000000000006",
                            "name": "ABA Routing Number"
                        },
                        "hits": {
                            "totalHits": 1,
                            "violations": 1,
                            "violationsDelta": 0,
                            "totalHitsDelta": 0,
                            "__typename": "Hits"
                        }
                    }
                ],
                "sensitiveHits": {
                    "highRiskHits": {
                        "totalHits": 20,
                        "violatedHits": 20,
                        "__typename": "SummaryHits"
                    },
                    "mediumRiskHits": {
                        "totalHits": 10,
                        "violatedHits": 10,
                        "__typename": "SummaryHits"
                    },
                    "lowRiskHits": {
                        "totalHits": 5,
                        "violatedHits": 5,
                        "__typename": "SummaryHits"
                    },
                    "noRiskHits": {
                        "totalHits": 5,
                        "violatedHits": 5,
                        "__typename": "SummaryHits"
                    },
                    "totalHits": {
                        "totalHits": 40,
                        "violatedHits": 40,
                        "__typename": "SummaryHits"
                    },
                    "__typename": "SensitiveHits"
                },
                "numActivities": 0,
                "numActivitiesDelta": 0,
                "__typename": "FileResult"
            },
            "snappable": {
                "id": "00000000-0000-0000-0000-000000000008",
                "name": "ran test",
                "objectType": "O365Site",
                "slaAssignment": "Direct",
                "logicalPath": [
                    {
                        "fid": "00000000-0000-0000-0000-000000000009",
                        "name": "Rubrik Inc",
                        "objectType": "O365Org",
                        "__typename": "PathNode"
                    },
                    {
                        "fid": "00000000-0000-0000-0000-000000000010",
                        "name": "rubrik-tme-lab",
                        "objectType": "AwsNativeAccount",
                        "__typename": "PathNode"
                    }
                ],
                "effectiveSlaDomain": {
                    "id": "00000000-0000-0000-0000-000000000001",
                    "name": "Silver",
                    "isRetentionLockedSla": false,
                    "retentionLockMode": "NO_MODE",
                    "__typename": "GlobalSlaReply",
                    "description": "Rubrik default Silver level SLA Domain policy"
                },
                "__typename": "O365Site"
            },
            "__typename": "PolicyObj",
            "osType": "NONE",
            "isUserAccessEnabledObject": true,
            "policySummaries": [
                {
                    "id": "00000000-0000-0000-0000-000000000003",
                    "name": "GLBA",
                    "colorEnum": "COLOR_003",
                    "__typename": "ClassificationPolicySummary"
                },
                {
                    "id": "00000000-0000-0000-0000-000000000005",
                    "name": "Financial",
                    "colorEnum": "COLOR_013",
                    "__typename": "ClassificationPolicySummary"
                },
                {
                    "id": "00000000-0000-0000-0000-000000000007",
                    "name": "Financials",
                    "colorEnum": "COLOR_005",
                    "__typename": "ClassificationPolicySummary"
                }
            ]
        }
    }
}

Human Readable Output

Sensitive Data Object

Object ID Object Name Object Type Risk Level OS Type Account Name Snapshot ID Snapshot Timestamp SLA Name Daily Hits Change Total Risk Hits High Risk Hits Medium Risk Hits Low Risk Hits No Risk Hits Total Files with Hits Stale Files with Hits Open Access Files with Hits Data Categories Data Types

00000000-0000-0000-0000-000000000001 ran test O365Site High NONE rubrik-tme-lab 00000000-0000-0000-0000-000000000001 2026-06-19T12:55:26Z Silver 0 40 20 10 5 5 11 8 0 - name: GLBA
totalViolatedHits: 2
- name: Financial
totalViolatedHits: 3
- name: U.S. Financials
totalViolatedHits: 3 - name: Bank Account Number
totalViolatedHits: 2
- name: ABA Routing Number
totalViolatedHits: 1

rubrik-sensitive-data-object-file-get

Retrieve the file information for the provided file path in the object.

Base Command

rubrik-sensitive-data-object-file-get

Input

Argument Name	Description	Required
object_id	The ID of the object (snappable FID). Note: Users can get the object ID by executing the “rubrik-polaris-object-list” command.	Required
snapshot_id	The Snapshot ID of the object. Note: Users can get the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.	Required
file_path	The full path of the file for which to retrieve information.	Required
resolve_sids	Whether to resolve SIDs to display names in the file response. Possible values are: True, False. Default is True.	Optional

Context Output

Path	Type	Description
RubrikPolaris.SensitiveDataObjectFile.objectId	String	The unique identifier of the snappable object.
RubrikPolaris.SensitiveDataObjectFile.stdPath	String	The standard file path of the sensitive file.
RubrikPolaris.SensitiveDataObjectFile.secInfo.path	String	The full path of the sensitive file from the security descriptor.
RubrikPolaris.SensitiveDataObjectFile.secInfo.owner	String	The SID of the owner of the file.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.cn	String	The display name of the principal with file permissions.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalId	String	The SID or identifier of the principal with file permissions.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalOrigin	String	The origin of the principal.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.idpType	String	The identity provider type for the principal.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.principalType	String	The type of the principal.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.resolutionType	String	The resolution type of the principal SID.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.access	String	The access level granted to the principal.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.flags	String	The permission flags.
RubrikPolaris.SensitiveDataObjectFile.secInfo.permissions.accessMethodDetails.accessMethod	String	The access method used.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.createdBy.value	String	The value of the principal who created the file.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.creationTime	Number	The creation time of the file as a Unix timestamp.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastAccessTime	Number	The last access time of the file as a Unix timestamp.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastModifiedBy.value	String	The value of the principal who last modified the file.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastModifiedTime	Number	The last modified time of the file as a Unix timestamp.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.lastScanTime	Number	The last scan time of the file as a Unix timestamp.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.path	String	The full path of the file as recorded in the metadata.
RubrikPolaris.SensitiveDataObjectFile.fileMetadata.size	Number	The size of the file in bytes.
RubrikPolaris.SensitiveDataObjectFile.exposureSummary.exposureType	String	The exposure type of the file.
RubrikPolaris.SensitiveDataObjectFile.exposureSummary.fileCount.totalCount	Number	The total count of files in the exposure summary.
RubrikPolaris.SensitiveDataObjectFile.exposureSummary.fileCount.violatedCount	Number	The number of files with violations in the exposure summary.

Command Example

!rubrik-sensitive-data-object-file-get object_id="00000000-0000-0000-0000-000000000001" snapshot_id="00000000-0000-0000-0000-000000000002" file_path="/C:/DummyPath/DummyFile.xlsx"

Context Example

{
    "objectId": "00000000-0000-0000-0000-000000000001",
    "stdPath": "/C:/DummyPath/DummyFile.xlsx",
    "secInfo": [
        {
            "path": "/C:/DummyPath/DummyFile.xlsx",
            "owner": "S-1-5-21-0000000000-000000000-0000000000-0001",
            "permissions": [
                {
                    "cn": "John Doe",
                    "principalId": "S-1-5-21-0000000000-000000000-0000000000-0002",
                    "principalOrigin": "ORIGIN_INTERNAL",
                    "idpType": "ON_PREM_AD",
                    "principalType": "UNKNOWN",
                    "resolutionType": "RESOLVED_AD",
                    "access": "Full control",
                    "flags": [
                        "INHERITED"
                    ],
                    "accessMethodDetails": {
                        "accessMethod": "WINDOWS_ACL",
                        "__typename": "DatagovAccessMethodDetailsType"
                    },
                    "__typename": "SDDLPermission"
                },
                {
                    "cn": "Local System",
                    "principalId": "S-1-5-18",
                    "principalOrigin": "ORIGIN_INTERNAL",
                    "idpType": "ON_PREM_AD",
                    "principalType": "UNKNOWN",
                    "resolutionType": "WELL_KNOWN",
                    "access": "Full control",
                    "flags": [
                        "INHERITED"
                    ],
                    "accessMethodDetails": {
                        "accessMethod": "WINDOWS_ACL",
                        "__typename": "DatagovAccessMethodDetailsType"
                    },
                    "__typename": "SDDLPermission"
                },
                {
                    "cn": "Administrators",
                    "principalId": "S-1-5-32-000",
                    "principalOrigin": "ORIGIN_INTERNAL",
                    "idpType": "ON_PREM_AD",
                    "principalType": "UNKNOWN",
                    "resolutionType": "WELL_KNOWN",
                    "access": "Full control",
                    "flags": [
                        "INHERITED"
                    ],
                    "accessMethodDetails": {
                        "accessMethod": "WINDOWS_ACL",
                        "__typename": "DatagovAccessMethodDetailsType"
                    },
                    "__typename": "SDDLPermission"
                },
                {
                    "cn": "Users",
                    "principalId": "S-1-5-32-001",
                    "principalOrigin": "ORIGIN_INTERNAL",
                    "idpType": "ON_PREM_AD",
                    "principalType": "UNKNOWN",
                    "resolutionType": "WELL_KNOWN",
                    "access": "Read & execute",
                    "flags": [
                        "INHERITED"
                    ],
                    "accessMethodDetails": {
                        "accessMethod": "WINDOWS_ACL",
                        "__typename": "DatagovAccessMethodDetailsType"
                    },
                    "__typename": "SDDLPermission"
                }
            ],
            "__typename": "PathSecInfo"
        }
    ],
    "__typename": "SensitiveFileDetailsReply",
    "fileMetadata": {
        "createdBy": {
            "value": "admin@example.com",
            "__typename": "FilePrincipalIdentity"
        },
        "creationTime": 1768473000,
        "lastAccessTime": 1781945100,
        "lastModifiedBy": {
            "value": "admin@example.com",
            "__typename": "FilePrincipalIdentity"
        },
        "lastModifiedTime": 1773151200,
        "lastScanTime": 1782388800,
        "path": "/C:/DummyPath/DummyFile.xlsx",
        "size": 1665816,
        "__typename": "SensitiveFileMetadata"
    },
    "exposureSummary": [
        {
            "exposureType": "NOT_OPEN",
            "fileCount": {
                "totalCount": 1,
                "violatedCount": 0,
                "__typename": "SummaryCount"
            },
            "__typename": "ExposureSummary"
        }
    ]
}

Human Readable Output

File Information

File Path File Size in Bytes Owner Created By Last Modified By Create Time Last Modified Time Last Access Time Exposure Type File Count Permissions

/C:/DummyPath/DummyFile.xlsx 1665816 S-1-5-21-0000000000-000000000-0000000000-0001 admin@example.com admin@example.com 2026-01-15T10:30:00Z 2026-03-10T14:00:00Z 2026-06-20T08:45:00Z NOT_OPEN 1 - id: S-1-5-21-0000000000-000000000-0000000000-0002
name: John Doe
accessMethod: WINDOWS_ACL
access: Full control
- id: S-1-5-18
name: Local System
accessMethod: WINDOWS_ACL
access: Full control
- id: S-1-5-32-000
name: Administrators
accessMethod: WINDOWS_ACL
access: Full control
- id: S-1-5-32-001
name: Users
accessMethod: WINDOWS_ACL
access: Read & execute

Configuration parameters

service_account_json — Service Account JSON
url — Rubrik Account (e.g. ${rubrikAccount}.my.rubrik.com)
email — Email
isFetch — Fetch incidents
incidentType — Incident type
rsc_fetch_types — RSC Fetch Types
event_types — Event types to fetch as incidents
event_severities — Event severities to fetch as incidents
threat_monitoring_match_types — Threat Monitoring Match Types
threat_monitoring_object_types — Threat Monitoring Object Types
first_fetch — First fetch time
incidentFetchInterval — Incidents Fetch Interval
max_fetch — Fetch Limit (Maximum of 1000)
radar_critical_severity_mapping — Event Critical Severity Level Mapping
radar_warning_severity_mapping — Event Warning Severity Level Mapping
threat_monitoring_severity_mapping — Threat Monitoring Object Severity Level Mapping
dspm_violation_status — DSPM Violation Statuses
dspm_violation_sensitivity — DSPM Violation Sensitivity Levels
dspm_violation_severity — DSPM Violation Severity Levels
dspm_violation_category — DSPM Violation Categories
dspm_violation_object_type — DSPM Violation Object Types
ir_violation_policy_type — IR Violation Policy Types
ir_violation_status — IR Violation Statuses
ir_violation_severity — IR Violation Severity Levels
ir_violation_category — IR Violation Categories
ir_violation_identity_provider — IR Violation Identity Providers
ir_violation_identity_tag — IR Violation Identity Tags
sensitive_data_object_sensitivity — Sensitive Data Object Sensitivity Levels
sensitive_data_object_type — Sensitive Data Object Types
integration_reliability — Source Reliability
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (61)

domain
Retrieve the sensitive information available for the given domain(s).
ip
Retrieve the sensitive information available for the given IP address(es).
rubrik-advance-ioc-scan
Start a new advance threat hunt.
rubrik-anomaly-csv-analysis-v2
Request for the analysis and directly download the anomaly CSV analyzed file.
rubrik-cdm-cluster-connection-state
Find the CDM Connection State of a CDM Cluster.
rubrik-cdm-cluster-location
Find the CDM GeoLocation of a CDM Cluster.
rubrik-data-security-violation-csv-download
Download all files at risk as CSV file for the specified data security violation.
rubrik-data-security-violation-file-list
Retrieve the file information of data security violation based on the provided violation ID.
rubrik-data-security-violation-get
Retrieve the details of DSPM violation based on the provided violation ID.
rubrik-data-security-violation-list
Retrieve the list of DSPM violations.
rubrik-data-security-violation-log-download
Download remediation logs as CSV file for the specified data security violation.
rubrik-data-security-violation-status-update
Updates the status of the DSPM violation.
rubrik-event-list
Retrieve the list of events.
rubrik-gps-async-result
Retrieve the result of an asynchronous request. This command will retrieve the result of requests made by commands "rubrik-gps-snapshot-files-download", "rubrik-gps-vm-livemount", "rubrik-gps-vm-export", "rubrik-gps-vm-snapshot-create" and "rubrik-gps-vm-recover-files".
rubrik-gps-cluster-list
Retrieve the list of the available rubrik clusters.
rubrik-gps-sla-domain-list
Enumerates the available SLA Domains to apply to the on-demand snapshot as a retention policy.
rubrik-gps-snapshot-files-download
Request to download the snapshot file from the backup. Note: To know about the file information and which file can be downloaded, use the "rubrik-gps-snapshot-files-list" command. To know about the status of the downloadable files, use the "rubrik-gps-async-result" command.
rubrik-gps-snapshot-files-list
Retrieve the list of the available files that can be downloaded. Note: To initiate the file download request use the "rubrik-gps-snapshot-files-download" command.
rubrik-gps-vm-datastore-list
Retrieve the list of the available datastores on a Vsphere Host.
rubrik-gps-vm-export
Request to initiate an export of a snapshot of a virtual machine. Note: To know about the exported VM's status, use the "rubrik-gps-async-result" command.
rubrik-gps-vm-host-list
Retrieve the list of available Vsphere Hosts.
rubrik-gps-vm-livemount
Performs a live mount of a virtual machine snapshot. Note: To know about the live mount status, use the "rubrik-gps-async-result" command.
rubrik-gps-vm-recover-files
Recovers files from a snapshot backup, back into a system. Note: To know about the recovery status, use the "rubrik-gps-async-result" command.
rubrik-gps-vm-snapshot-create
Triggers an on-demand snapshot of a system. Note: To know about the status of the on-demand snapshot creation, use the "rubrik-gps-async-result" command.
rubrik-identity-resilience-violation-get
Retrieves the details of the Identity Resilience (IR) violation based on the provided violation ID.
rubrik-identity-resilience-violation-list
Retrieves the list of Identity Resilience (IR) violations.
rubrik-identity-resilience-violation-status-update
Updates the status of the Identity Resilience (IR) violation.
rubrik-ioc-scan-list-v2
List details of the Turbo and Advance Threat Hunt.
rubrik-ioc-scan-results-v2
Retrieve details of the Turbo and Advance Threat Hunt.
rubrik-polaris-object-list
Retrieve the list of Rubrik objects, based on the provided filters.
rubrik-polaris-object-search
Search for Rubrik discovered objects of any type, return zero or more matches.
rubrik-polaris-object-snapshot-list
Retrieve Rubrik snapshot(s) of an object, based on the provided object ID.
rubrik-polaris-vm-object-metadata-get
Retrieve details for a Vsphere object based on the provided object ID.
rubrik-polaris-vm-object-snapshot-list
Search for a Rubrik snapshot of an object based on the provided snapshot ID, exact timestamp, or specific value like earliest/latest, or closest before/after a timestamp.
rubrik-polaris-vm-objects-list
Retrieve a list of all the objects of the Vsphere Vm known to the Rubrik.
rubrik-radar-analysis-status Deprecated
Check the Radar Event for updates.
rubrik-radar-anomaly-csv-analysis
Request for the analysis and retrieve the download link or directly download file for the Radar CSV analyzed file.
rubrik-radar-anomaly-status-update
Updates the status of the Anomaly detection. Note: Run the "rubrik-radar-suspicious-file-list" command first to check the resolution status of the Anomaly Detection snapshot before executing this command.
rubrik-radar-ioc-scan
Triggers an IOC scan of a system. Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command and to list the running/completed IOC scans on a cluster use the "rubrik-radar-ioc-scan-list" command.
rubrik-radar-ioc-scan-list
Lists the running/completed IOC scans on a cluster. Note: To know the results of the scan use the "rubrik-radar-ioc-scan-results" command. To initiate a scan use the "rubrik-radar-ioc-scan" command.
rubrik-radar-ioc-scan-results
Retrieves the results of IOC scan of a system. Note: To initiate a scan use the "rubrik-radar-ioc-scan" command and to list the running/completed scans on a cluster use the "rubrik-radar-ioc-scan-list" command.
rubrik-radar-suspicious-file-list
Retrieve the suspicious list of files for a snapshot ID with detected file anomalies.
rubrik-sensitive-data-object-file-get
Retrieve the file information for the provided file path in the object.
rubrik-sensitive-data-object-get
Retrieve the details of the object based on the provided object ID and snapshot ID.
rubrik-sonar-csv-download
Request to download the Sonar CSV Snapshot results file. Note: To know the ID and status of the download, use the "rubrik-user-downloads-list" command. To download the file, use the "rubrik-sonar-csv-result-download" command.
rubrik-sonar-csv-result-download
Retrieve the download link for the requested Sonar CSV Snapshot file.
rubrik-sonar-file-context-list
Retrieve the context of the file, folder, or file share for the provided object and the file details.
rubrik-sonar-ondemand-scan
Trigger an on-demand scan of a system. Supports "Vsphere VM" object type only. Note: To know the scan status use the "rubrik-sonar-ondemand-scan-status" command. To download the completed request use the "rubrik-sonar-ondemand-scan-result" command.
rubrik-sonar-ondemand-scan-result
Retrieve the download link for the requested scanned file.
rubrik-sonar-ondemand-scan-status
Retrieve the status of a scanned system. Note: To download the completed request use the "rubrik-sonar-ondemand-scan-result" command.
rubrik-sonar-policies-list
Retrieve the list of all the available Sonar policies.
rubrik-sonar-policy-analyzer-groups-list
List the analyzer group policies.
rubrik-sonar-sensitive-hits
Find data classification hits on an object.
rubrik-sonar-user-access-get
Retrieve the user access information based on the provided user ID.
rubrik-sonar-user-access-list
Retrieve the user access information.
rubrik-threat-monitoring-matched-file-get
Get the matched file for the Threat Monitoring object.
rubrik-threat-monitoring-matched-file-list
List the matched files for the Threat Monitoring object.
rubrik-threat-monitoring-matched-object-get
Get the matched object for Threat Monitoring.
rubrik-threat-monitoring-matched-object-list
List the matched objects for Threat Monitoring.
rubrik-turbo-ioc-scan
Start a new turbo threat hunt.
rubrik-user-downloads-list
Retrieve the user downloads. This would return the current and past download history. Note: To download the requested Sonar CSV Snapshot results file use the "rubrik-sonar-csv-result-download" command.

Source

RubrikPolaris.py RubrikPolaris_test.py RubrikPolaris.yml RubrikPolaris_description.md

Download History Raw

"""Test File for RubrikPolaris Integration."""

import json
import os
import time
from pathlib import Path
from unittest.mock import patch

import pytest
from CommonServerPython import remove_empty_elements
from RubrikPolaris import (
    ANOMALY_TYPE_ENUM,
    DEFAULT_EVENT_TYPES,
    DSPM_VIOLATION_FILE_LIST_ACCESS_VIA,
    DSPM_VIOLATION_FILE_LIST_EXPOSURE,
    DSPM_VIOLATION_FILE_LIST_SENSITIVITY,
    DSPM_VIOLATION_FILE_LIST_SORT_BY,
    DSPM_VIOLATION_SENSITIVITY,
    DSPM_VIOLATION_SEVERITY,
    DSPM_VIOLATION_SORT_BY,
    DSPM_VIOLATION_STATUS,
    ERROR_MESSAGES,
    FALSE_POSITIVE_TYPE_ENUM,
    HUNT_STATUSES,
    IOC_MATCHES,
    IOC_TYPE_ENUM,
    IR_VIOLATION_IDENTITY_PROVIDER,
    IR_VIOLATION_IDENTITY_TAG,
    IR_VIOLATION_POLICY_TYPE,
    IR_VIOLATION_SEVERITY,
    IR_VIOLATION_SORT_BY,
    IR_VIOLATION_STATUS,
    MAX_INT_VALUE,
    MAX_LONG_VALUE,
    MAXIMUM_PAGINATION_LIMIT,
    MESSAGES,
    OUTPUT_PREFIX,
    QUERANTINE_STATUS,
    SENSITIVE_DATA_OBJECT_SENSITIVITY,
    TOKEN_EXPIRY_BUFFER_TIME,
    TOKEN_EXPIRY_TIME_SPAN,
)

BASE_URL = "https://demo.my.rubrik.com/api"
BASE_URL_GRAPHQL = BASE_URL + "/graphql"
BASE_URL_SESSION = BASE_URL + "/session"
TEST_DATA_DIR = Path(__file__).parent
last_fetch = "2021-10-22T14:55:51.616000Z"
first_fetch = "2021-10-22T14:55:51.616Z"
sonar_on_demand_file_path = "test_data/sonar_ondemand_scan_success_response.json"
enum_values_file_path = "test_data/enum_values.json"
mock_command = "demistomock.command"
mock_params = "demistomock.params"

MOCK_INTEGRATION_CONTEXT = {
    "api_token": "dummy_token",
    "valid_until": int(time.time()) + TOKEN_EXPIRY_TIME_SPAN - TOKEN_EXPIRY_BUFFER_TIME,
}

SDK_ERROR_MESSAGES = {
    "INVALID_SLA_LIST_OBJECT_TYPE": "'{}' is an invalid value for 'object types'. "
    "Value must be in ['UNKNOWN_OBJECT_TYPE', 'SAP_HANA_OBJECT_TYPE', "
    "'AWS_EC2_EBS_OBJECT_TYPE', 'AWS_RDS_OBJECT_TYPE', 'AZURE_OBJECT_TYPE', "
    "'GCP_OBJECT_TYPE', 'O365_OBJECT_TYPE', 'VSPHERE_OBJECT_TYPE', "
    "'KUPR_OBJECT_TYPE', 'FILESET_OBJECT_TYPE', 'CASSANDRA_OBJECT_TYPE', "
    "'VOLUME_GROUP_OBJECT_TYPE', 'MSSQL_OBJECT_TYPE', "
    "'AZURE_SQL_DATABASE_OBJECT_TYPE', 'AZURE_SQL_MANAGED_INSTANCE_OBJECT_TYPE'].",
    "INVALID_SORT_ORDER": "'{}' is an invalid value for 'sort_order'. Value must be in ['ASC', 'DESC'].",
    "INVALID_OBJECT_SNAPSHOT_SORT_ORDER": "'{}' is an invalid value for 'sort_order'. Value must be in ['ASC', 'DESC'].",
    "INVALID_REQUESTED_HASH_TYPE": "'{}' is an invalid value for 'requested_hash_types'. "
    "Value must be in ['HASH_TYPE_M_D5', 'HASH_TYPE_SH_A1', 'HASH_TYPE_SH_A256'].",
}


def util_load_json(path):
    """Load file in JSON format."""
    with open(TEST_DATA_DIR / path, encoding="utf-8") as f:
        return json.loads(f.read())


def util_load_text_data(path: str) -> str:
    """Load a text file."""
    with open(TEST_DATA_DIR / path, encoding="utf-8") as f:
        return f.read()


def test_main_incorrect_credentials(requests_mock, monkeypatch, capfd, caplog):
    """Tests the execution of main function when incorrect credentials are provided."""
    from RubrikPolaris import main

    monkeypatch.setattr(
        mock_params, lambda: {"url": "demo", "email": {"identifier": "incorrect@account.com", "password": "password"}}
    )
    monkeypatch.setattr(mock_command, lambda: "rubrik-sonar-policy-analyzer-groups-list")
    monkeypatch.setattr("demistomock.args", dict)
    response_data = {
        "code": 401,
        "uri": "/api/session",
        "traceSpan": {"traceId": "dummy-trace", "operation": "/api/session", "spanId": "qi0QREAFDyE="},
        "message": "UNAUTHENTICATED: wrong username or password",
    }
    requests_mock.post(BASE_URL_SESSION, json=response_data)
    with pytest.raises(SystemExit):
        caplog.set_level(50)
        capfd.close()
        main()


def test_main_unknown_commmand(requests_mock, monkeypatch, capfd):
    """Tests the execution of main function when unknown command name is provided."""
    from RubrikPolaris import main

    monkeypatch.setattr(
        mock_params, lambda: {"url": "demo", "email": {"identifier": "username@domain.com", "password": "password"}}
    )
    monkeypatch.setattr(mock_command, lambda: "unknown_command")
    response_data = {"access_token": "", "mfa_token": "dummy_token"}
    requests_mock.post(BASE_URL_SESSION, json=response_data)
    with pytest.raises(SystemExit):
        capfd.close()
        main()


def test_main_no_json_no_email(monkeypatch, capfd):
    """Tests the execution of main function when neither service account json nor email-password have been provided."""
    from RubrikPolaris import main

    monkeypatch.setattr(mock_params, lambda: {"url": "demo"})
    monkeypatch.setattr(mock_command, lambda: "some_command")
    with pytest.raises(SystemExit):
        capfd.close()
        main()


@pytest.mark.parametrize(
    "service_account_json",
    ["{", '{"client_id":}', '{"client_id"=""}', '{"client_id": "client", "name": "name","client_secret": "secret"}'],
)
def test_main_incorrect_json_structure(monkeypatch, capfd, service_account_json, caplog):
    """Tests the execution of main function when incorrectly formatted service account json is provided."""
    from RubrikPolaris import main

    monkeypatch.setattr(mock_params, lambda: {"url": "demo", "service_account_json": service_account_json})

    monkeypatch.setattr(mock_command, lambda: "some_command")
    with pytest.raises(SystemExit):
        capfd.close()
        caplog.set_level(50)
        main()


@pytest.fixture()
def client(requests_mock, capfd):
    """Client fixture."""
    from RubrikPolaris import MyClient

    data = {"access_token": "dummy_token", "mfa_token": "dummy_token"}
    requests_mock.post(BASE_URL_SESSION, json=data)
    capfd.close()
    client_obj = MyClient(domain="demo", username="dummy_username", password="dummy_password", insecure=True)
    return client_obj


def test_test_module_for_correct_params(client, monkeypatch, requests_mock):
    """Test test_module function when correct parameters are passed."""
    from RubrikPolaris import test_module

    params = {"isFetch": True, "max_fetch": "30", "first_fetch": "3 days", "rsc_fetch_types": "Event"}
    list_policies_response = {"data": {}}
    fetch_data_response = {"data": {}}

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": list_policies_response},
        {"json": enum_values.get("activity_type_enum")},
        {"json": enum_values.get("event_sort_by_enum")},
        {"json": enum_values.get("event_sort_order_enum")},
        {"json": fetch_data_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    assert test_module(client, params) == "ok"


@pytest.mark.parametrize(
    "max_fetch, first_fetch, event_types, radar_critical_severity_mapping",
    [("-1", "3 days", [], None), ("20", "abc", [], None), ("10", "3 days", ["abc"], None), ("10", "3 days", [], "")],
)
def test_test_module_for_incorrect_params(
    client, requests_mock, max_fetch, first_fetch, event_types, radar_critical_severity_mapping
):
    """Test test_module function to raise ValueError with appropriate message when incorrect parameters are passed."""
    from RubrikPolaris import test_module

    params = {
        "isFetch": True,
        "max_fetch": max_fetch,
        "first_fetch": first_fetch,
        "event_types": event_types,
        "radar_critical_severity_mapping": radar_critical_severity_mapping,
    }
    list_policies_response = {"data": {}}
    requests_mock.post(BASE_URL_GRAPHQL, json=list_policies_response)

    with pytest.raises(ValueError):
        test_module(client, params)


@pytest.mark.parametrize(
    "integration_context", [({}), ({"api_token": "dummy_token"}), ({"api_token": "dummy_token", "valid_until": time.time() - 1})]
)
@patch("demistomock.getIntegrationContext")
def test_get_api_token_when_not_found_in_integration_context(mocker_get_context, client, integration_context):
    """Test cases for scenario when there is no api_token or valid_until in integration context."""
    mocker_get_context.return_value = integration_context

    api_token = client.get_api_token()

    assert not api_token


@patch("demistomock.getIntegrationContext")
def test_get_api_token_when_found_in_integration_context(mocker_get_context, client):
    """Test cases for scenario when there is api_token and valid_until in integration context."""
    mocker_get_context.return_value = MOCK_INTEGRATION_CONTEXT

    api_token = client.get_api_token()

    assert api_token == "dummy_token"
    assert mocker_get_context.call_count == 1


def test_fetch_incidents_success_without_last_run(client, requests_mock):
    """Test fetch_incidents function to return incidents and new last run with provided empty last run."""
    from RubrikPolaris import fetch_incidents

    fetch_response = util_load_json("test_data/fetch_incidents_success_response.json")
    incidents = util_load_json("test_data/fetch_incidents_success_incidents.json")
    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("activity_type_enum")},
        {"json": enum_values.get("event_sort_by_enum")},
        {"json": enum_values.get("event_sort_order_enum")},
        {"json": fetch_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    fetch_incidents_last_run, fetch_incidents_incidents = fetch_incidents(
        client,
        {},
        {"first_fetch": f"{first_fetch}", "max_fetch": 2, "event_types": [DEFAULT_EVENT_TYPES[0]], "rsc_fetch_types": "Event"},
    )
    last_run = {
        "last_fetch": f"{last_fetch}",
        "next_page_token": fetch_response["data"]["activitySeriesConnection"]["pageInfo"]["endCursor"],
    }
    assert fetch_incidents_last_run == last_run
    assert fetch_incidents_incidents == incidents


def test_fetch_incidents_success_with_last_run(client, requests_mock):
    """Test fetch_incidents function to return incidents and new last run with a provided last run."""
    from RubrikPolaris import fetch_incidents

    fetch_response = util_load_json("test_data/fetch_incidents_success_response.json")
    incidents = util_load_json("test_data/fetch_incidents_success_incidents.json")
    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("activity_type_enum")},
        {"json": enum_values.get("event_sort_by_enum")},
        {"json": enum_values.get("event_sort_order_enum")},
        {"json": fetch_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    fetch_incidents_last_run, fetch_incidents_incidents = fetch_incidents(
        client,
        {"last_fetch": f"{last_fetch}", "next_page_token": "dummy-token"},
        {"first_fetch": f"{first_fetch}", "max_fetch": 2, "rsc_fetch_types": "Event"},
    )

    last_run = {
        "last_fetch": f"{last_fetch}",
        "next_page_token": fetch_response["data"]["activitySeriesConnection"]["pageInfo"]["endCursor"],
    }
    assert fetch_incidents_last_run == last_run
    assert fetch_incidents_incidents == incidents


def test_fetch_incidents_empty_response_without_last_run(client, requests_mock):
    """Test fetch_incidents function to return empty incidents and new last run without a provided last run."""
    from RubrikPolaris import fetch_incidents

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    fetch_incidents_empty_response = util_load_json("test_data/fetch_incidents_empty_response.json")
    responses = [
        {"json": enum_values.get("activity_type_enum")},
        {"json": enum_values.get("event_sort_by_enum")},
        {"json": enum_values.get("event_sort_order_enum")},
        {"json": fetch_incidents_empty_response},
    ]

    requests_mock.post(BASE_URL_GRAPHQL, responses)

    fetch_incidents_last_run, fetch_incidents_incidents = fetch_incidents(
        client, {}, {"first_fetch": f"{first_fetch}", "max_fetch": 2, "rsc_fetch_types": "Event"}
    )
    last_run = {"last_fetch": f"{last_fetch}"}
    assert fetch_incidents_last_run == last_run
    assert fetch_incidents_incidents == []


def test_fetch_incidents_empty_response_with_last_run(client, requests_mock):
    """Test fetch_incidents function to return empty incidents and new last run with a provided last run."""
    from RubrikPolaris import fetch_incidents

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    fetch_incidents_empty_response = util_load_json("test_data/fetch_incidents_empty_response.json")
    responses = [
        {"json": enum_values.get("activity_type_enum")},
        {"json": enum_values.get("event_sort_by_enum")},
        {"json": enum_values.get("event_sort_order_enum")},
        {"json": fetch_incidents_empty_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    fetch_incidents_last_run, fetch_incidents_incidents = fetch_incidents(
        client,
        {"last_fetch": f"{last_fetch}", "next_page_token": "dummy-token"},
        {"first_fetch": f"{first_fetch}", "max_fetch": 2, "rsc_fetch_types": "Event"},
    )

    last_run = {"last_fetch": f"{last_fetch}", "next_page_token": "dummy-token"}
    assert fetch_incidents_last_run == last_run
    assert fetch_incidents_incidents == []


def test_object_search_success(client, requests_mock):
    """Tests success for rubrik_polaris_object_search."""
    from RubrikPolaris import rubrik_polaris_object_search_command

    args = {"object_name": "admin"}

    object_search_response = util_load_json("test_data/object_search_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/object_search_hr1.md")) as f:
        object_search_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("sort_by_enum")},
        {"json": enum_values.get("sort_order_enum")},
        {"json": object_search_response.get("raw_response")},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    response = rubrik_polaris_object_search_command(client, args)

    assert response.raw_response == object_search_response.get("raw_response")
    assert response.outputs.get(f"{OUTPUT_PREFIX['GLOBAL_SEARCH']}(val.id == obj.id)") == remove_empty_elements(
        object_search_response.get("outputs")
    )
    assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_GLOBAL_SEARCH']}(val.name == obj.name)") == remove_empty_elements(
        object_search_response.get("page_token")
    )
    assert response.readable_output == object_search_response_hr


def test_object_search_with_token_hr_success(client, requests_mock):
    """Tests success for hr with next token for rubrik_polaris_object_search."""
    from RubrikPolaris import rubrik_polaris_object_search_command

    args = {"object_name": "admin", "limit": 2}

    object_search_response = util_load_json("test_data/object_search_response2.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/object_search_hr2.md")) as f:
        object_search_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("sort_by_enum")},
        {"json": enum_values.get("sort_order_enum")},
        {"json": object_search_response.get("raw_response")},
    ]

    requests_mock.post(BASE_URL_GRAPHQL, responses)

    response = rubrik_polaris_object_search_command(client, args)

    assert response.raw_response == object_search_response.get("raw_response")
    assert response.outputs.get(f"{OUTPUT_PREFIX['GLOBAL_SEARCH']}(val.id == obj.id)") == remove_empty_elements(
        object_search_response.get("outputs")
    )
    assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_GLOBAL_SEARCH']}(val.name == obj.name)") == remove_empty_elements(
        object_search_response.get("page_token")
    )
    assert response.readable_output == object_search_response_hr


@pytest.mark.parametrize(
    "args, exception, error",
    [
        ({"object_name": ""}, ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_name")),
        ({"object_name": "abc", "limit": "ab"}, ValueError, '"ab" is not a valid number'),
        ({"object_name": "abc", "limit": 1001}, ValueError, ERROR_MESSAGES["INVALID_LIMIT"].format("1001")),
        ({"object_name": "abc", "limit": -1}, ValueError, ERROR_MESSAGES["INVALID_LIMIT"].format("-1")),
    ],
)
def test_object_search_arguments_failure(client, requests_mock, args, exception, error):
    """Tests failure for rubrik_polaris_object_search."""
    from RubrikPolaris import rubrik_polaris_object_search_command

    response = {"data": {}}
    requests_mock.post(BASE_URL_GRAPHQL, json=response)

    with pytest.raises(exception) as e:
        rubrik_polaris_object_search_command(client, args)

    assert str(e.value) == error


def test_sonar_policies_list_when_empty_response(client, requests_mock):
    """Tests rubrik_sonar_policies_list when empty response is returned."""
    from RubrikPolaris import rubrik_sonar_policies_list_command

    empty_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/sonar_policies_list_empty_response.json"))

    requests_mock.post(BASE_URL_GRAPHQL, json=empty_response)

    list_policies_command_results = rubrik_sonar_policies_list_command(client, {})

    assert list_policies_command_results.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("sonar policies")
    assert list_policies_command_results.outputs is None


def test_sonar_policies_list_success(client, requests_mock):
    """Tests rubrik_sonar_policies_list when response is not empty."""
    from RubrikPolaris import rubrik_sonar_policies_list_command

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/sonar_policies_list_success_response.json"))

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_policies_list_success_hr.md")) as f:
        sonar_policies_list_hr = f.read()

    sonar_policies_list_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_policies_list_success_outputs.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)

    list_policies_command_results = rubrik_sonar_policies_list_command(client, {})

    assert list_policies_command_results.raw_response == raw_response
    assert list_policies_command_results.readable_output == sonar_policies_list_hr
    assert list_policies_command_results.outputs == sonar_policies_list_outputs


def test_sonar_policy_analyzer_groups_list_when_empty_response(client, requests_mock):
    """Tests rubrik_sonar_policy_analyzer_groups_list_command when empty response is returned."""
    from RubrikPolaris import rubrik_sonar_policy_analyzer_groups_list_command

    empty_response = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_policy_analyzer_groups_list_empty_response.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=empty_response)

    list_policy_analyzer_groups_command_results = rubrik_sonar_policy_analyzer_groups_list_command(client, {})

    assert list_policy_analyzer_groups_command_results.readable_output == MESSAGES["NO_RECORDS_FOUND"].format(
        "sonar policy analyzer groups"
    )
    assert list_policy_analyzer_groups_command_results.outputs is None


def test_sonar_policy_analyzer_groups_list_success(client, requests_mock):
    """Tests rubrik_sonar_policy_analyzer_groups_list_command when response is not empty."""
    from RubrikPolaris import rubrik_sonar_policy_analyzer_groups_list_command

    raw_response = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_policy_analyzer_groups_list_success_response.json")
    )

    with open(
        os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_policy_analyzer_groups_list_success_hr.md")
    ) as f:
        sonar_policy_analyzer_groups_list_hr = f.read()

    sonar_policy_analyzer_groups_list_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_policy_analyzer_groups_list_success_outputs.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)

    list_policy_analyzer_groups_command_results = rubrik_sonar_policy_analyzer_groups_list_command(client, {})

    assert list_policy_analyzer_groups_command_results.raw_response == raw_response
    assert list_policy_analyzer_groups_command_results.readable_output == sonar_policy_analyzer_groups_list_hr
    assert list_policy_analyzer_groups_command_results.outputs == sonar_policy_analyzer_groups_list_outputs


@pytest.mark.parametrize("response", ["empty_response", "raw_response"])
def test_vm_object_metadata_when_valid_response_is_returned(client, requests_mock, response):
    """Tests success for rubrik_polaris_vm_object_metadata_get."""
    from RubrikPolaris import rubrik_polaris_vm_object_metadata_get_command

    args = {"object_id": "e060116b-f9dc-56a1-82a6-1b968d2f6cef"}

    data = util_load_json("test_data/vm_object_metadata_get.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=data.get(f"{response}"))
    object_response = rubrik_polaris_vm_object_metadata_get_command(client, args)

    if response == "empty_response":
        assert object_response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("vm object metadata")
    else:
        with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/vm_object_metadata_get.md")) as f:
            object_response_hr = f.read()

        assert object_response.raw_response == data.get("raw_response")
        assert object_response.outputs == remove_empty_elements(data.get("outputs"))
        assert object_response.readable_output == object_response_hr


@pytest.mark.parametrize("args", [{"object_id": ""}])
def test_vm_object_metadata_invalid_object_id(client, requests_mock, args):
    """Tests incorrect object_id for rubrik_polaris_vm_object_metadata_get."""
    from RubrikPolaris import rubrik_polaris_vm_object_metadata_get_command

    response = {"data": {}}
    requests_mock.post(BASE_URL_GRAPHQL, json=response)

    with pytest.raises(ValueError) as e:
        rubrik_polaris_vm_object_metadata_get_command(client, args)

    assert str(e.value) == ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")


def test_vm_objects_list_success(client, requests_mock):
    """Tests success for rubrik_polaris_vm_objects_list."""
    from RubrikPolaris import rubrik_polaris_vm_objects_list_command

    objects_list_response = util_load_json("test_data/objects_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/objects_list_hr.md")) as f:
        objects_list_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("sort_by_enum")},
        {"json": enum_values.get("sort_order_enum")},
        {"json": objects_list_response.get("raw_response")},
    ]

    requests_mock.post(BASE_URL_GRAPHQL, responses)

    response = rubrik_polaris_vm_objects_list_command(client, args={"limit": 2})

    assert response.raw_response == objects_list_response.get("raw_response")
    assert response.outputs.get(f"{OUTPUT_PREFIX['VM_OBJECT']}(val.id == obj.id)") == remove_empty_elements(
        objects_list_response.get("outputs")
    )
    assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_VM_OBJECT']}(val.name == obj.name)") == remove_empty_elements(
        objects_list_response.get("page_token")
    )
    assert response.readable_output == objects_list_response_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"is_relic": "a"}, ERROR_MESSAGES["INVALID_BOOLEAN"].format("a", "is_relic")),
        ({"is_replicated": "tr"}, ERROR_MESSAGES["INVALID_BOOLEAN"].format("tr", "is_replicated")),
        ({"limit": "a"}, '"a" is not a valid number'),
        ({"limit": 1001}, ERROR_MESSAGES["INVALID_LIMIT"].format("1001")),
    ],
)
def test_vm_objects_list_when_invalid_arguments_are_provided(client, requests_mock, args, error):
    """Tests invalid arguments for rubrik_polaris_vm_objects_list."""
    from RubrikPolaris import rubrik_polaris_vm_objects_list_command

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("sort_by_enum")}, {"json": enum_values.get("sort_order_enum")}]

    requests_mock.post(BASE_URL_GRAPHQL, responses)

    with pytest.raises(ValueError) as e:
        rubrik_polaris_vm_objects_list_command(client, args=args)
    assert str(e.value) == error


def test_sonar_on_demand_scan_when_success_response(client, requests_mock):
    """Tests rubrik_sonar_ondemand_scan_command when response is success."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_command

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), f"{sonar_on_demand_file_path}"))

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_ondemand_scan_success_hr.md")) as f:
        sonar_ondemand_scan_hr = f.read()

    sonar_on_demand_scan_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_ondemand_scan_success_outputs.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)
    args = {
        "scan_name": "dummy",
        "objects_to_scan": "1234-abc, 2345-bcd",
        "sonar_policy_analyzer_groups": '{ "id": 1, "name":"ABC", "groupType":"ABC",'
        '"analyzers": [{ "id": 1, "name": "anc", "analyzerType": "xyz"},'
        '{"id": 2, "name": "xyz", "analyzerType": "klm"} ]}',
    }
    sonar_on_demand_scan_command_results = rubrik_sonar_ondemand_scan_command(client, args)

    assert sonar_on_demand_scan_command_results.raw_response == raw_response
    assert sonar_on_demand_scan_command_results.readable_output == sonar_ondemand_scan_hr
    assert sonar_on_demand_scan_command_results.outputs == sonar_on_demand_scan_outputs


@pytest.mark.parametrize(
    "objects_to_scan, sonar_policy_analyzer_groups, exception, error",
    [
        ("", "", ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("objects_to_scan")),
        ("1234-abc, 2345-bcd", "", ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("sonar_policy_analyzer_groups")),
        ("1234-abc, 2345-bcd", "{}", ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("sonar_policy_analyzer_groups")),
        ("1234-abc, 2345-bcd", "{", ValueError, ERROR_MESSAGES["JSON_DECODE"].format("sonar_policy_analyzer_groups")),
        (
            "1234-abc, 2345-bcd",
            '[{"id": dummy-id',
            ValueError,
            ERROR_MESSAGES["JSON_DECODE"].format("sonar_policy_analyzer_groups"),
        ),
        ("1234-abc, 2345-bcd", "[]", ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("sonar_policy_analyzer_groups")),
    ],
)
def test_sonar_on_demand_scan_when_invalid_input(
    client, requests_mock, objects_to_scan, sonar_policy_analyzer_groups, exception, error
):
    """Tests rubrik_sonar_ondemand_scan_command when invalid inputs are provided."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_command

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), f"{sonar_on_demand_file_path}"))

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)
    args = {
        "scan_name": "",
        "objects_to_scan": objects_to_scan,
        "sonar_policy_analyzer_groups": sonar_policy_analyzer_groups,
    }

    with pytest.raises(exception) as e:
        rubrik_sonar_ondemand_scan_command(client, args)

    assert str(e.value) == error


def test_sonar_ondemand_scan_when_empty_response(client, requests_mock):
    """Tests rubrik_sonar_ondemand_scan_command when empty response is returned."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_command

    empty_response = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_policy_analyzer_groups_list_empty_response.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=empty_response)
    args = {
        "scan_name": "dummy",
        "objects_to_scan": "1234-abc, 2345-bcd",
        "sonar_policy_analyzer_groups": '{ "id": 1, "name":"ABC", "groupType":"ABC",'
        '"analyzers": [{ "id": 1, "name": "anc", "analyzerType": "xyz"},'
        '{"id": 2, "name": "xyz", "analyzerType": "klm"} ]}',
    }
    sonar_on_demand_scan_command_results = rubrik_sonar_ondemand_scan_command(client, args)

    assert sonar_on_demand_scan_command_results.readable_output == MESSAGES["NO_RESPONSE"]
    assert sonar_on_demand_scan_command_results.outputs is None


@pytest.mark.parametrize("file_suffix", ["complete", "fail", "progress"])
def test_sonar_on_demand_scan_status_when_success_response(client, requests_mock, file_suffix):
    """Tests rubrik_sonar_ondemand_scan_status_command when response is success."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_status_command

    raw_response = util_load_json(
        os.path.join(os.path.dirname(__file__), f"test_data/sonar_ondemand_scan_status_success_{file_suffix}_response.json")
    )

    with open(
        os.path.join(
            os.path.dirname(os.path.realpath(__file__)), f"test_data/sonar_ondemand_scan_status_success_{file_suffix}_hr.md"
        )
    ) as f:
        sonar_ondemand_scan_status_hr = f.read()

    sonar_on_demand_scan_status_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), f"test_data/sonar_ondemand_scan_status_success_{file_suffix}_outputs.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)
    args = {"crawl_id": "587d147a-add9-4152-b7a0-5a667d99f395"}
    sonar_on_demand_scan_status_command_results = rubrik_sonar_ondemand_scan_status_command(client, args)

    assert sonar_on_demand_scan_status_command_results.raw_response == raw_response
    assert sonar_on_demand_scan_status_command_results.readable_output == sonar_ondemand_scan_status_hr
    assert sonar_on_demand_scan_status_command_results.outputs == sonar_on_demand_scan_status_outputs


@pytest.mark.parametrize(
    "crawl_id, exception, error",
    [
        ("", ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("crawl_id")),
        (None, ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("crawl_id")),
    ],
)
def test_sonar_on_demand_scan_status_when_invalid_input(client, crawl_id, exception, error):
    """Tests rubrik_sonar_ondemand_scan_status_command when invalid inputs are provided."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_status_command

    args = {
        "crawl_id": crawl_id,
    }

    with pytest.raises(exception) as e:
        rubrik_sonar_ondemand_scan_status_command(client, args)

    assert str(e.value) == error


def test_sonar_ondemand_scan_status_when_empty_response(client, requests_mock):
    """Tests rubrik_sonar_ondemand_scan_status_command when empty response is returned."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_status_command

    empty_response = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_ondemand_scan_status_empty_response.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=empty_response)
    args = {"crawl_id": "dummy-id"}
    sonar_on_demand_scan_status_command_results = rubrik_sonar_ondemand_scan_status_command(client, args)

    assert sonar_on_demand_scan_status_command_results.readable_output == MESSAGES["NO_RESPONSE"]
    assert sonar_on_demand_scan_status_command_results.outputs is None


@pytest.mark.parametrize(
    "crawl_id, file_type, exception, error",
    [
        ("", "", ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("crawl_id")),
        ("dummy_crawl_id", "", ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("file_type")),
        (
            "dummy_crawl_id",
            "not_valid_file_type",
            ValueError,
            "'not_valid_file_type' is an invalid value for 'file type'. Value must be in "
            "['ANY', 'HITS', 'STALE', 'OPEN_ACCESS', 'STALE_HITS', 'OPEN_ACCESS_HITS'].",
        ),
    ],
)
def test_sonar_on_demand_scan_result_when_invalid_input(client, requests_mock, crawl_id, file_type, exception, error):
    """Tests rubrik_sonar_ondemand_scan_result_command when response is success."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_result_command

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), f"{sonar_on_demand_file_path}"))
    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("file_count_type_enum")}, {"json": raw_response}]
    requests_mock.post(BASE_URL_GRAPHQL, responses)
    args = {
        "crawl_id": crawl_id,
        "file_type": file_type,
    }

    with pytest.raises(exception) as e:
        rubrik_sonar_ondemand_scan_result_command(client, args)

    assert str(e.value) == error


def test_sonar_ondemand_scan_result_when_empty_response(client, requests_mock):
    """Tests rubrik_sonar_ondemand_scan_result_command when empty response is returned."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_result_command

    empty_response = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_ondemand_scan_result_empty_response.json")
    )

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("file_count_type_enum")}, {"json": empty_response}]
    requests_mock.post(BASE_URL_GRAPHQL, responses)
    args = {
        "crawl_id": "dummy_id",
        "file_type": "HITS",
    }
    sonar_on_demand_scan_result_command_results = rubrik_sonar_ondemand_scan_result_command(client, args)

    assert sonar_on_demand_scan_result_command_results.readable_output == MESSAGES["NO_RESPONSE"]
    assert sonar_on_demand_scan_result_command_results.outputs is None


def test_sonar_on_demand_scan_result_when_success_response(client, requests_mock):
    """Tests rubrik_sonar_ondemand_scan_result_command when response is success."""
    from RubrikPolaris import rubrik_sonar_ondemand_scan_result_command

    raw_response = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_ondemand_scan_result_success_response.json")
    )

    with open(
        os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_ondemand_scan_result_success_hr.md")
    ) as f:
        sonar_ondemand_scan_hr = f.read()

    sonar_on_demand_scan_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/sonar_ondemand_scan_result_success_outputs.json")
    )

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("file_count_type_enum")}, {"json": raw_response}]

    requests_mock.post(BASE_URL_GRAPHQL, responses)

    args = {
        "crawl_id": "dummy_id",
        "file_type": "HITS",
    }
    sonar_on_demand_scan_result_command_results = rubrik_sonar_ondemand_scan_result_command(client, args)

    assert sonar_on_demand_scan_result_command_results.raw_response == raw_response
    assert sonar_on_demand_scan_result_command_results.readable_output == sonar_ondemand_scan_hr
    assert sonar_on_demand_scan_result_command_results.outputs == sonar_on_demand_scan_outputs


@pytest.mark.parametrize("empty_response", [True, False])
def test_vm_object_snapshot_get_success(client, requests_mock, empty_response):
    """Tests success for rubrik_polaris_vm_object_snapshot_get."""
    from RubrikPolaris import rubrik_polaris_vm_object_snapshot_list_command

    object_snapshot_response = util_load_json("test_data/vm_object_snapshot_get_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/vm_object_snapshot_get_hr.md")) as f:
        object_snapshot_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    args = {"object_id": "dummy_id", "start_date": "2020-03-21", "end_date": "2020-06-21", "timezone_offset": "1"}

    if empty_response:
        responses = [
            {"json": enum_values.get("snapshot_group_by_enum")},
            {"json": enum_values.get("missed_snapshot_group_by_enum")},
            {"json": object_snapshot_response.get("empty_response")},
        ]
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_polaris_vm_object_snapshot_list_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("vm object snapshots")

    else:
        responses = [
            {"json": enum_values.get("snapshot_group_by_enum")},
            {"json": enum_values.get("missed_snapshot_group_by_enum")},
            {"json": object_snapshot_response.get("raw_response")},
        ]
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_polaris_vm_object_snapshot_list_command(client, args=args)

        assert response.raw_response == object_snapshot_response.get("raw_response")
        assert response.outputs == remove_empty_elements(object_snapshot_response.get("outputs"))
        assert response.readable_output == object_snapshot_response_hr


@pytest.mark.parametrize(
    "args, error",
    [
        (
            {"object_id": "", "start_date": "tr", "end_date": "tr", "timezone_offset": "1.5"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id"),
        ),
        (
            {"object_id": "dummy_id", "start_date": "", "end_date": "tr", "timezone_offset": "1.5"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("start_date"),
        ),
        (
            {"object_id": "dummy_id", "start_date": "tr", "end_date": "", "timezone_offset": "1.5"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("end_date"),
        ),
        ({"object_id": "dummy_id", "start_date": "abc", "end_date": "tr", "timezone_offset": "1.5"}, '"abc" is not a valid date'),
        (
            {"object_id": "dummy_id", "start_date": "tr", "end_date": "tr", "timezone_offset": "1.5", "cluster_connected": "tr"},
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("tr", "cluster_connected"),
        ),
    ],
)
def test_vm_object_snapshot_get_when_invalid_arguments_are_provided(client, requests_mock, args, error):
    """Tests invalid arguments for rubrik_polaris_vm_object_snapshot_get."""
    from RubrikPolaris import rubrik_polaris_vm_object_snapshot_list_command

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))

    responses = [{"json": enum_values.get("snapshot_group_by_enum")}, {"json": enum_values.get("missed_snapshot_group_by_enum")}]

    requests_mock.post(BASE_URL_GRAPHQL, responses)

    with pytest.raises(ValueError) as e:
        rubrik_polaris_vm_object_snapshot_list_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response, download_file", [(True, "True"), (True, "False"), (False, "True"), (False, "False")])
def test_radar_anomaly_csv_analysis_success(client, requests_mock, empty_response, download_file):
    """Tests success for rubrik_radar_anomaly_csv_analysis."""
    from RubrikPolaris import rubrik_radar_anomaly_csv_analysis_command

    radar_anomaly_response = util_load_json("test_data/radar_anomaly_csv_analysis_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_anomaly_csv_analysis_hr.md")) as f:
        radar_anomaly_hr = f.read()

    args = {"object_id": "dummy", "cluster_id": "dummy", "snapshot_id": "dummy", "download_file": download_file}

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_anomaly_csv_analysis_file.csv")) as f:
        file_data = f.read()
    requests_mock.get("https://dummy_link/snapshot_000-000-000.csv", text=file_data, status_code=200)

    if empty_response:
        response = radar_anomaly_response.get("empty_response")
        requests_mock.post(BASE_URL_GRAPHQL, json=response)
        response = rubrik_radar_anomaly_csv_analysis_command(client, args=args)
        assert response[0].readable_output == MESSAGES["NO_RESPONSE"]

    else:
        responses = radar_anomaly_response.get("raw_response")
        requests_mock.post(BASE_URL_GRAPHQL, json=responses)
        response = rubrik_radar_anomaly_csv_analysis_command(client, args=args)

        assert response[0].raw_response == radar_anomaly_response.get("raw_response")
        assert response[0].outputs == remove_empty_elements(radar_anomaly_response.get("outputs"))
        assert response[0].readable_output == radar_anomaly_hr
        if download_file == "True" and isinstance(response[1], dict):
            assert response[1].get("File") == "snapshot_000-000-000.csv"


@pytest.mark.parametrize(
    "args, error",
    [
        ({"object_id": "dummy", "cluster_id": "dummy"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        (
            {"object_id": "dummy_id", "cluster_id": "", "snapshot_id": "tr"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("cluster_id"),
        ),
        (
            {"object_id": "", "cluster_id": " dummy", "snapshot_id": "dummy"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id"),
        ),
    ],
)
def test_radar_anomaly_csv_analysis_when_invalid_arguments_are_provided(client, requests_mock, args, error):
    """Tests invalid arguments for rubrik_radar_anomaly_csv_analysis."""
    from RubrikPolaris import rubrik_radar_anomaly_csv_analysis_command

    with pytest.raises(ValueError) as e:
        rubrik_radar_anomaly_csv_analysis_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_sonar_csv_download_success(client, requests_mock, empty_response):
    """Tests success for rubrik_sonar_csv_download."""
    from RubrikPolaris import rubrik_sonar_csv_download_command

    sonar_csv_download_response = util_load_json("test_data/sonar_csv_download_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_csv_download_hr.md")) as f:
        sonar_csv_download_hr = f.read()

    args = {"object_id": "dummy", "snapshot_id": "dummy"}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=sonar_csv_download_response.get("empty_response"))
        response = rubrik_sonar_csv_download_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RESPONSE"]
    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=sonar_csv_download_response.get("raw_response"))
        response = rubrik_sonar_csv_download_command(client, args=args)
        assert response.raw_response == sonar_csv_download_response.get("raw_response")
        assert response.outputs == remove_empty_elements(sonar_csv_download_response.get("outputs"))
        assert response.readable_output == sonar_csv_download_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"object_id": "dummy"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        ({"object_id": "", "snapshot_id": "dummy"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
    ],
)
def test_sonar_csv_download_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik_sonar_csv_download."""
    from RubrikPolaris import rubrik_sonar_csv_download_command

    with pytest.raises(ValueError) as e:
        rubrik_sonar_csv_download_command(client, args=args)
    assert str(e.value) == error


def test_snapshot_files_list_success(client, requests_mock):
    """Tests rubrik_gps_snapshot_files_list_command when response is not empty."""
    from RubrikPolaris import rubrik_gps_snapshot_files_list_command

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/snapshot_files_list_success_response.json"))

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/snapshot_files_list_success_hr.md")) as f:
        snapshot_files_list_hr = f.read()

    snapshot_files_list_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/snapshot_files_list_success_outputs.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)
    args = {"snapshot_id": "90858c2f-e572-5b9c-b455-ba309d50c1a2"}
    list_snapshot_files_command_results = rubrik_gps_snapshot_files_list_command(client, args)

    assert list_snapshot_files_command_results.raw_response == raw_response
    assert list_snapshot_files_command_results.readable_output == snapshot_files_list_hr
    assert list_snapshot_files_command_results.outputs == snapshot_files_list_outputs


def test_snapshot_files_list_when_empty_response(client, requests_mock):
    """Tests rubrik_gps_snapshot_files_list_command when empty response is returned."""
    from RubrikPolaris import rubrik_gps_snapshot_files_list_command

    empty_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/snapshot_files_list_empty_response.json"))

    requests_mock.post(BASE_URL_GRAPHQL, json=empty_response)
    args = {"snapshot_id": "90858c2f-e572-5b9c-b455-ba309d50c1a2"}
    list_snapshot_files_command_results = rubrik_gps_snapshot_files_list_command(client, args)

    assert list_snapshot_files_command_results.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("files")
    assert list_snapshot_files_command_results.outputs is None


@pytest.mark.parametrize(
    "args, error",
    [
        ({"snapshot_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        ({"snapshot_id": "1234-5678-9012", "limit": "a"}, '"a" is not a valid number'),
        ({"snapshot_id": "1234-5678-9012", "limit": 1001}, ERROR_MESSAGES["INVALID_LIMIT"].format("1001")),
    ],
)
def test_snapshot_files_list_when_invalid_arguments_are_provided(client, requests_mock, args, error):
    """Tests rubrik_gps_snapshot_files_list_command when invalid arguments provided."""
    from RubrikPolaris import rubrik_gps_snapshot_files_list_command

    response = {"data": {}}
    requests_mock.post(BASE_URL_GRAPHQL, json=response)

    with pytest.raises(ValueError) as e:
        rubrik_gps_snapshot_files_list_command(client, args)

    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_gps_vm_export_success(client, requests_mock, empty_response):
    """Tests success for rubrik-gps-vm-export."""
    from RubrikPolaris import rubrik_gps_vm_export_command

    vm_export_response = util_load_json("test_data/gps_vm_export_success.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_vm_export_hr.md")) as f:
        vm_export_response_hr = f.read()

    args = {
        "object_id": "dc4f1b47-da71-5a62-a4eb-b94406d74cbc",
        "datastore_id": "711f8a94-c7dd-5ea9-afe9-2d8e44d09d3d",
        "host_id": "f57bfebf-c7c9-5310-a5fd-1f0aeea5ba25",
        "snapshot_id": "e9e1980f-11f0-53f3-84d6-15f60264b63b",
    }
    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=vm_export_response.get("empty_response"))
        response = rubrik_gps_vm_export_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("vm export")

    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=vm_export_response.get("raw_response"))
        response = rubrik_gps_vm_export_command(client, args=args)

        assert response.raw_response == vm_export_response.get("raw_response")
        assert response.outputs == remove_empty_elements(vm_export_response.get("outputs"))
        assert response.readable_output == vm_export_response_hr


@pytest.mark.parametrize(
    "args, error",
    [
        (
            {"datastore_id": "dummy_id", "host_id": "dummy_id", "snapshot_id": "dummy_id"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id"),
        ),
        (
            {"object_id": "dummy_id", "datastore_id": "dummy_id", "snapshot_id": "dummy_id"},
            ERROR_MESSAGES["MISSING_EXPORT_DESTINATION"],
        ),
        (
            {"object_id": "dummy_id", "host_id": "dummy_id", "snapshot_id": "dummy_id"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("datastore_id"),
        ),
        (
            {"object_id": "dummy_id", "datastore_id": "dummy_id", "snapshot_id": "dummy_id"},
            ERROR_MESSAGES["MISSING_EXPORT_DESTINATION"],
        ),
        (
            {"object_id": "dummy_id", "datastore_id": "dummy_id", "host_id": "dummy_id"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id"),
        ),
        (
            {
                "object_id": "dummy_id",
                "datastore_id": "dummy_id",
                "host_id": "dummy_id",
                "snapshot_id": "dummy_id",
                "power_on": "dummy",
            },
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("dummy", "power_on"),
        ),
        (
            {
                "object_id": "dummy_id",
                "datastore_id": "dummy_id",
                "host_id": "dummy_id",
                "snapshot_id": "dummy_id",
                "keep_mac_addresses": "dummy",
            },
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("dummy", "keep_mac_addresses"),
        ),
        (
            {
                "object_id": "dummy_id",
                "datastore_id": "dummy_id",
                "host_id": "dummy_id",
                "snapshot_id": "dummy_id",
                "remove_network_devices": "dummy",
            },
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("dummy", "remove_network_devices"),
        ),
        (
            {
                "object_id": "dummy_id",
                "datastore_id": "dummy_id",
                "host_id": "dummy_id",
                "snapshot_id": "dummy_id",
                "recover_tags": "dummy",
            },
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("dummy", "recover_tags"),
        ),
        (
            {
                "object_id": "dummy_id",
                "datastore_id": "dummy_id",
                "host_id": "dummy_id",
                "snapshot_id": "dummy_id",
                "disable_network": "dummy",
            },
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("dummy", "disable_network"),
        ),
    ],
)
def test_gps_vm_export_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik-gps-vm-export."""
    from RubrikPolaris import rubrik_gps_vm_export_command

    with pytest.raises(ValueError) as e:
        rubrik_gps_vm_export_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize(
    "object_type, show_cluster_slas_only, exception, error",
    [
        ("ABC_OBJECT", "", ValueError, SDK_ERROR_MESSAGES["INVALID_SLA_LIST_OBJECT_TYPE"].format(["ABC_OBJECT"])),
        (
            "ABC_OBJECT, DEF_OBJECT",
            "",
            ValueError,
            SDK_ERROR_MESSAGES["INVALID_SLA_LIST_OBJECT_TYPE"].format(["ABC_OBJECT", "DEF_OBJECT"]),
        ),
        ("FILESET_OBJECT_TYPE", "abc", ValueError, ERROR_MESSAGES["INVALID_BOOLEAN"].format("abc", "show_cluster_slas_only")),
    ],
)
def test_gps_sla_domain_list_when_invalid_input(client, requests_mock, object_type, show_cluster_slas_only, exception, error):
    """Tests rubrik_gps_sla_domain_list when inputs are invalid."""
    from RubrikPolaris import rubrik_gps_sla_domain_list

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/gps_sla_domain_list_response.json"))
    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("sla_object_type_enum")},
        {"json": enum_values.get("sla_query_sort_by_field_enum")},
        {"json": enum_values.get("sort_order_enum")},
        {"json": raw_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)
    args = {
        "name": "",
        "cluster_id": "",
        "object_type": object_type,
        "show_cluster_slas_only": show_cluster_slas_only,
        "sort_by": "",
        "sort_order": "",
        "next_page_token": "",
    }

    with pytest.raises(exception) as e:
        rubrik_gps_sla_domain_list(client, args)

    assert str(e.value) == error


def test_gps_sla_domain_list_when_empty_response(client, requests_mock):
    """Tests rubrik_gps_sla_domain_list when empty response is returned."""
    from RubrikPolaris import rubrik_gps_sla_domain_list

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/gps_sla_domain_list_empty_response.json"))
    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("sla_query_sort_by_field_enum")},
        {"json": enum_values.get("sort_order_enum")},
        {"json": raw_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    gps_sla_domain_list_command_results = rubrik_gps_sla_domain_list(client, {})

    assert gps_sla_domain_list_command_results.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("sla domains")
    assert gps_sla_domain_list_command_results.outputs is None


def test_gps_sla_domain_list_when_success_response(client, requests_mock):
    """Tests rubrik_gps_sla_domain_list when response is success."""
    from RubrikPolaris import rubrik_gps_sla_domain_list

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/gps_sla_domain_list_success_response.json"))

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_sla_domain_list_success_hr.md")) as f:
        gps_sla_domain_list_hr = f.read()

    gps_sla_domain_list_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/gps_sla_domain_list_success_outputs.json")
    )

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("sla_object_type_enum")},
        {"json": enum_values.get("sla_query_sort_by_field_enum")},
        {"json": enum_values.get("sort_order_enum")},
        {"json": raw_response},
    ]

    requests_mock.post(BASE_URL_GRAPHQL, responses)
    args = {
        "name": "",
        "cluster_id": "",
        "object_type": "FILESET_OBJECT_TYPE, VSPHERE_OBJECT_TYPE",
        "show_cluster_slas_only": "false",
        "sort_by": "NAME",
        "sort_order": "DESC",
        "limit": "2",
        "next_page_token": "",
    }
    gps_sla_domain_list_command_results = rubrik_gps_sla_domain_list(client, args)

    assert gps_sla_domain_list_command_results.raw_response == [
        edge["node"] for edge in raw_response["data"]["slaDomains"]["edges"]
    ]
    assert gps_sla_domain_list_command_results.readable_output == gps_sla_domain_list_hr
    assert gps_sla_domain_list_command_results.outputs == gps_sla_domain_list_outputs


@pytest.mark.parametrize("empty_response", [True, False])
def test_user_downloads_list_success(client, requests_mock, empty_response):
    """Tests success for rubrik_user_downloads_list."""
    from RubrikPolaris import rubrik_user_downloads_list_command

    user_downloads_response = util_load_json("test_data/user_downloads_get_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/user_downloads_get_hr.md")) as f:
        user_downloads_hr = f.read()

    args = {"object_id": "dummy", "cluster_id": "dummy", "snapshot_id": "dummy"}

    if empty_response:
        response = user_downloads_response.get("empty_response")
        requests_mock.post(BASE_URL_GRAPHQL, json=response)
        response = rubrik_user_downloads_list_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("user downloads")

    else:
        responses = user_downloads_response.get("raw_response")
        requests_mock.post(BASE_URL_GRAPHQL, json=responses)
        response = rubrik_user_downloads_list_command(client, args=args)

        assert response.raw_response == user_downloads_response.get("raw_response")
        assert response.outputs == remove_empty_elements(user_downloads_response.get("outputs"))
        assert response.readable_output == user_downloads_hr


@pytest.mark.parametrize("empty_response", [True, False])
def test_sonar_csv_result_download_success(client, requests_mock, empty_response):
    """Tests success for rubrik_sonar_csv_result_download."""
    from RubrikPolaris import rubrik_sonar_csv_result_download_command

    sonar_csv_download_response = util_load_json("test_data/sonar_csv_result_download_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_csv_result_download_hr.md")) as f:
        sonar_csv_download_hr = f.read()

    args = {"download_id": 1}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=sonar_csv_download_response.get("empty_response"))
        response = rubrik_sonar_csv_result_download_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RESPONSE"]
    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=sonar_csv_download_response.get("raw_response"))
        response = rubrik_sonar_csv_result_download_command(client, args=args)
        assert response.raw_response == sonar_csv_download_response.get("raw_response")
        assert response.outputs == remove_empty_elements(sonar_csv_download_response.get("outputs"))
        assert response.readable_output == sonar_csv_download_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"download_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("download_id")),
        ({"download_id": "a"}, '"a" is not a valid number'),
    ],
)
def test_sonar_csv_result_download_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik_sonar_csv_result_download."""
    from RubrikPolaris import rubrik_sonar_csv_result_download_command

    with pytest.raises(ValueError) as e:
        rubrik_sonar_csv_result_download_command(client, args=args)
    assert str(e.value) == error


def test_gps_vm_snapshot_create_when_object_id_is_not_provided(client):
    """Tests invalid arguments for rubrik_gps_vm_snapshot_create."""
    from RubrikPolaris import rubrik_gps_vm_snapshot_create

    args = {"object_id": "", "sla_domain_id": ""}
    with pytest.raises(ValueError) as e:
        rubrik_gps_vm_snapshot_create(client, args=args)
    assert str(e.value) == ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")


def test_gps_vm_snapshot_create_when_empty_response(client, requests_mock):
    """Tests rubrik_gps_vm_snapshot_create when empty response is returned."""
    from RubrikPolaris import rubrik_gps_vm_snapshot_create

    empty_response = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/gps_vm_snapshot_create_empty_response.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=empty_response)
    args = {"object_id": "dummy-object-id", "sla_domain_id": ""}
    gps_vm_snapshot_create_command_results = rubrik_gps_vm_snapshot_create(client, args)

    assert gps_vm_snapshot_create_command_results.readable_output == MESSAGES["NO_RESPONSE"]
    assert gps_vm_snapshot_create_command_results.outputs is None


def test_gps_vm_snapshot_create_when_success_response(client, requests_mock):
    """Tests rubrik_gps_vm_snapshot_create when response is success."""
    from RubrikPolaris import rubrik_gps_vm_snapshot_create

    raw_response = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/gps_vm_snapshot_create_success_response.json")
    )

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_vm_snapshot_create_success_hr.md")) as f:
        gps_vm_snapshot_create_scan_hr = f.read()

    gps_vm_snapshot_create_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/gps_vm_snapshot_create_success_outputs.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)
    args = {"object_id": "dummy-object-id", "sla_domain_id": ""}

    gps_vm_snapshot_create_command_results = rubrik_gps_vm_snapshot_create(client, args)

    assert gps_vm_snapshot_create_command_results.raw_response == raw_response
    assert gps_vm_snapshot_create_command_results.readable_output == gps_vm_snapshot_create_scan_hr
    assert gps_vm_snapshot_create_command_results.outputs == gps_vm_snapshot_create_outputs


@pytest.mark.parametrize(
    "empty_response, object_type", [(True, ""), (False, "WindowsFileset"), (False, "VolumeGroup"), (False, "VmwareVm")]
)
def test_gps_snapshot_file_download_success(client, requests_mock, empty_response, object_type):
    """Tests success for rubrik_gps_snapshot_file_download."""
    from RubrikPolaris import rubrik_gps_snapshot_files_download_command

    gps_snapshot_file_download_response = util_load_json("test_data/gps_snapshot_file_download_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_snapshot_file_download_hr.md")) as f:
        gps_snapshot_file_download_hr = f.read()

    args = {"snapshot_id": 1, "file_path": "a", "object_type": object_type}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=gps_snapshot_file_download_response.get("empty_response"))
        response = rubrik_gps_snapshot_files_download_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RESPONSE"]
    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=gps_snapshot_file_download_response.get("raw_response"))
        response = rubrik_gps_snapshot_files_download_command(client, args=args)
        assert response.raw_response == gps_snapshot_file_download_response.get("raw_response")
        assert response.outputs == remove_empty_elements(gps_snapshot_file_download_response.get("outputs"))
        assert response.readable_output == gps_snapshot_file_download_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"snapshot_id": "", "file_path": "abc"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        ({"file_path": "", "snapshot_id": "abc"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("file_path")),
    ],
)
def test_gps_snapshot_file_download_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik_gps_snapshot_file_download."""
    from RubrikPolaris import rubrik_gps_snapshot_files_download_command

    with pytest.raises(ValueError) as e:
        rubrik_gps_snapshot_files_download_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize(
    "snappable_id, bool_value, field_name, exception, error",
    [
        ("", None, None, ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snappable_id")),
        ("dummy_id", "Abc", "power_on", ValueError, ERROR_MESSAGES["INVALID_BOOLEAN"].format("Abc", "power_on")),
        (
            "dummy_id",
            "Abc",
            "keep_mac_addresses",
            ValueError,
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("Abc", "keep_mac_addresses"),
        ),
        (
            "dummy_id",
            "Abc",
            "remove_network_devices",
            ValueError,
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("Abc", "remove_network_devices"),
        ),
        (
            "dummy_id",
            "Abc",
            "should_recover_tags",
            ValueError,
            ERROR_MESSAGES["INVALID_BOOLEAN"].format("Abc", "should_recover_tags"),
        ),
    ],
)
def test_gps_vm_livemount_when_invalid_input(requests_mock, snappable_id, bool_value, field_name, exception, error):
    """Tests rubrik_gps_vm_livemount when inputs are invalid."""
    from RubrikPolaris import rubrik_gps_vm_livemount

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/gps_vm_livemount_success_response.json"))

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)
    args = {"snappable_id": snappable_id, f"{field_name}": bool_value}

    with pytest.raises(exception) as e:
        rubrik_gps_vm_livemount(client, args)

    assert str(e.value) == error


def test_gps_vm_livemount_when_empty_response(client, requests_mock):
    """Tests rubrik_gps_vm_livemount when empty response is returned."""
    from RubrikPolaris import rubrik_gps_vm_livemount

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/gps_vm_livemount_empty_response.json"))

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)

    gps_vm_livemount_command_results = rubrik_gps_vm_livemount(client, {"snappable_id": "dummy_id"})

    assert gps_vm_livemount_command_results.readable_output == MESSAGES["NO_RESPONSE"]
    assert gps_vm_livemount_command_results.outputs is None


def test_gps_vm_livemount_list_when_success_response(client, requests_mock):
    """Tests rubrik_gps_vm_livemount when response is success."""
    from RubrikPolaris import rubrik_gps_vm_livemount

    raw_response = util_load_json(os.path.join(os.path.dirname(__file__), "test_data/gps_vm_livemount_success_response.json"))

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_vm_livemount_success_hr.md")) as f:
        gps_vm_livemount_hr = f.read()

    gps_vm_livemount_outputs = util_load_json(
        os.path.join(os.path.dirname(__file__), "test_data/gps_vm_livemount_success_outputs.json")
    )

    requests_mock.post(BASE_URL_GRAPHQL, json=raw_response)
    args = {"snappable_id": "dummy_id"}
    gps_vm_livemount_command_results = rubrik_gps_vm_livemount(client, args)

    assert gps_vm_livemount_command_results.raw_response == raw_response
    assert gps_vm_livemount_command_results.readable_output == gps_vm_livemount_hr
    assert gps_vm_livemount_command_results.outputs == gps_vm_livemount_outputs


@pytest.mark.parametrize("empty_response", [True, False])
def test_gps_vm_host_list_success(client, requests_mock, empty_response):
    """Tests success for rubrik-gps-vm-host-list."""
    from RubrikPolaris import rubrik_gps_vm_host_list_command

    vm_host_list_response = util_load_json("test_data/gps_vm_host_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_vm_host_list_hr.md")) as f:
        vm_host_list_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("sort_by_enum")}, {"json": enum_values.get("sort_order_enum")}]
    if empty_response:
        responses.append({"json": vm_host_list_response.get("empty_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_gps_vm_host_list_command(client, args={})
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("vm hosts")

    else:
        responses.append({"json": vm_host_list_response.get("raw_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_gps_vm_host_list_command(client, args={})

        assert response.raw_response == vm_host_list_response.get("raw_response")
        assert response.outputs.get(f"{OUTPUT_PREFIX['GPS_VM_HOSTS']}(val.id == obj.id)") == remove_empty_elements(
            vm_host_list_response.get("outputs")
        )
        assert response.readable_output == vm_host_list_response_hr


@pytest.mark.parametrize("args, error", [({"limit": "a"}, '"a" is not a valid number')])
def test_gps_vm_host_list_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik-gps-vm-host-list."""
    from RubrikPolaris import rubrik_gps_vm_host_list_command

    with pytest.raises(ValueError) as e:
        rubrik_gps_vm_host_list_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_gps_vm_datastore_list_success(client, requests_mock, empty_response):
    """Tests success for rubrik-gps-vm-datastore-list."""
    from RubrikPolaris import rubrik_gps_vm_datastore_list_command

    vm_datastore_list_response = util_load_json("test_data/gps_vm_datastore_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_vm_datastore_list_hr.md")) as f:
        vm_datastore_list_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("sort_by_enum")}, {"json": enum_values.get("sort_order_enum")}]
    args = {"host_id": "dummy_id", "name": "vm"}
    if empty_response:
        responses.append({"json": vm_datastore_list_response.get("empty_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_gps_vm_datastore_list_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("vm datastores")

    else:
        responses.append({"json": vm_datastore_list_response.get("raw_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_gps_vm_datastore_list_command(client, args=args)

        assert response.raw_response == vm_datastore_list_response.get("raw_response")
        assert response.outputs.get(f"{OUTPUT_PREFIX['GPS_VM_HOSTS']}(val.id == obj.id)") == remove_empty_elements(
            vm_datastore_list_response.get("outputs")
        )
        assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_VM_HOSTS']}(val.name == obj.name)") == {
            "Datastore": remove_empty_elements(vm_datastore_list_response.get("page_token"))
        }
        assert response.readable_output == vm_datastore_list_response_hr


@pytest.mark.parametrize("args, error", [({"limit": "a"}, '"a" is not a valid number')])
def test_gps_vm_datastore_list_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik-gps-vm-datastore-list."""
    from RubrikPolaris import rubrik_gps_vm_datastore_list_command

    with pytest.raises(ValueError) as e:
        rubrik_gps_vm_datastore_list_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_cdm_cluster_connection_state_command_success(client, requests_mock, empty_response):
    """Tests success for rubrik-cdm-cluster-connection-state."""
    from RubrikPolaris import cdm_cluster_connection_state_command

    cdm_cluster_connection_state_response = util_load_json("test_data/cdm_cluster_connection_state_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/cdm_cluster_connection_state_hr.md")) as f:
        cdm_cluster_connection_state_hr = f.read()

    args = {"clusterId": "dummy"}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=cdm_cluster_connection_state_response.get("empty_response"))
        with pytest.raises(Exception) as e:
            cdm_cluster_connection_state_command(client, args=args)
        assert str(e.value) == "A CDM Cluster with an ID of {} was not found.".format("dummy")

    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=cdm_cluster_connection_state_response.get("raw_response"))
        response = cdm_cluster_connection_state_command(client, args=args)

        assert response.raw_response == cdm_cluster_connection_state_response.get("outputs").get("Cluster").get("ConnectionState")
        assert response.outputs == remove_empty_elements(cdm_cluster_connection_state_response.get("outputs"))
        assert response.readable_output == cdm_cluster_connection_state_hr


@pytest.mark.parametrize("args, error", [({"clusterId": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("clusterId"))])
def test_cdm_cluster_connection_state_command_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik-cdm-cluster-connection-state."""
    from RubrikPolaris import cdm_cluster_connection_state_command

    with pytest.raises(ValueError) as e:
        cdm_cluster_connection_state_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_cdm_cluster_location_command_command_success(client, requests_mock, empty_response):
    """Tests success for rubrik-cdm-cluster-location."""
    from RubrikPolaris import cdm_cluster_location_command

    cdm_cluster_location_response = util_load_json("test_data/cdm_cluster_location_response.json")

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/cdm_cluster_location_hr.md")) as f:
        cdm_cluster_location_hr = f.read()

    args = {"clusterId": "dummy"}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=cdm_cluster_location_response.get("empty_response"))
        with pytest.raises(Exception) as e:
            cdm_cluster_location_command(client, args=args)
        assert str(e.value) == "A CDM Cluster with an ID of {} was not found.".format("dummy")

    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=cdm_cluster_location_response.get("raw_response"))
        response = cdm_cluster_location_command(client, args=args)
        assert response.raw_response == cdm_cluster_location_response.get("outputs").get("Cluster").get("Location")
        assert response.outputs == remove_empty_elements(cdm_cluster_location_response.get("outputs"))
        assert response.readable_output == cdm_cluster_location_hr


def test_cdm_cluster_location_command_when_key_not_present(client, requests_mock):
    """Tests rubrik-cdm-cluster-location command when some of the keys are not present in response."""
    from RubrikPolaris import cdm_cluster_location_command

    cdm_cluster_location_response = util_load_json("test_data/cdm_cluster_location_response.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=cdm_cluster_location_response.get("empty_location"))

    response = cdm_cluster_location_command(client, args={"clusterId": "dummy"})
    assert response.readable_output == MESSAGES["NO_RESPONSE"]


@pytest.mark.parametrize("args, error", [({"clusterId": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("clusterId"))])
def test_cdm_cluster_location_command_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik-cdm-cluster-location."""
    from RubrikPolaris import cdm_cluster_location_command

    with pytest.raises(ValueError) as e:
        cdm_cluster_location_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_radar_analysis_status_command_success(client, requests_mock, empty_response):
    """Tests success for rubrik-radar-analysis-status."""
    from RubrikPolaris import radar_analysis_status_command

    radar_analysis_status_response = util_load_json("test_data/radar_analysis_status_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_analysis_status_hr.md")) as f:
        radar_analysis_status_hr = f.read()

    args = {"activitySeriesId": "dummy", "clusterId": "dummy"}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=radar_analysis_status_response.get("empty_response"))
        response = radar_analysis_status_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("radar analysis status")

    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=radar_analysis_status_response.get("raw_response"))
        response = radar_analysis_status_command(client, args=args)

        assert response.raw_response == radar_analysis_status_response.get("raw_response")
        assert response.outputs == remove_empty_elements(radar_analysis_status_response.get("outputs"))
        assert response.readable_output == radar_analysis_status_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"activitySeriesId": "", "clusterId": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("activitySeriesId")),
        ({"activitySeriesId": "", "clusterId": "dummy"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("activitySeriesId")),
        ({"activitySeriesId": "dummy", "clusterId": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("clusterId")),
    ],
)
def test_radar_analysis_status_command_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik-radar-analysis-status."""
    from RubrikPolaris import radar_analysis_status_command

    with pytest.raises(ValueError) as e:
        radar_analysis_status_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_event_list_success(client, requests_mock, empty_response):
    """Tests success for rubrik-event-list."""
    from RubrikPolaris import rubrik_event_list_command

    event_list_response = util_load_json("test_data/event_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/event_list_response_hr.md")) as f:
        event_list_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("event_sort_by_enum")}, {"json": enum_values.get("event_sort_order_enum")}]
    args = {}
    if empty_response:
        responses.append({"json": event_list_response.get("empty_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_event_list_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("events")

    else:
        responses.append({"json": event_list_response.get("raw_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_event_list_command(client, args=args)

        assert response.raw_response == event_list_response.get("raw_response")
        assert response.outputs.get(f"{OUTPUT_PREFIX['EVENT']}(val.id == obj.id)") == remove_empty_elements(
            event_list_response.get("outputs")
        )
        assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_EVENT']}(val.name == obj.name)") == remove_empty_elements(
            event_list_response.get("page_token")
        )
        assert response.readable_output == event_list_response_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"limit": "a"}, '"a" is not a valid number'),
        ({"start_date": "aaa"}, '"aaa" is not a valid date'),
        ({"end_date": "a111"}, '"a111" is not a valid date'),
        ({"limit": -1}, ERROR_MESSAGES["INVALID_LIMIT"].format(-1)),
    ],
)
def test_event_list_when_invalid_arguments_are_provided(client, args, error):
    """Tests invalid arguments for rubrik-event-list."""
    from RubrikPolaris import rubrik_event_list_command

    with pytest.raises(ValueError) as e:
        rubrik_event_list_command(client, args=args)
    assert str(e.value) == error


def test_sonar_sensitive_hits_success(client, requests_mock):
    """
    Test case scenario for successful execution of rubrik-sonar-sensitive-hits command with a valid response.

    When:
        -calling rubrik-sonar-sensitive-hits command
    Then:
        -Verifies mock response with actual response obtained
    """
    from RubrikPolaris import sonar_sensitive_hits_command

    sonar_sensitive_hits_response = util_load_json("test_data/sonar_sensitive_hits_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_sensitive_hits_response_hr.md")) as f:
        sonar_sensitive_hits_response_hr = f.read()
    responses = [
        {"json": sonar_sensitive_hits_response.get("raw_response_list")},
        {"json": sonar_sensitive_hits_response.get("raw_response")},
    ]
    args = {}
    requests_mock.post(BASE_URL_GRAPHQL, responses)
    response = sonar_sensitive_hits_command(client, args=args)

    assert response.raw_response == sonar_sensitive_hits_response.get("raw_response")
    assert response.outputs == remove_empty_elements(sonar_sensitive_hits_response.get("outputs"))
    assert response.readable_output == sonar_sensitive_hits_response_hr


def test_sonar_sensitive_hits_when_response_is_empty(client, requests_mock):
    """
    Test case scenario for successful execution of rubrik-sonar-sensitive-hits command with an empty response.

    When:
        -calling rubrik-sonar-sensitive-hits command
    Then:
        -Verifies mock response with empty message obtained in HR
    """
    from RubrikPolaris import sonar_sensitive_hits_command

    sonar_sensitive_hits_response = util_load_json("test_data/sonar_sensitive_hits_response.json")
    responses = [
        {"json": sonar_sensitive_hits_response.get("raw_response_list")},
        {"json": sonar_sensitive_hits_response.get("empty_response")},
    ]
    args = {}
    requests_mock.post(BASE_URL_GRAPHQL, responses)
    response = sonar_sensitive_hits_command(client, args=args)

    assert response.raw_response is None
    assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("sensitive hits")


@pytest.mark.parametrize("args, error", [({"searchTimePeriod": "a"}, '"a" is not a valid number')])
def test_sonar_sensitive_hits_when_invalid_arguments_are_provided(client, args, error):
    """
    Tests invalid arguments for rubrik-sonar-sensitive-hits.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import sonar_sensitive_hits_command

    with pytest.raises(ValueError) as e:
        sonar_sensitive_hits_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_object_list_success(client, requests_mock, empty_response):
    """
    Test case scenario for successful execution of rubrik-polaris-object-list command with a valid and an empty response.

    When:
        -calling rubrik-polaris-object-list command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_polaris_object_list_command

    object_list_response = util_load_json("test_data/object_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/object_list_response_hr.md")) as f:
        object_list_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("sort_by_enum")},
        {"json": enum_values.get("sort_order_enum")},
        {"json": enum_values.get("hierarchy_object_type_enum")},
    ]
    args = {"sort_order": "ASC", "type_filter": "MONGODB_DATABASE"}
    if empty_response:
        responses.append({"json": object_list_response.get("empty_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_polaris_object_list_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("objects")

    else:
        responses.append({"json": object_list_response.get("raw_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_polaris_object_list_command(client, args=args)

        assert response.raw_response == object_list_response.get("raw_response")
        assert response.outputs.get(f"{OUTPUT_PREFIX['OBJECT']}(val.id == obj.id)") == remove_empty_elements(
            object_list_response.get("outputs")
        )
        assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_OBJECT']}(val.name == obj.name)") == remove_empty_elements(
            object_list_response.get("page_token")
        )
        assert response.readable_output == object_list_response_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"limit": "a"}, "'type_filter' field is required. Please provide correct input."),
        ({"type_filter": "MONGODB_DATABASE", "limit": -1}, ERROR_MESSAGES["INVALID_LIMIT"].format(-1)),
        ({"type_filter": "MONGODB_DATABASE", "sort_order": "asc"}, SDK_ERROR_MESSAGES["INVALID_SORT_ORDER"].format("asc")),
    ],
)
def test_object_list_when_invalid_arguments_are_provided(client, args, error, requests_mock):
    """
    Test case scenario for invalid arguments for rubrik-polaris-object-list.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_polaris_object_list_command

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("sort_by_enum")},
        {"json": enum_values.get("sort_order_enum")},
        {"json": enum_values.get("hierarchy_object_type_enum")},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    with pytest.raises(ValueError) as e:
        rubrik_polaris_object_list_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_polaris_object_snapshot_list_success(client, requests_mock, empty_response):
    """Tests success for rubrik-polaris-object-snapshot-list."""
    from RubrikPolaris import rubrik_polaris_object_snapshot_list_command

    object_snapshot_list_response = util_load_json("test_data/object_snapshot_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/object_snapshot_list_response_hr.md")) as f:
        object_snapshot_list_response_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("event_sort_order_enum")}]
    args = {"object_id": "06515737-388a-57aa-9c8e-54b3f1ee5d8b", "sort_order": "ASC"}
    if empty_response:
        responses.append({"json": object_snapshot_list_response.get("empty_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_polaris_object_snapshot_list_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("object snapshots")

    else:
        responses.append({"json": object_snapshot_list_response.get("raw_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_polaris_object_snapshot_list_command(client, args=args)

        assert response.raw_response == object_snapshot_list_response.get("raw_response")
        assert response.outputs.get(f"{OUTPUT_PREFIX['OBJECT']}(val.id == obj.id)") == remove_empty_elements(
            object_snapshot_list_response.get("outputs")
        )
        assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_OBJECT']}(val.name == obj.name)") == remove_empty_elements(
            object_snapshot_list_response.get("page_token")
        )
        assert response.readable_output == object_snapshot_list_response_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"object_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
        ({"object_id": "1", "limit": "a"}, '"a" is not a valid number'),
        ({"object_id": "1", "start_date": "aaa"}, '"aaa" is not a valid date'),
        ({"object_id": "1", "end_date": "a111"}, '"a111" is not a valid date'),
        ({"object_id": "1", "limit": -1}, ERROR_MESSAGES["INVALID_LIMIT"].format(-1)),
        ({"object_id": "1", "sort_order": "as"}, SDK_ERROR_MESSAGES["INVALID_OBJECT_SNAPSHOT_SORT_ORDER"].format("as")),
    ],
)
def test_polaris_object_snapshot_list_when_invalid_arguments_are_provided(client, args, error, requests_mock):
    """Tests invalid arguments for rubrik-polaris-object-snapshot-list."""
    from RubrikPolaris import rubrik_polaris_object_snapshot_list_command

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))

    responses = [{"json": enum_values.get("event_sort_order_enum")}]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    with pytest.raises(ValueError) as e:
        rubrik_polaris_object_snapshot_list_command(client, args=args)
    assert str(e.value) == error


radar_ioc_scan_invalid_args = [
    ({"cluster_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("cluster_id")),
    ({"cluster_id": "dummy-cluster-id", "object_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id",
            "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
            "ioc_value": "",
            "start_date": "abc",
        },
        'Invalid date: "start_date"="abc"',
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id",
            "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
            "ioc_value": "",
            "end_date": "abc",
        },
        'Invalid date: "end_date"="abc"',
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id",
            "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
            "ioc_value": "",
            "max_snapshots_per_object": "abc",
        },
        'Invalid number: "max_snapshots_per_object"="abc"',
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1, dummy-object-id-2",
            "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
            "ioc_value": "",
            "snapshot_id": "dummy-snapshot-id-1-1, dummy-snapshot-id-1-2",
        },
        ERROR_MESSAGES["LEN_SNAPSHOT_NE_LEN_OBJECT"],
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1, dummy-object-id-2",
            "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
            "ioc_value": "",
            "snapshot_id": "dummy-snapshot-id-1-1, dummy-snapshot-id-1-2: dummy-snapshot-id-2-1: dummy-snapshot-id-3-1",
        },
        ERROR_MESSAGES["LEN_SNAPSHOT_NE_LEN_OBJECT"],
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1",
            "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
            "ioc_value": "",
            "snapshot_id": "dummy-snapshot-id-1-1, dummy-snapshot-id-1-2: dummy-snapshot-id-2-1",
        },
        ERROR_MESSAGES["LEN_SNAPSHOT_NE_LEN_OBJECT"],
    ),
    (
        {"cluster_id": "dummy-cluster-id", "object_id": "dummy-object-id-1", "ioc_type": "abc", "ioc_value": ""},
        ERROR_MESSAGES["INVALID_SELECT"].format("abc", "ioc_type", IOC_TYPE_ENUM),
    ),
    (
        {"cluster_id": "dummy-cluster-id", "object_id": "dummy-object-id-1", "ioc_type": "", "ioc_value": ""},
        ERROR_MESSAGES["NO_INDICATOR_SPECIFIED"],
    ),
    (
        {"cluster_id": "dummy-cluster-id", "object_id": "dummy-object-id-1", "ioc_type": "", "ioc_value": "", "advance_ioc": ""},
        ERROR_MESSAGES["NO_INDICATOR_SPECIFIED"],
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1",
            "ioc_type": "",
            "ioc_value": "",
            "advance_ioc": "{}",
        },
        ERROR_MESSAGES["NO_INDICATOR_SPECIFIED"],
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1",
            "ioc_type": "",
            "ioc_value": "",
            "advance_ioc": "[]",
        },
        ERROR_MESSAGES["NO_INDICATOR_SPECIFIED"],
    ),
    (
        {"cluster_id": "dummy-cluster-id", "object_id": "dummy-object-id-1", "ioc_type": "", "ioc_value": "", "advance_ioc": "["},
        ERROR_MESSAGES["JSON_DECODE"].format("advance_ioc"),
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1",
            "ioc_type": "",
            "ioc_value": "",
            "advance_ioc": '{"path_or_filename": ""',
        },
        ERROR_MESSAGES["JSON_DECODE"].format("advance_ioc"),
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1",
            "ioc_type": "",
            "ioc_value": "",
            "advance_ioc": '["path_or_filename": ""]',
        },
        ERROR_MESSAGES["JSON_DECODE"].format("advance_ioc"),
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1",
            "ioc_type": "",
            "ioc_value": "",
            "advance_ioc": '[{"path_or_filename": ""}]',
        },
        ERROR_MESSAGES["INVALID_FORMAT"].format("advance_ioc"),
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1",
            "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
            "ioc_value": "",
            "requested_hash_types": "WRONG_HASH_TYPE",
        },
        SDK_ERROR_MESSAGES["INVALID_REQUESTED_HASH_TYPE"].format(["WRONG_HASH_TYPE"]),
    ),
    (
        {
            "cluster_id": "dummy-cluster-id",
            "object_id": "dummy-object-id-1",
            "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
            "ioc_value": "",
            "requested_hash_types": "WRONG_HASH_TYPE1, WRONG_HASH_TYPE2",
        },
        SDK_ERROR_MESSAGES["INVALID_REQUESTED_HASH_TYPE"].format(["WRONG_HASH_TYPE1", "WRONG_HASH_TYPE2"]),
    ),
]


@pytest.mark.parametrize("args, error", radar_ioc_scan_invalid_args)
def test_radar_ioc_scan_when_invalid_arguments_are_provided(client, requests_mock, args, error):
    """
    Test case scenario for invalid arguments for rubrik-radar-ioc-scan.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_radar_ioc_scan_command

    enum_values = util_load_json("test_data/enum_values.json")

    requests_mock.post(BASE_URL + "/graphql", json=enum_values.get("hash_type_enum"))
    with pytest.raises(ValueError) as e:
        rubrik_radar_ioc_scan_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_radar_ioc_scan_when_success(client, requests_mock, empty_response):
    """
    Test case scenario for successful execution of rubrik-radar-ioc-scan command with a valid and an empty response.

    When:
        -calling rubrik-radar-ioc-scan command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_radar_ioc_scan_command

    ioc_scan_response = util_load_json("test_data/ioc_scan_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/ioc_scan_response_hr.md")) as f:
        ioc_scan_response_hr = f.read()
    args = {
        "cluster_id": "dummy-cluster-id",
        "object_id": "dummy-object-id-1",
        "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH",
        "ioc_value": "",
    }
    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=ioc_scan_response.get("empty_response"))
        response = rubrik_radar_ioc_scan_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RESPONSE"]
    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=ioc_scan_response.get("raw_response"))
        response = rubrik_radar_ioc_scan_command(client, args=args)

        assert response.raw_response == ioc_scan_response.get("raw_response")
        assert response.outputs == ioc_scan_response.get("outputs")
        assert response.readable_output == ioc_scan_response_hr


@pytest.mark.parametrize("args, error", [({"cluster_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("cluster_id"))])
def test_radar_ioc_scan_list_when_invalid_arguments_are_provided(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik-radar-ioc-scan-list.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_radar_ioc_scan_list_command

    with pytest.raises(ValueError) as e:
        rubrik_radar_ioc_scan_list_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_radar_ioc_scan_list_when_success(client, requests_mock, empty_response):
    """
    Test case scenario for successful execution of rubrik-radar-ioc-scan-list command with a valid and an empty response.

    When:
        -calling rubrik-radar-ioc-scan command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_radar_ioc_scan_list_command

    ioc_scan_list_response = util_load_json("test_data/ioc_scan_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/ioc_scan_list_response_hr.md")) as f:
        ioc_scan_list_response_hr = f.read()

    args = {"cluster_id": "dummy-cluster-id"}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=ioc_scan_list_response.get("empty_response"))
        response = rubrik_radar_ioc_scan_list_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("ioc scans")
    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=ioc_scan_list_response.get("raw_response"))
        response = rubrik_radar_ioc_scan_list_command(client, args=args)

        assert response.raw_response == ioc_scan_list_response.get("raw_response")
        assert response.outputs == ioc_scan_list_response.get("outputs")
        assert response.readable_output == ioc_scan_list_response_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"scan_id": "", "cluster_id": "dummy-cluster-id"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("scan_id")),
        ({"scan_id": "dummy-scan-id", "cluster_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("cluster_id")),
    ],
)
def test_radar_ioc_scan_results_when_invalid_arguments_are_provided(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik-radar-ioc-scan-results.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_radar_ioc_scan_results_command

    with pytest.raises(ValueError) as e:
        rubrik_radar_ioc_scan_results_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_radar_ioc_scan_results_success(client, requests_mock, empty_response):
    """
    Test case scenario for successful execution of rubrik-radar-ioc-scan-results command with a valid and an empty response.

    When:
        -calling rubrik-radar-ioc-scan-results command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_radar_ioc_scan_results_command

    ioc_scan_results_response = util_load_json("test_data/radar_ioc_scan_results_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_ioc_scan_results_response_hr.md")) as f:
        ioc_scan_results_response_hr = f.read()

    args = {"scan_id": "dummy-scan-id", "cluster_id": "dummy-cluster-id"}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=ioc_scan_results_response.get("empty_response"))
        response = rubrik_radar_ioc_scan_results_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RESPONSE"]

    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=ioc_scan_results_response.get("raw_response"))
        response = rubrik_radar_ioc_scan_results_command(client, args=args)

        assert response.raw_response == ioc_scan_results_response.get("raw_response")
        assert response.outputs == ioc_scan_results_response.get("outputs")
        assert response.readable_output == ioc_scan_results_response_hr


@pytest.mark.parametrize("empty_response", [True, False])
def test_gps_async_result_command_success(client, requests_mock, empty_response):
    """
    Test case scenario for successful execution of rubrik-gps-async-result command with a valid and an empty response.

    When:
        -calling rubrik-gps-async-result command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_gps_async_result_command

    gps_async_result_response = util_load_json("test_data/gps_async_result_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_async_result_response_hr.md")) as f:
        gps_async_result_hr = f.read()

    args = {"request_id": "dummy", "cluster_id": "dummy"}

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=gps_async_result_response.get("empty_response"))
        response = rubrik_gps_async_result_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RESPONSE"]

    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=gps_async_result_response.get("raw_response"))
        response = rubrik_gps_async_result_command(client, args=args)

        assert response.raw_response == gps_async_result_response.get("raw_response")
        assert response.outputs == remove_empty_elements(gps_async_result_response.get("outputs"))
        assert response.readable_output == gps_async_result_hr


@pytest.mark.parametrize(
    "args, error",
    [
        ({"request_id": "", "cluster_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("request_id")),
        ({"request_id": "dummy", "cluster_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("cluster_id")),
    ],
)
def test_gps_async_result_command_when_invalid_arguments_are_provided(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik-gps-async-result.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_gps_async_result_command

    with pytest.raises(ValueError) as e:
        rubrik_gps_async_result_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_gps_cluster_list_command_success(client, requests_mock, empty_response):
    """
    Test case scenario for successful execution of rubrik-gps-cluster-list command with a valid and an empty response.

    When:
        -calling rubrik-gps-cluster-list command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_gps_cluster_list_command

    gps_cluster_list_response = util_load_json("test_data/gps_cluster_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_cluster_list_response_hr.md")) as f:
        gps_cluster_list_hr = f.read()

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("cluster_list_sort_by_enum")}, {"json": enum_values.get("event_sort_order_enum")}]
    args = {}

    if empty_response:
        responses.append({"json": gps_cluster_list_response.get("empty_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_gps_cluster_list_command(client, args=args)
        assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("clusters")

    else:
        responses.append({"json": gps_cluster_list_response.get("raw_response")})
        requests_mock.post(BASE_URL_GRAPHQL, responses)
        response = rubrik_gps_cluster_list_command(client, args=args)

        assert response.raw_response == [
            edge["node"] for edge in gps_cluster_list_response.get("raw_response")["data"]["clusterConnection"]["edges"]
        ]
        assert response.outputs == remove_empty_elements(gps_cluster_list_response.get("outputs"))
        assert response.readable_output == gps_cluster_list_hr


def test_gps_cluster_list_command_when_invalid_argument_is_provided(client, requests_mock):
    """
    Test case scenario for invalid argument for rubrik-gps-cluster-list.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_gps_cluster_list_command

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [{"json": enum_values.get("cluster_list_sort_by_enum")}, {"json": enum_values.get("event_sort_order_enum")}]
    requests_mock.post(BASE_URL_GRAPHQL, responses)
    with pytest.raises(ValueError) as e:
        rubrik_gps_cluster_list_command(client, args={"sort_order": "asc"})
    assert str(e.value) == SDK_ERROR_MESSAGES["INVALID_OBJECT_SNAPSHOT_SORT_ORDER"].format("asc")


@pytest.mark.parametrize(
    "args, error",
    [
        ({"snapshot_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        ({"snapshot_id": "dummy-snapshot-id", "cluster_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("cluster_id")),
        (
            {"snapshot_id": "dummy-snapshot-id", "cluster_id": "dummy-cluster-id", "paths_to_recover": ""},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("paths_to_recover"),
        ),
        (
            {
                "snapshot_id": "dummy-snapshot-id",
                "cluster_id": "dummy-cluster-id",
                "paths_to_recover": "/etc,/home",
                "restore_path": "",
            },
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("restore_path"),
        ),
    ],
)
def test_gps_vm_recover_files_command_when_invalid_arguments_are_provided(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik-gps-vm-recover-files.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_gps_vm_recover_files

    with pytest.raises(ValueError) as e:
        rubrik_gps_vm_recover_files(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_gps_vm_recover_files_command_success(client, requests_mock, empty_response):
    """
    Test case scenario for successful execution of rubrik-gps-vm-recover-files command with a valid and an empty response.

    When:
        -calling rubrik-gps-vm-recover-files command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_gps_vm_recover_files

    gps_vm_recover_files_response = util_load_json("test_data/gps_vm_recover_files_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/gps_vm_recover_files_response_hr.md")) as f:
        gps_vm_recover_files_hr = f.read()

    args = {
        "snapshot_id": "dummy-snapshot-id",
        "cluster_id": "dummy-cluster-id",
        "paths_to_recover": "/etc,/home",
        "restore_path": "/",
    }

    if empty_response:
        requests_mock.post(BASE_URL_GRAPHQL, json=gps_vm_recover_files_response.get("empty_response"))
        response = rubrik_gps_vm_recover_files(client, args=args)
        assert response.readable_output == MESSAGES["NO_RESPONSE"]

    else:
        requests_mock.post(BASE_URL_GRAPHQL, json=gps_vm_recover_files_response.get("raw_response"))
        response = rubrik_gps_vm_recover_files(client, args=args)

        assert response.raw_response == gps_vm_recover_files_response.get("raw_response")
        assert response.outputs == gps_vm_recover_files_response.get("outputs")
        assert response.readable_output == gps_vm_recover_files_hr


def test_rubrik_sonar_user_access_list_command_success_with_empty_response(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_user_access_list_command with valid case and empty response.

    When:
        - Calling rubrik_sonar_user_access_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_user_access_list_command

    # Load test data
    response_data = util_load_json("test_data/sonar_user_access_list_response.json")

    args = {"sort_order": "ASC", "limit": 1, "page_number": 1, "include_whitelisted_results": True, "user_email": "demo"}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("empty_response")}])
    response = rubrik_sonar_user_access_list_command(client, args=args)
    assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("user accesses")


@pytest.mark.parametrize("limit, page_number", [(1, 1), (1, 2), (2, 1)])
def test_rubrik_sonar_user_access_list_command_success(client, requests_mock, limit, page_number):
    """
    Test case scenario for rubrik_sonar_user_access_list_command with valid case.

    When:
        - Calling rubrik_sonar_user_access_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_user_access_list_command

    # Load test data
    response_data = util_load_json("test_data/sonar_user_access_list_response.json")
    with open(
        os.path.join(
            os.path.dirname(os.path.realpath(__file__)), f"test_data/sonar_user_access_list_response_hr_{limit}_{page_number}.md"
        )
    ) as f:
        hr_data = f.read()

    args = {
        "sort_order": "ASC",
        "limit": limit,
        "page_number": page_number,
        "include_whitelisted_results": True,
        "user_email": "demo",
    }

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_sonar_user_access_list_command(client, args=args)
    outputs = response_data.get(f"outputs_{limit}_{page_number}")
    page_token = response_data.get(f"page_token_{limit}_{page_number}")

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs.get(f"{OUTPUT_PREFIX['USER_ACCESS']}(val.principalId == obj.principalId)") == remove_empty_elements(
        outputs
    )
    assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_USER_ACCESS']}(val.name == obj.name)") == remove_empty_elements(
        page_token
    )
    assert response.readable_output == hr_data


def test_rubrik_sonar_user_access_list_command_success_with_invalid_user_email(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_user_access_list_command when irrelevant user email is provided.

    When:
        - Calling rubrik_sonar_user_access_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_user_access_list_command

    # Load test data
    response_data = util_load_json("test_data/sonar_user_access_list_response.json")
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])

    args = {"sort_order": "ASC", "limit": "1", "user_email": "invalid_user_email", "next_page_token": "cursor_1"}

    page_token = remove_empty_elements(response_data.get("page_token_2_1"))

    response = rubrik_sonar_user_access_list_command(client, args=args)
    assert (
        response.readable_output
        == MESSAGES["NO_RECORDS_FOUND"].format("user accesses") + f"\n\n{MESSAGES['NEXT_PAGE_TOKEN'].format('cursor_2')}"
    )
    assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_USER_ACCESS']}(val.name == obj.name)", {}) == page_token


def test_rubrik_sonar_user_access_list_command_success_with_not_whitelisted(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_user_access_list_command when not whitelisting response.

    When:
        - Calling rubrik_sonar_user_access_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_user_access_list_command

    # Load test data
    response_data = util_load_json("test_data/sonar_user_access_list_response.json")
    with open(
        os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_user_access_list_response_hr_2_1.md")
    ) as f:
        hr_data = f.read()

    args = {"sort_order": "Asc", "limit": "2", "include_whitelisted_results": False}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response_when_not_whitelisted")}])
    response = rubrik_sonar_user_access_list_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response_when_not_whitelisted")
    assert response.outputs.get(f"{OUTPUT_PREFIX['USER_ACCESS']}(val.principalId == obj.principalId)") == remove_empty_elements(
        response_data.get("outputs_when_not_whitelisted")
    )
    assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_USER_ACCESS']}(val.name == obj.name)") == remove_empty_elements(
        response_data.get("page_token_2_1")
    )
    assert response.readable_output == hr_data


@pytest.mark.parametrize(
    "args, error",
    [
        ({"limit": "0"}, ERROR_MESSAGES["INVALID_LIMIT"].format(0)),
        ({"limit": MAXIMUM_PAGINATION_LIMIT + 1}, ERROR_MESSAGES["INVALID_LIMIT"].format(MAXIMUM_PAGINATION_LIMIT + 1)),
        ({"sort_order": "INC"}, ERROR_MESSAGES["INVALID_SORT_ORDER"].format("INC")),
    ],
)
def test_rubrik_sonar_user_access_list_command_with_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_sonar_user_access_list_command.

    Given:
        -args: Contains arguments for the command.
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_sonar_user_access_list_command

    with pytest.raises(ValueError) as e:
        rubrik_sonar_user_access_list_command(client, args=args)
    assert str(e.value) == error


def test_rubrik_sonar_user_access_get_command_success_with_empty_response(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_user_access_get_command with valid case and empty response.

    When:
        - Calling rubrik_sonar_user_access_get_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_user_access_get_command

    # Load test data
    response_data = util_load_json("test_data/sonar_user_access_get_response.json")

    args = {"user_id": "S-1-0-01-0000000000-0000000000-000000000-0001", "include_whitelisted_results": True}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("empty_response")}])
    response = rubrik_sonar_user_access_get_command(client, args=args)
    assert response.readable_output == MESSAGES["NO_RESPONSE"]


def test_rubrik_sonar_user_access_get_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_user_access_get_command with valid case.

    When:
        - Calling rubrik_sonar_user_access_get_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_user_access_get_command

    # Load test data
    response_data = util_load_json("test_data/sonar_user_access_get_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_user_access_get_response_hr.md")) as f:
        hr_data = f.read()

    args = {"user_id": "S-1-0-01-0000000000-0000000000-000000000-0001", "include_whitelisted_results": True}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_sonar_user_access_get_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs.get(f"{OUTPUT_PREFIX['USER_ACCESS']}(val.principalId == obj.principalId)") == remove_empty_elements(
        response_data.get("outputs")
    )
    assert response.readable_output == hr_data


def test_rubrik_sonar_user_access_get_command_success_when_not_whitelisted(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_user_access_get_command when not whitelisting response.

    When:
        - Calling rubrik_sonar_user_access_get_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_user_access_get_command

    # Load test data
    response_data = util_load_json("test_data/sonar_user_access_get_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_user_access_get_response_hr.md")) as f:
        hr_data = f.read()

    args = {"user_id": "S-1-0-01-0000000000-0000000000-000000000-0001", "include_whitelisted_results": False}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response_when_not_whitelisted")}])
    response = rubrik_sonar_user_access_get_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response_when_not_whitelisted")
    assert response.outputs.get(f"{OUTPUT_PREFIX['USER_ACCESS']}(val.principalId == obj.principalId)") == remove_empty_elements(
        response_data.get("outputs_when_not_whitelisted")
    )
    assert response.readable_output == hr_data


@pytest.mark.parametrize("args, error", [({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("user_id"))])
def test_rubrik_sonar_user_access_get_command_with_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_sonar_user_access_get_command.

    Given:
        -args: Contains arguments for the command.
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_sonar_user_access_get_command

    with pytest.raises(ValueError) as e:
        rubrik_sonar_user_access_get_command(client, args=args)
    assert str(e.value) == error


def test_rubrik_sonar_file_context_list_command_success_with_empty_response(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_file_context_list_command with valid case and empty response.

    When:
        - Calling rubrik_sonar_file_context_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_file_context_list_command

    # Load test data
    response_data = util_load_json("test_data/sonar_file_context_list_response.json")

    args = {"object_id": "1", "snapshot_id": "1", "sort_order": "ASC", "limit": "1", "include_whitelisted_results": True}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("empty_response")}])
    response = rubrik_sonar_file_context_list_command(client, args=args)
    assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("file contexts")


def test_rubrik_sonar_file_context_list_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_file_context_list_command with valid case.

    When:
        - Calling rubrik_sonar_file_context_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_file_context_list_command

    # Load test data
    response_data = util_load_json("test_data/sonar_file_context_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_file_context_list_response_hr.md")) as f:
        hr_data = f.read()

    args = {"object_id": "1", "snapshot_id": "1", "sort_order": "ASC", "limit": "1", "include_whitelisted_results": True}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_sonar_file_context_list_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs.get(f"{OUTPUT_PREFIX['FILE_CONTEXT']}(val.stdPath == obj.stdPath)") == remove_empty_elements(
        response_data.get("outputs")
    )
    assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_FILE_CONTEXT']}(val.name == obj.name)") == remove_empty_elements(
        response_data.get("page_token")
    )
    assert response.readable_output == hr_data


def test_rubrik_sonar_file_context_list_command_success_when_not_whitelisted(client, requests_mock):
    """
    Test case scenario for rubrik_sonar_file_context_list_command when not whitelisting response.

    When:
        - Calling rubrik_sonar_file_context_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sonar_file_context_list_command

    # Load test data
    response_data = util_load_json("test_data/sonar_file_context_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/sonar_file_context_list_response_hr.md")) as f:
        hr_data = f.read()

    args = {
        "object_id": "1",
        "snapshot_id": "1",
        "user_id": "1",
        "next_page_token": "cursor_0",
        "sort_order": "Asc",
        "limit": "1",
        "include_whitelisted_results": False,
    }

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response_when_not_whitelisted")}])
    response = rubrik_sonar_file_context_list_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response_when_not_whitelisted")
    assert response.outputs.get(f"{OUTPUT_PREFIX['FILE_CONTEXT']}(val.stdPath == obj.stdPath)") == remove_empty_elements(
        response_data.get("outputs_when_not_whitelisted")
    )
    assert response.outputs.get(f"{OUTPUT_PREFIX['PAGE_TOKEN_FILE_CONTEXT']}(val.name == obj.name)") == remove_empty_elements(
        response_data.get("page_token")
    )
    assert response.readable_output == hr_data


@pytest.mark.parametrize(
    "args, error",
    [
        ({"limit": "0"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
        ({"object_id": "1", "limit": "0"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        ({"object_id": "1", "snapshot_id": "1", "limit": "0"}, ERROR_MESSAGES["INVALID_LIMIT"].format(0)),
        (
            {"object_id": "1", "snapshot_id": "1", "limit": MAXIMUM_PAGINATION_LIMIT + 1},
            ERROR_MESSAGES["INVALID_LIMIT"].format(MAXIMUM_PAGINATION_LIMIT + 1),
        ),
        ({"object_id": "1", "snapshot_id": "1", "sort_order": "INC"}, ERROR_MESSAGES["INVALID_SORT_ORDER"].format("INC")),
    ],
)
def test_rubrik_sonar_file_context_list_command_with_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_sonar_file_context_list_command.

    Given:
        -args: Contains arguments for the command.
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_sonar_file_context_list_command

    with pytest.raises(ValueError) as e:
        rubrik_sonar_file_context_list_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize(
    "empty_response_type, message",
    [
        ("empty_response", MESSAGES["NO_RECORD_FOUND"].format("snapshot")),
        ("empty_response_cdm_id", MESSAGES["NO_RECORD_FOUND"].format("snapshot")),
        ("empty_response_cluster_id", MESSAGES["NO_RECORD_FOUND"].format("snapshot")),
        ("empty_response_suspicious_file", MESSAGES["NO_RECORDS_FOUND"].format("suspicious files")),
    ],
)
def test_rubrik_radar_suspicious_file_list_command_success_with_empty_response(
    client, requests_mock, empty_response_type, message
):
    """
    Test case scenario for rubrik_radar_suspicious_file_list_command with valid case and empty response.

    When:
        - Calling rubrik_radar_suspicious_file_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_radar_suspicious_file_list_command

    # Load test data
    response_data = util_load_json("test_data/radar_suspicious_file_list_response.json")

    args = {"snapshot_id": "00000000-0000-0000-0000-000000000001"}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get(empty_response_type)}])
    response = rubrik_radar_suspicious_file_list_command(client, args=args)
    assert response.readable_output == message


def test_rubrik_radar_suspicious_file_list_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_radar_suspicious_file_list_command with valid case.

    When:
        - Calling rubrik_radar_suspicious_file_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_radar_suspicious_file_list_command

    # Load test data
    response_data = util_load_json("test_data/radar_suspicious_file_list_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_suspicious_file_list_hr.md")) as f:
        hr_data = f.read()

    args = {"snapshot_id": "00000000-0000-0000-0000-000000000001"}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_radar_suspicious_file_list_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs.get(f"{OUTPUT_PREFIX['SUSPICIOUS_FILE']}(val.id == obj.id)") == remove_empty_elements(
        response_data.get("outputs")
    )
    assert response.readable_output == hr_data


def test_rubrik_radar_suspicious_file_list_command_success_when_no_anomalies(client, requests_mock):
    """
    Test case scenario for rubrik_radar_suspicious_file_list_command when no anomalies detected.

    When:
        - Calling rubrik_radar_suspicious_file_list_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_radar_suspicious_file_list_command

    # Load test data
    response_data = util_load_json("test_data/radar_suspicious_file_list_response.json")
    with open(
        os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_suspicious_file_list_no_anomalies_hr.md")
    ) as f:
        hr_data = f.read()

    args = {"snapshot_id": "00000000-0000-0000-0000-000000000001"}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response_no_anomalies")}])
    response = rubrik_radar_suspicious_file_list_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response_no_anomalies")
    assert response.outputs.get(f"{OUTPUT_PREFIX['SUSPICIOUS_FILE']}(val.id == obj.id)") == remove_empty_elements(
        response_data.get("outputs_when_no_anomalies")
    )
    assert response.readable_output == hr_data


@pytest.mark.parametrize("args, error", [({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id"))])
def test_rubrik_radar_suspicious_file_list_command_with_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_radar_suspicious_file_list_command.

    Given:
        -args: Contains arguments for the command.
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_radar_suspicious_file_list_command

    with pytest.raises(ValueError) as e:
        rubrik_radar_suspicious_file_list_command(client, args=args)
    assert str(e.value) == error


@patch("RubrikPolaris.return_warning")
def test_ip_command_success(mock_return, client, requests_mock, capfd):
    """
    Test case scenario for successful execution of ip_command.

    Given:
       - mocked client.
    When:
       - Calling `ip_command` function.
    Then:
       - Returns CommandResult.
    """
    response = util_load_json("test_data/ip_command_success_response.json")
    output = util_load_json("test_data/ip_command_success_output.json")
    ip_hr = util_load_text_data("test_data/ip_command_success_hr.md")
    ip_indicator = util_load_json("test_data/ip_indicator.json")

    requests_mock.get(
        f"{BASE_URL}/thirdparty/workload_summary?search_string=0.0.0.1&search_type=ipv4", json=response, status_code=200
    )
    requests_mock.get(f"{BASE_URL}/thirdparty/workload_summary?search_string=0.0.0.2&search_type=ipv4", json={}, status_code=200)

    args = {"ip": '0.0.0.1,"  0.0.0.2  ",0.0.0.256'}

    capfd.close()
    from RubrikPolaris import ip_command

    command_output = ip_command(client, args=args)

    assert MESSAGES["IP_NOT_FOUND"].format("0.0.0.2") == mock_return.call_args[0][0]
    assert output == command_output[0].outputs
    assert response == command_output[0].raw_response
    assert ip_hr == command_output[0].readable_output
    assert command_output[0].outputs_key_field == "ip"
    assert OUTPUT_PREFIX["IP"] == command_output[0].outputs_prefix
    assert ip_indicator == command_output[0].indicator.to_context()


def test_ip_command_when_all_ips_invalid(client, capfd):
    """
    Test case scenario for the execution of ip_command with invalid ip addresses.

    Given:
       - mocked client.
    When:
       - Calling `ip_command` function.
    Then:
       - Returns exception.
    """
    from RubrikPolaris import ip_command

    args = {"ip": '0: 0: 85a3: 0000: asv: 8a2e: 0370: 7334, 2.2.2, " a.b.c.d "'}
    capfd.close()
    with pytest.raises(SystemExit) as err:
        ip_command(client, args)

    assert err.value.code == 0


@patch("RubrikPolaris.return_warning")
def test_domain_command_success(mock_return, client, requests_mock, capfd):
    """
    Test case scenario for successful execution of domain_command.

    Given:
       - mocked client.
    When:
       - Calling `domain_command` function.
    Then:
       - Returns CommandResult.
    """
    response = util_load_json("test_data/domain_command_success_response.json")
    output = util_load_json("test_data/domain_command_success_output.json")
    domain_hr = util_load_text_data("test_data/domain_command_success_hr.md")
    domain_indicator = util_load_json("test_data/domain_indicator.json")

    requests_mock.get(
        f"{BASE_URL}/thirdparty/workload_summary?search_string=DEMO-RADAR&search_type=name", json=response, status_code=200
    )
    requests_mock.get(
        f"{BASE_URL}/thirdparty/workload_summary?search_string=DEMO-RADAR02&search_type=name", json={}, status_code=200
    )

    args = {"domain": "DEMO-RADAR, ,DEMO-RADAR02"}

    capfd.close()
    from RubrikPolaris import domain_command

    command_output = domain_command(client, args=args)

    assert MESSAGES["DOMAIN_NOT_FOUND"].format("DEMO-RADAR02") == mock_return.call_args[0][0]
    assert output == command_output[0].outputs
    assert response == command_output[0].raw_response
    assert domain_hr == command_output[0].readable_output
    assert command_output[0].outputs_key_field == "domain"
    assert OUTPUT_PREFIX["DOMAIN"] == command_output[0].outputs_prefix
    assert domain_indicator == command_output[0].indicator.to_context()


def test_rubrik_radar_anomaly_status_update_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_radar_anomaly_status_update_command with valid case.

    When:
        - Calling rubrik_radar_anomaly_status_update_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_radar_anomaly_status_update_command

    # Load test data
    response_data = util_load_json("test_data/radar_anomaly_status_update_response.json")
    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_anomaly_status_update_hr.md")) as f:
        hr_data = f.read()

    args = {
        "workload_id": "00000000-0000-0000-0000-000000000001",
        "anomaly_id": "00000000-0000-0000-0000-000000000001",
        "anomaly_type": "FILESYSTEM",
    }

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_radar_anomaly_status_update_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs == remove_empty_elements(response_data.get("outputs"))
    assert response.readable_output == hr_data
    assert response.outputs_key_field == ["command_name", "anomaly_id", "workload_id"]
    assert response.outputs_prefix == OUTPUT_PREFIX["ANOMALY_UPDATE_STATUS"]


def test_rubrik_radar_anomaly_status_update_command_false_positive_success(client, requests_mock):
    """
    Test case scenario for rubrik_radar_anomaly_status_update_command with false positive valid case.

    When:
        - Calling rubrik_radar_anomaly_status_update_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_radar_anomaly_status_update_command

    # Load test data
    response_data = util_load_json(
        os.path.join(
            os.path.dirname(os.path.realpath(__file__)), "test_data/radar_anomaly_status_update_false_positive_response.json"
        )
    )
    with open(
        os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_anomaly_status_update_false_positive_hr.md")
    ) as f:
        hr_data = f.read()

    args = {
        "workload_id": "00000000-0000-0000-0000-000000000001",
        "anomaly_id": "00000000-0000-0000-0000-000000000001",
        "anomaly_type": "FILESYSTEM",
        "false_positive_type": "other",
        "false_positive_reason": "test reason",
    }

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_radar_anomaly_status_update_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs == remove_empty_elements(response_data.get("outputs"))
    assert response.readable_output == hr_data
    assert response.outputs_key_field == ["command_name", "anomaly_id", "workload_id"]
    assert response.outputs_prefix == OUTPUT_PREFIX["ANOMALY_UPDATE_STATUS"]


@pytest.mark.parametrize(
    "args, error",
    [
        ({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("anomaly_type")),
        ({"anomaly_type": "filesystem"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("workload_id")),
        (
            {"anomaly_type": "filesystem", "workload_id": "00000000-0000-0000-0000-000000000001"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("anomaly_id"),
        ),
        (
            {
                "anomaly_type": "filesystem",
                "workload_id": "00000000-0000-0000-0000-000000000001",
                "anomaly_id": "00000000-0000-0000-0000-000000000001",
                "false_positive_type": "other",
            },
            ERROR_MESSAGES["FALSE_POSITIVE_TYPE_ERROR"].format("false_positive_reason", "false_positive_type"),
        ),
        (
            {
                "anomaly_type": "filesystem",
                "workload_id": "00000000-0000-0000-0000-000000000001",
                "anomaly_id": "00000000-0000-0000-0000-000000000001",
                "false_positive_reason": "test reason",
            },
            ERROR_MESSAGES["FALSE_POSITIVE_REASON_ERROR"].format("false_positive_type", "false_positive_reason"),
        ),
        (
            {
                "anomaly_type": "anomaly",
                "workload_id": "00000000-0000-0000-0000-000000000001",
                "anomaly_id": "00000000-0000-0000-0000-000000000001",
                "false_positive_type": "other",
            },
            ERROR_MESSAGES["INVALID_SELECT"].format("anomaly", "anomaly_type", ANOMALY_TYPE_ENUM),
        ),
        (
            {
                "anomaly_type": "filesystem",
                "workload_id": "00000000-0000-0000-0000-000000000001",
                "anomaly_id": "00000000-0000-0000-0000-000000000001",
                "false_positive_reason": "test reason",
                "false_positive_type": "other_type",
            },
            ERROR_MESSAGES["INVALID_SELECT"].format("other_type", "false_positive_type", FALSE_POSITIVE_TYPE_ENUM),
        ),
    ],
)
def test_rubrik_radar_anomaly_status_update_command_with_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_radar_anomaly_status_update_command.

    Given:
        -args: Contains arguments for the command.
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_radar_anomaly_status_update_command

    with pytest.raises(ValueError) as e:
        rubrik_radar_anomaly_status_update_command(client, args=args)
    assert str(e.value) == error


def test_threat_monitoring_matched_object_list_command_success_when_empty_response(client, requests_mock):
    """Tests success when empty response is received for rubrik-threat-monitoring-matched-object-list command."""
    from RubrikPolaris import rubrik_threat_monitoring_matched_object_list_command

    threat_monitoring_empty_response = util_load_json("test_data/threat_monitoring_list_empty_response.json")

    args = {"start_time": "3 days"}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": threat_monitoring_empty_response}])
    response = rubrik_threat_monitoring_matched_object_list_command(client, args=args)
    assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("threat monitoring objects")


def test_threat_monitoring_matched_object_list_command_success(client, requests_mock):
    """Tests success for rubrik-threat-monitoring-matched-object-list command."""
    from RubrikPolaris import rubrik_threat_monitoring_matched_object_list_command

    threat_monitoring_response = util_load_json("test_data/threat_monitoring_list_response.json")

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/threat_monitoring_list_response_hr.md")) as f:
        threat_monitoring_response_hr = f.read()

    args = {"start_time": "3 days"}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": threat_monitoring_response.get("raw_response")}])
    response = rubrik_threat_monitoring_matched_object_list_command(client, args=args)

    assert response.raw_response == threat_monitoring_response.get("raw_response")
    assert response.outputs == remove_empty_elements(threat_monitoring_response.get("outputs"))
    assert response.readable_output == threat_monitoring_response_hr


@pytest.mark.parametrize(
    "args, exception, error",
    [
        ({"start_time": " "}, ValueError, '" " is not a valid date'),
        ({"start_time": "3 days", "limit": "-1"}, ValueError, ERROR_MESSAGES["INVALID_LIMIT"].format(-1)),
        ({"start_time": "3 days", "limit": "1001"}, ValueError, ERROR_MESSAGES["INVALID_LIMIT"].format(1001)),
    ],
)
def test_threat_monitoring_matched_object_list_command_when_arguments_failure(client, args, exception, error):
    """Tests failure for rubrik-threat-monitoring-matched-object-list command."""
    from RubrikPolaris import rubrik_threat_monitoring_matched_object_list_command

    with pytest.raises(exception) as e:
        rubrik_threat_monitoring_matched_object_list_command(client, args)

    assert str(e.value) == error


def test_threat_monitoring_matched_object_get_command_success_when_empty_response(client, requests_mock):
    """Tests success when empty response is received for rubrik-threat-monitoring-matched-object-get command."""
    from RubrikPolaris import rubrik_threat_monitoring_matched_object_get_command

    threat_monitoring_get_empty_response = {"data": None}

    args = {"object_id": "00000000-0000-0000-0000-000000000001"}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": threat_monitoring_get_empty_response}])
    response = rubrik_threat_monitoring_matched_object_get_command(client, args=args)
    assert response.readable_output == MESSAGES["NO_RECORD_FOUND"].format("threat monitoring object")


def test_threat_monitoring_matched_object_get_command_success(client, requests_mock):
    """Tests success for rubrik-threat-monitoring-matched-object-get command."""
    from RubrikPolaris import OUTPUT_PREFIX, rubrik_threat_monitoring_matched_object_get_command

    threat_monitoring_get_response = util_load_json("test_data/threat_monitoring_get_response.json")

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/threat_monitoring_get_hr.md")) as f:
        threat_monitoring_get_hr = f.read()

    args = {"object_id": "00000000-0000-0000-0000-000000000001"}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": threat_monitoring_get_response.get("raw_response")}])
    response = rubrik_threat_monitoring_matched_object_get_command(client, args=args)

    assert response.raw_response == threat_monitoring_get_response.get("raw_response")
    assert response.outputs == remove_empty_elements(threat_monitoring_get_response.get("outputs"))
    assert response.readable_output == threat_monitoring_get_hr
    assert response.outputs_prefix == OUTPUT_PREFIX["THREAT_MONITORING"]
    assert response.outputs_key_field == "id"


def test_threat_monitoring_matched_object_get_command_when_arguments_failure(client):
    """Tests failure for rubrik-threat-monitoring-matched-object-get command."""
    from RubrikPolaris import rubrik_threat_monitoring_matched_object_get_command

    args = {"object_id": " "}
    with pytest.raises(ValueError) as e:
        rubrik_threat_monitoring_matched_object_get_command(client, args)

    assert str(e.value) == ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")


def test_test_module_when_fetch_is_false(client, requests_mock):
    """Tests failure for rubrik-threat-monitoring-matched-object-list command."""
    from RubrikPolaris import test_module

    response = {"data": {"deploymentVersion": "v000001-01"}}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response}])

    response = test_module(client, {"isFetch": False})

    assert response == "ok"


def test_threat_monitoring_matched_file_list_command_success_when_empty_response(client, requests_mock):
    """Tests success when empty response is received for rubrik-threat-monitoring-matched-file-list command."""
    from RubrikPolaris import rubrik_threat_monitoring_matched_file_list_command

    file_list_empty_response = util_load_json("test_data/threat_monitoring_file_list_empty_response.json")

    args = {"object_id": "dummy-object-id"}

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": file_list_empty_response}])
    response = rubrik_threat_monitoring_matched_file_list_command(client, args=args)
    assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("threat monitoring files")


def test_threat_monitoring_matched_file_list_command_success(client, requests_mock):
    """Tests success for rubrik-threat-monitoring-matched-file-list command."""
    from RubrikPolaris import rubrik_threat_monitoring_matched_file_list_command

    file_list_response = util_load_json("test_data/threat_monitoring_file_list_response.json")

    with open(
        os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/threat_monitoring_file_list_response_hr.md")
    ) as f:
        file_list_response_hr = f.read()

    args = {"object_id": "dummy-object-id"}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": file_list_response.get("raw_response")}])
    response = rubrik_threat_monitoring_matched_file_list_command(client, args=args)

    assert response.raw_response == file_list_response.get("raw_response")
    assert response.outputs == remove_empty_elements(file_list_response.get("outputs"))
    assert response.readable_output == file_list_response_hr


@pytest.mark.parametrize(
    "args, exception, error",
    [
        ({"object_id": " "}, ValueError, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
        ({"object_id": "test-id", "limit": "-1"}, ValueError, ERROR_MESSAGES["INVALID_LIMIT"].format(-1)),
        ({"object_id": "test-id", "limit": "1001"}, ValueError, ERROR_MESSAGES["INVALID_LIMIT"].format(1001)),
    ],
)
def test_threat_monitoring_matched_file_list_command_when_arguments_failure(client, args, exception, error):
    """Tests failure for rubrik-threat-monitoring-matched-file-list command."""
    from RubrikPolaris import rubrik_threat_monitoring_matched_file_list_command

    with pytest.raises(exception) as e:
        rubrik_threat_monitoring_matched_file_list_command(client, args)

    assert str(e.value) == error


@pytest.mark.parametrize(
    "args, exception, error",
    [
        (
            {"matched_snapshot_id": "", "file_path": "test/path"},
            ValueError,
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("matched_snapshot_id"),
        ),
        (
            {"matched_snapshot_id": "test-id", "file_path": ""},
            ValueError,
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("file_path"),
        ),
        (
            {"matched_snapshot_id": " ", "file_path": "test/path"},
            ValueError,
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("matched_snapshot_id"),
        ),
        (
            {"matched_snapshot_id": "test-id", "file_path": " "},
            ValueError,
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("file_path"),
        ),
        (
            {"matched_snapshot_id": "", "file_path": ""},
            ValueError,
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("matched_snapshot_id", "file_path"),
        ),
    ],
)
def test_threat_monitoring_matched_file_get_when_invalid_arguments(client, args, exception, error):
    """
    Tests invalid arguments for rubrik-threat-monitoring-matched-file-get.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_threat_monitoring_matched_file_get_command

    with pytest.raises(exception) as e:
        rubrik_threat_monitoring_matched_file_get_command(client, args)
    assert str(e.value) == error


def test_threat_monitoring_matched_file_get_when_empty_response(client, requests_mock):
    """
    Test case scenario for successful execution of rubrik-threat-monitoring-matched-file-get command with an empty response.

    When:
        -calling rubrik-threat-monitoring-matched-file-get command
    Then:
        -Verifies mock response with empty message obtained in HR
    """
    from RubrikPolaris import rubrik_threat_monitoring_matched_file_get_command

    args = {"matched_snapshot_id": "test-id", "file_path": "/dummy/path/file1.txt"}
    mock_response = {"data": None}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": mock_response}])

    result = rubrik_threat_monitoring_matched_file_get_command(client, args)

    assert result.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("matched file details")
    assert result.raw_response == mock_response


def test_threat_monitoring_matched_file_get_success(client, requests_mock):
    """
    Test case scenario for successful execution of rubrik-threat-monitoring-matched-file-get command with a valid response.

    When:
        -calling rubrik-threat-monitoring-matched-file-get command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_threat_monitoring_matched_file_get_command

    args = {"matched_snapshot_id": "test-id", "file_path": "/dummy/path/file1.txt"}

    mock_response = util_load_json("test_data/threat_monitoring_file_get_response.json")

    with open(
        os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/threat_monitoring_file_get_response_hr.md")
    ) as f:
        hr = f.read()

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": mock_response.get("raw_response")}])

    result = rubrik_threat_monitoring_matched_file_get_command(client, args)

    assert result.outputs_prefix == OUTPUT_PREFIX["THREAT_MONITORING_FILE"]
    assert result.outputs_key_field == ["fileName", "filePath"]
    assert result.raw_response == mock_response.get("raw_response")
    assert result.readable_output == hr
    assert result.outputs == remove_empty_elements(mock_response.get("outputs"))


def test_fetch_incidents_with_threat_monitoring_only(client, requests_mock):
    """
    Test fetch_incidents function when rsc_fetch_types is set to "Threat Monitoring Object"
    """
    from RubrikPolaris import fetch_incidents

    # Mock the threat monitoring response
    threat_monitoring_response = util_load_json("test_data/fetch_threat_monitoring_objects_response.json")
    threat_monitoring_incidents = util_load_json(
        os.path.join(
            os.path.dirname(os.path.realpath(__file__)), "test_data/fetch_events_and_threat_monitoring_objects_incidents.json"
        )
    )
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": threat_monitoring_response}])

    first_fetch = "2025-07-01T14:55:51.616000Z"
    params = {"rsc_fetch_types": "Threat Monitoring Object", "first_fetch": first_fetch}

    expected_next_run = {
        "threat_monitoring": {
            "last_fetch": first_fetch,
            "already_fetched": ["dummy-fid-789012"],
            "object_type_filter": [],
            "match_type_filter": [],
            "next_page_token": "dummy-end-cursor",
        }
    }

    next_run, incidents = fetch_incidents(client, {}, params)

    assert next_run == expected_next_run
    assert incidents == [threat_monitoring_incidents[0]]


def test_fetch_incidents_with_threat_monitoring_with_last_run(client, requests_mock):
    """
    Test fetch_incidents function when rsc_fetch_types is set to "Threat Monitoring Object"
    """
    from RubrikPolaris import fetch_incidents

    # Mock the threat monitoring response
    threat_monitoring_response = util_load_json("test_data/fetch_threat_monitoring_objects_response.json")
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": threat_monitoring_response}])

    first_fetch = "2025-07-01T14:55:51.616000Z"
    params = {"rsc_fetch_types": "Threat Monitoring Object", "first_fetch": first_fetch}

    expected_next_run = {
        "threat_monitoring": {
            "last_fetch": first_fetch,
            "already_fetched": ["dummy-fid-789012"],
            "object_type_filter": [],
            "match_type_filter": [],
            "next_page_token": "dummy-end-cursor",
        }
    }

    last_run = {
        "threat_monitoring": {
            "already_fetched": ["dummy-fid-789012"],
        }
    }

    next_run, incidents = fetch_incidents(client, last_run, params)

    assert next_run == expected_next_run
    assert incidents == []


def test_fetch_incidents_with_both_types(client, requests_mock):
    """Test fetch_incidents function when rsc_fetch_types is set to ["Threat Monitoring Object", "Event"]"""
    from RubrikPolaris import fetch_incidents

    # Load test data
    threat_monitoring_response = util_load_json("test_data/fetch_threat_monitoring_objects_response.json")
    event_response = util_load_json("test_data/fetch_incidents_success_response.json")
    expected_incidents = util_load_json(
        os.path.join(
            os.path.dirname(os.path.realpath(__file__)), "test_data/fetch_events_and_threat_monitoring_objects_incidents.json"
        )
    )

    # Set up mock responses
    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": threat_monitoring_response},
        {"json": enum_values.get("activity_type_enum")},
        {"json": enum_values.get("event_sort_by_enum")},
        {"json": enum_values.get("event_sort_order_enum")},
        {"json": event_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    first_fetch = "2025-07-01T14:55:51.616000Z"
    params = {"first_fetch": f"{first_fetch}", "max_fetch": 2, "rsc_fetch_types": ["Threat Monitoring Object", "Event"]}

    last_run, incidents = fetch_incidents(client, {}, params)

    expected_next_run = {
        "last_fetch": first_fetch,
        "next_page_token": "dummy-end-cursor-1",
        "threat_monitoring": {
            "last_fetch": first_fetch,
            "already_fetched": ["dummy-fid-789012"],
            "object_type_filter": [],
            "match_type_filter": [],
            "next_page_token": "dummy-end-cursor",
        },
    }

    assert last_run == expected_next_run
    assert incidents == expected_incidents


@pytest.mark.parametrize(
    "rsc_fetch_types, expected_error_message",
    [
        (["InvalidType"], MESSAGES["INVALID_FETCH_TYPE"]),
        ([""], MESSAGES["INVALID_FETCH_TYPE"]),
        (["   "], MESSAGES["INVALID_FETCH_TYPE"]),
    ],
)
def test_fetch_incidents_with_invalid_fetch_types(client, rsc_fetch_types, expected_error_message):
    """Test fetch_incidents function with various invalid rsc_fetch_types configurations."""
    from RubrikPolaris import fetch_incidents

    first_fetch = "2025-07-01T14:55:51.616000Z"
    params = {"first_fetch": first_fetch, "max_fetch": 2, "rsc_fetch_types": rsc_fetch_types}

    with pytest.raises(ValueError) as e:
        fetch_incidents(client, {}, params)

    assert str(e.value) == expected_error_message


@pytest.mark.parametrize(
    "max_fetch_value, expected_error_message",
    [
        (0, ERROR_MESSAGES["INVALID_MAX_FETCH"]),
        ("not_an_integer", 'Invalid number: "Fetch Limit"="not_an_integer"'),
        (None, ERROR_MESSAGES["INVALID_MAX_FETCH"]),
        ("", ERROR_MESSAGES["INVALID_MAX_FETCH"]),
        ("   ", 'Invalid number: "Fetch Limit"="   "'),
        (-1, ERROR_MESSAGES["INVALID_MAX_FETCH"]),
        (1001, ERROR_MESSAGES["INVALID_MAX_FETCH"]),
    ],
)
def test_fetch_incidents_with_invalid_max_fetch(client, max_fetch_value, expected_error_message):
    """Test fetch_incidents function with various invalid max_fetch values."""
    from RubrikPolaris import fetch_incidents

    first_fetch = "2025-07-01T14:55:51.616000Z"
    params = {"first_fetch": first_fetch, "max_fetch": max_fetch_value, "rsc_fetch_types": ["threat monitoring object"]}

    with pytest.raises(ValueError) as e:
        fetch_incidents(client, {}, params)

    assert str(e.value) == expected_error_message


@pytest.mark.parametrize(
    "first_fetch_value, expected_error_message",
    [
        ("invalid_date_format", 'Invalid date: "First fetch time"="invalid_date_format"'),
        ("", 'Invalid date: "First fetch time"=""'),
        ("   ", 'Invalid date: "First fetch time"="   "'),
    ],
)
def test_fetch_incidents_with_invalid_first_fetch(client, first_fetch_value, expected_error_message):
    """Test fetch_incidents function with invalid first_fetch values."""
    from RubrikPolaris import fetch_incidents

    params = {"first_fetch": first_fetch_value, "max_fetch": 2, "rsc_fetch_types": ["Threat Monitoring Object"]}

    with pytest.raises(ValueError) as e:
        fetch_incidents(client, {}, params)

    assert str(e.value) == expected_error_message


def test_rubrik_ioc_scan_list_v2_command_success_when_empty_response(client, requests_mock):
    """Tests success when empty response is received for rubrik-ioc-scan-list-v2 command."""
    from RubrikPolaris import rubrik_ioc_scan_list_v2_command

    ioc_scan_empty_response = util_load_json("test_data/ioc_scan_list_v2_empty_response.json")

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": ioc_scan_empty_response.get("raw_response")}])
    response = rubrik_ioc_scan_list_v2_command(client, {})
    assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("ioc scans")
    assert response.raw_response == ioc_scan_empty_response.get("raw_response")
    assert response.outputs == remove_empty_elements(ioc_scan_empty_response.get("outputs"))


def test_rubrik_ioc_scan_list_v2_command_success(client, requests_mock):
    """Tests success for rubrik-ioc-scan-list-v2 command."""
    from RubrikPolaris import rubrik_ioc_scan_list_v2_command

    ioc_scan_response = util_load_json("test_data/ioc_scan_list_v2_response.json")

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/ioc_scan_list_v2_response_hr.md")) as f:
        ioc_scan_response_hr = f.read()

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": ioc_scan_response.get("raw_response")}])
    response = rubrik_ioc_scan_list_v2_command(client, {})

    assert response.raw_response == ioc_scan_response.get("raw_response")
    assert response.outputs == remove_empty_elements(ioc_scan_response.get("outputs"))
    assert response.readable_output == ioc_scan_response_hr


@pytest.mark.parametrize(
    "args, exception, error",
    [
        ({"start_time": " "}, ValueError, '" " is not a valid date'),
        ({"start_time": "3 days", "limit": "-1"}, ValueError, ERROR_MESSAGES["INVALID_LIMIT"].format(-1)),
        ({"start_time": "3 days", "limit": "1001"}, ValueError, ERROR_MESSAGES["INVALID_LIMIT"].format(1001)),
        (
            {"start_time": "3 days", "ioc_match": ["INVALID_MATCH"]},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_MATCH", "ioc_match", IOC_MATCHES),
        ),
        (
            {"start_time": "3 days", "quarantine_status": ["INVALID_STATUS"]},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_STATUS", "quarantine_status", QUERANTINE_STATUS),
        ),
        (
            {"start_time": "3 days", "hunt_status": ["INVALID_STATUS"]},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_STATUS", "hunt_status", HUNT_STATUSES),
        ),
    ],
)
def test_rubrik_ioc_scan_list_v2_command_when_arguments_failure(client, args, exception, error):
    """Tests failure for rubrik-ioc-scan-list-v2 command."""
    from RubrikPolaris import rubrik_ioc_scan_list_v2_command

    with pytest.raises(exception) as e:
        rubrik_ioc_scan_list_v2_command(client, args)

    assert str(e.value) == error


def test_rubrik_ioc_scan_results_v2_when_invalid_arguments(client):
    """
    Tests invalid arguments for rubrik-ioc-scan-results-v2.

    Given:
        -args: contains arguments for the command
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_ioc_scan_results_v2_command

    with pytest.raises(ValueError) as e:
        rubrik_ioc_scan_results_v2_command(client, args={"hunt_id": ""})
    assert str(e.value) == ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("hunt_id")


def test_rubrik_ioc_scan_results_v2_when_empty_response(client, requests_mock):
    """
    Test case scenario for successful execution of rubrik-ioc-scan-results-v2 command with an empty response.

    When:
        -calling rubrik-ioc-scan-results-v2 command
    Then:
        -Verifies mock response with empty message obtained in HR
    """
    from RubrikPolaris import rubrik_ioc_scan_results_v2_command

    args = {"hunt_id": "test-hunt-id"}
    mock_response = {"data": None}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": mock_response}])

    result = rubrik_ioc_scan_results_v2_command(client, args)

    assert result.readable_output == MESSAGES["NO_RECORD_FOUND"].format("ioc scan result")
    assert result.raw_response == mock_response


def test_rubrik_ioc_scan_results_v2_success(client, requests_mock):
    """
    Test case scenario for successful execution of rubrik-ioc-scan-results-v2 command with a valid response.

    When:
        -calling rubrik-ioc-scan-results-v2 command
    Then:
        -Verifies mock response with actual response
    """
    from RubrikPolaris import rubrik_ioc_scan_results_v2_command

    args = {"hunt_id": "test-hunt-id"}

    mock_response = util_load_json("test_data/ioc_scan_results_v2_response.json")

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/ioc_scan_results_v2_response_hr.md")) as f:
        hr = f.read()

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": mock_response.get("raw_response")}])

    result = rubrik_ioc_scan_results_v2_command(client, args)

    assert result.outputs_prefix == OUTPUT_PREFIX["IOC_SCAN"]
    assert result.outputs_key_field == "hunt_id"
    assert result.raw_response == mock_response.get("raw_response")
    assert result.readable_output == hr
    assert result.outputs == mock_response.get("outputs")


def test_turbo_ioc_scan_command_success(client, requests_mock):
    """Tests success for rubrik-turbo-ioc-scan command."""
    from RubrikPolaris import rubrik_turbo_ioc_scan_command

    turbo_ioc_scan_response = util_load_json("test_data/turbo_ioc_scan_response.json")

    args = {
        "ioc": "hash123",
        "cluster_id": ["cluster1", "cluster2"],
        "start_time": "2025-07-24T10:48:41Z",
        "end_time": "2025-07-24T11:48:41Z",
        "max_snapshots_per_object": 10,
    }

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": turbo_ioc_scan_response.get("raw_response")}])
    response = rubrik_turbo_ioc_scan_command(client, args=args)

    assert response.raw_response == turbo_ioc_scan_response.get("raw_response")
    assert response.outputs == remove_empty_elements(turbo_ioc_scan_response.get("outputs"))
    assert response.readable_output == "#### The new Turbo Threat Hunt started with ID: 000000000-0000-0000-0000-000000001"


def test_turbo_ioc_scan_command_when_missing_ioc(client):
    """Tests failure for rubrik-turbo-ioc-scan command when IOC is missing."""
    from RubrikPolaris import rubrik_turbo_ioc_scan_command

    args = {"cluster_id": ["cluster1", "cluster2"]}

    with pytest.raises(ValueError) as e:
        rubrik_turbo_ioc_scan_command(client, args)

    assert str(e.value) == ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("ioc")


def test_turbo_ioc_scan_command_when_invalid_max_snapshots(client):
    """Tests failure for rubrik-turbo-ioc-scan command when invalid max snapshots value is provided."""
    from RubrikPolaris import rubrik_turbo_ioc_scan_command

    args = {"ioc": "hash123", "max_snapshots_per_object": 0}

    with pytest.raises(ValueError) as e:
        rubrik_turbo_ioc_scan_command(client, args)

    assert str(e.value) == ERROR_MESSAGES["NEGATIVE_ARG_VALUE"].format(0, "max_snapshots_per_object")


def test_rubrik_advance_ioc_scan_command_when_invalid_arguments(client):
    """
    Tests invalid arguments for rubrik-advance-ioc-scan.

    Given:
        - args: missing required object_id
    When:
        - Calling the command
    Then:
        - Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_advance_ioc_scan_command

    with pytest.raises(ValueError) as e:
        rubrik_advance_ioc_scan_command(client, args={"object_id": ""})
    assert str(e.value) == ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")


def test_rubrik_advance_ioc_scan_command_success(client, requests_mock):
    """
    Test case scenario for successful execution of rubrik-advance-ioc-scan command.

    When:
        - Calling command with valid response
    Then:
        - Verifies outputs and HR
    """
    args = {"object_id": "obj-123", "ioc_type": "INDICATOR_OF_COMPROMISE_TYPE_HASH", "ioc_value": "deadbeef"}
    from RubrikPolaris import rubrik_advance_ioc_scan_command

    mock_response = util_load_json("test_data/advance_ioc_scan_response.json")

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": mock_response.get("raw_response")}])

    result = rubrik_advance_ioc_scan_command(client, args)

    assert result.outputs_prefix == OUTPUT_PREFIX["ADVANCE_IOC_SCAN"]
    assert result.outputs_key_field == "huntId"
    assert result.raw_response == mock_response.get("raw_response")
    assert result.outputs == mock_response.get("outputs")
    assert result.readable_output == "#### The new advance Threat Hunt started with ID: hunt-abc."


def test_rubrik_advance_ioc_scan_invalid_ioc_type(client):
    """
    Should raise ValueError if ioc_type is not valid.
    """
    from RubrikPolaris import rubrik_advance_ioc_scan_command

    args = {"object_id": "obj-123", "ioc_type": "INVALID_TYPE", "ioc_value": "deadbeef"}
    with pytest.raises(ValueError) as e:
        rubrik_advance_ioc_scan_command(client, args)
    assert str(e.value) == ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_TYPE", "ioc_type", IOC_TYPE_ENUM)


def test_rubrik_advance_ioc_scan_no_indicator_specified(client):
    """
    Should raise ValueError if neither ioc_type/ioc_value nor advance_ioc is provided.
    """
    from RubrikPolaris import rubrik_advance_ioc_scan_command

    args = {"object_id": "obj-123"}
    with pytest.raises(ValueError) as e:
        rubrik_advance_ioc_scan_command(client, args)
    assert str(e.value) == ERROR_MESSAGES["NO_INDICATOR_SPECIFIED"]


@pytest.mark.parametrize(
    "arg_name,arg_value",
    [
        ("max_matches_per_snapshot", 0),
        ("max_snapshots_per_object", 0),
        ("min_file_size", 0),
        ("max_file_size", 0),
        ("max_matches_per_snapshot", -5),
        ("max_snapshots_per_object", -3),
        ("min_file_size", -1),
        ("max_file_size", -10),
    ],
)
def test_rubrik_advance_ioc_scan_negative_numeric_args(client, arg_name, arg_value):
    """
    Should raise ValueError if any numeric argument is less than 1.
    """
    from RubrikPolaris import rubrik_advance_ioc_scan_command

    args = {"object_id": "obj-123", "ioc_type": list(IOC_TYPE_ENUM)[0], "ioc_value": "deadbeef", arg_name: arg_value}
    with pytest.raises(ValueError) as e:
        rubrik_advance_ioc_scan_command(client, args)
    assert str(e.value) == ERROR_MESSAGES["NEGATIVE_ARG_VALUE"].format(arg_value, arg_name)


@pytest.mark.parametrize(
    "arg_name,arg_value,max_value",
    [
        ("max_matches_per_snapshot", 2**31, MAX_INT_VALUE),
        ("max_snapshots_per_object", 2**31, MAX_INT_VALUE),
        ("min_file_size", 2**63, MAX_LONG_VALUE),
        ("max_file_size", 2**63, MAX_LONG_VALUE),
    ],
)
def test_rubrik_advance_ioc_scan_invalid_numeric_args(client, arg_name, arg_value, max_value):
    """
    Should raise ValueError if any numeric argument is more than max value.
    """
    from RubrikPolaris import rubrik_advance_ioc_scan_command

    args = {"object_id": "obj-123", "ioc_type": list(IOC_TYPE_ENUM)[0], "ioc_value": "deadbeef", arg_name: arg_value}
    with pytest.raises(ValueError) as e:
        rubrik_advance_ioc_scan_command(client, args)
    assert str(e.value) == ERROR_MESSAGES["INVALID_INT_VALUE"].format(arg_value, arg_name, max_value)


def test_rubrik_advance_ioc_scan_invalid_advance_ioc_json(client):
    """
    Should raise ValueError if advance_ioc is not valid JSON.
    """
    from RubrikPolaris import rubrik_advance_ioc_scan_command

    args = {"object_id": "obj-123", "advance_ioc": "{not: valid, json}"}
    with pytest.raises(ValueError) as e:
        rubrik_advance_ioc_scan_command(client, args)
    assert str(e.value) == ERROR_MESSAGES["JSON_DECODE"].format("advance_ioc")


def test_fetch_incidents_success_with_event_severity_filter_without_last_run(client, requests_mock):
    """Test fetch_incidents function to return incidents and new last run with provided empty last run."""
    from RubrikPolaris import fetch_incidents

    fetch_response = util_load_json("test_data/fetch_incidents_success_response.json")
    fetch_response["data"]["activitySeriesConnection"]["edges"][0]["node"]["severity"] = "Info"
    incidents = util_load_json("test_data/fetch_incidents_success_incidents.json")

    enum_values = util_load_json(os.path.join(os.path.dirname(os.path.realpath(__file__)), enum_values_file_path))
    responses = [
        {"json": enum_values.get("activity_type_enum")},
        {"json": enum_values.get("event_sort_by_enum")},
        {"json": enum_values.get("event_sort_order_enum")},
        {"json": fetch_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    fetch_incidents_last_run, fetch_incidents_incidents = fetch_incidents(
        client,
        {},
        {
            "first_fetch": f"{first_fetch}",
            "max_fetch": 2,
            "event_types": [DEFAULT_EVENT_TYPES[0]],
            "rsc_fetch_types": "Event",
            "event_severities": ["SEVERITY_INFO"],
        },
    )
    last_run = {
        "last_fetch": f"{last_fetch}",
        "next_page_token": fetch_response["data"]["activitySeriesConnection"]["pageInfo"]["endCursor"],
    }
    assert fetch_incidents_last_run == last_run
    assert fetch_incidents_incidents == incidents


@pytest.mark.parametrize(
    "event_severities, expected_error_message",
    [
        (["Invalid_Severity"], MESSAGES["INVALID_FETCH_EVENT_SEVERITIES"]),
        (["SEVERITY_INFO", "  Invalid_Severity "], MESSAGES["INVALID_FETCH_EVENT_SEVERITIES"]),
    ],
)
def test_fetch_incidents_with_invalid_event_severity_filter(client, event_severities, expected_error_message):
    """Test fetch_incidents function with various invalid event_severities configurations."""
    from RubrikPolaris import fetch_incidents

    first_fetch = "2025-07-01T14:55:51.616000Z"
    params = {"first_fetch": first_fetch, "max_fetch": 2, "rsc_fetch_types": "Event", "event_severities": event_severities}

    with pytest.raises(ValueError) as e:
        fetch_incidents(client, {}, params)

    assert str(e.value) == expected_error_message


@pytest.mark.parametrize("empty_response", [True, False])
def test_rubrik_anomaly_csv_analysis_v2_initial_request_success(client, requests_mock, empty_response):
    """Test initial CSV download request (non-polling) returns success status."""
    from RubrikPolaris import rubrik_anomaly_csv_analysis_v2_command

    radar_anomaly_v2_response = util_load_json("test_data/anomaly_csv_analysis_v2_response.json")

    args = {
        "cluster_id": "cluster-123",
        "snapshot_id": "snapshot-456",
        "object_id": "object-789",
        "polling": False,
    }

    if empty_response:
        response_data = radar_anomaly_v2_response.get("empty_response")
        requests_mock.post(BASE_URL_GRAPHQL, json=response_data)
        result = rubrik_anomaly_csv_analysis_v2_command(client, args)
        assert result[0].readable_output == f"#### {MESSAGES['NO_RESPONSE']}"
    else:
        response_data = radar_anomaly_v2_response.get("initial_request_success", {}).get("raw_response")
        requests_mock.post(BASE_URL_GRAPHQL, json=response_data)
        result = rubrik_anomaly_csv_analysis_v2_command(client, args)

        assert len(result) == 1
        assert result[0].raw_response == radar_anomaly_v2_response.get("initial_request_success", {}).get("raw_response")
        assert result[0].outputs == remove_empty_elements(
            radar_anomaly_v2_response.get("initial_request_success", {}).get("outputs")
        )
        assert result[0].readable_output == "#### Successfully analyzed the CSV file."


def test_rubrik_anomaly_csv_analysis_v2_polling_file_ready(client, requests_mock):
    """Test polling execution when CSV file is ready - should download and return file."""
    from RubrikPolaris import rubrik_anomaly_csv_analysis_v2_command

    radar_anomaly_v2_response = util_load_json("test_data/anomaly_csv_analysis_v2_response.json")

    args = {
        "cluster_id": "cluster-123",
        "snapshot_id": "snapshot-456",
        "object_id": "object-789",
        "polling": True,
    }

    user_files_response = radar_anomaly_v2_response.get("polling_file_ready", {}).get("raw_response")

    with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "test_data/radar_anomaly_csv_analysis_file.csv")) as f:
        file_data = f.read()

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)
    requests_mock.get("https://demo.my.rubrik.com/file-downloads/external-123", text=file_data, status_code=200)

    result = rubrik_anomaly_csv_analysis_v2_command(client, args)

    assert len(result) == 2
    assert result[0].raw_response == radar_anomaly_v2_response.get("polling_file_ready", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(radar_anomaly_v2_response.get("polling_file_ready", {}).get("outputs"))
    assert result[0].readable_output == "#### Successfully downloaded the analyzed CSV file."
    if isinstance(result[1], dict):
        assert result[1].get("File") == "snapshot_snapshot-456.csv"


def test_rubrik_anomaly_csv_analysis_v2_polling_file_not_ready(client, requests_mock):
    """Test polling execution when CSV file is not ready yet - should return polling status."""
    from RubrikPolaris import rubrik_anomaly_csv_analysis_v2_command

    radar_anomaly_v2_response = util_load_json("test_data/anomaly_csv_analysis_v2_response.json")

    args = {
        "cluster_id": "cluster-123",
        "snapshot_id": "snapshot-456",
        "object_id": "object-789",
        "polling": True,
    }

    user_files_response = radar_anomaly_v2_response.get("polling_file_not_ready", {}).get("raw_response")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)

    result = rubrik_anomaly_csv_analysis_v2_command(client, args)

    assert len(result) == 1
    assert result[0].raw_response == radar_anomaly_v2_response.get("polling_file_not_ready", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(radar_anomaly_v2_response.get("polling_file_not_ready", {}).get("outputs"))
    assert result[0].readable_output == "#### Polling for CSV file availability. The command will automatically retry..."


def test_rubrik_anomaly_csv_analysis_v2_polling_file_failed(client, requests_mock):
    """Test polling execution when CSV file status is failed."""
    from RubrikPolaris import rubrik_anomaly_csv_analysis_v2_command

    radar_anomaly_v2_response = util_load_json("test_data/anomaly_csv_analysis_v2_response.json")

    args = {
        "cluster_id": "cluster-123",
        "snapshot_id": "snapshot-456",
        "object_id": "object-789",
        "polling": True,
    }

    user_files_response = radar_anomaly_v2_response.get("polling_file_failed", {}).get("raw_response")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)

    result = rubrik_anomaly_csv_analysis_v2_command(client, args)

    assert len(result) == 1
    assert result[0].raw_response == radar_anomaly_v2_response.get("polling_file_failed", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(radar_anomaly_v2_response.get("polling_file_failed", {}).get("outputs"))
    assert result[0].readable_output == "#### Failed to download the analyzed CSV file."


@pytest.mark.parametrize(
    "args, error_message",
    [
        (
            {"snapshot_id": "snapshot-456", "object_id": "object-789"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("cluster_id"),
        ),
        (
            {"cluster_id": "cluster-123", "object_id": "object-789"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id"),
        ),
        (
            {"cluster_id": "cluster-123", "snapshot_id": "snapshot-456"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id"),
        ),
    ],
)
def test_rubrik_anomaly_csv_analysis_v2_invalid_arguments_are_provided(client, args, error_message):
    """Test that missing required arguments raise ValueError."""
    from RubrikPolaris import rubrik_anomaly_csv_analysis_v2_command

    with pytest.raises(ValueError) as e:
        rubrik_anomaly_csv_analysis_v2_command(client, args)

    assert error_message in str(e.value)


def test_fetch_dspm_violations_success_without_last_run(client, requests_mock):
    """
    Test Case : Success scenario with all filter parameters without last run.
    Tests fetch_dspm_violations function to return incidents and new last run with provided empty last run.
    """
    from RubrikPolaris import fetch_dspm_violations

    fetch_response = util_load_json("test_data/fetch_dspm_violations_success_response.json")
    expected_incidents = util_load_json("test_data/fetch_dspm_violations_incidents.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=fetch_response)

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "dspm_violation_status": ["OPEN"],
        "dspm_violation_severity": ["HIGH", "MEDIUM"],
        "dspm_violation_sensitivity": ["HIGH"],
        "dspm_violation_category": ["MISPLACED"],
    }

    dspm_next_run, incidents = fetch_dspm_violations(client, {}, params, 10)

    # Verify next_run state
    assert "last_fetch" in dspm_next_run
    assert dspm_next_run.get("next_page_token") == "end_cursor"
    assert len(dspm_next_run.get("already_fetched", [])) == 3
    assert "00000000-0000-0000-0000-000000000001" in dspm_next_run.get("already_fetched", [])
    assert "00000000-0000-0000-0000-000000000002" in dspm_next_run.get("already_fetched", [])
    assert "00000000-0000-0000-0000-000000000003" in dspm_next_run.get("already_fetched", [])

    # Verify incidents match expected
    assert incidents == expected_incidents


def test_fetch_dspm_violations_success_with_last_run(client, requests_mock):
    """
    Test Case : Success scenario with last run.
    Tests fetch_dspm_violations function with existing last_run state.
    """
    from RubrikPolaris import fetch_dspm_violations

    fetch_response = util_load_json("test_data/fetch_dspm_violations_success_response.json")
    expected_incidents = util_load_json("test_data/fetch_dspm_violations_incidents.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=fetch_response)

    last_run = {
        "dspm_violation": {
            "last_fetch": last_fetch,
            "next_page_token": "page_cursor",
            "already_fetched": [],
        }
    }

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "dspm_violation_status": ["OPEN"],
        "dspm_violation_severity": ["HIGH"],
        "dspm_violation_sensitivity": ["HIGH"],
        "dspm_violation_category": ["MISPLACED"],
    }

    dspm_next_run, incidents = fetch_dspm_violations(client, last_run, params, 10)

    # Verify next_run state is updated
    assert dspm_next_run.get("last_fetch") == last_fetch
    assert dspm_next_run.get("next_page_token") == "end_cursor"
    assert len(dspm_next_run.get("already_fetched", [])) == 3

    # Verify incidents match expected
    assert incidents == expected_incidents


def test_fetch_dspm_violations_with_duplicates(client, requests_mock):
    """
    Test Case : Success with duplicate scenario.
    Tests that duplicate violations are skipped and logged.
    """
    from RubrikPolaris import fetch_dspm_violations

    fetch_response = util_load_json("test_data/fetch_dspm_violations_success_response.json")
    expected_incidents = util_load_json("test_data/fetch_dspm_violations_incidents.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=fetch_response)

    last_run = {
        "dspm_violation": {
            "last_fetch": last_fetch,
            "already_fetched": ["00000000-0000-0000-0000-000000000001"],  # First violation already fetched
        }
    }

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "dspm_violation_status": ["OPEN"],
        "dspm_violation_severity": ["HIGH", "MEDIUM"],
        "dspm_violation_sensitivity": ["HIGH"],
        "dspm_violation_category": ["MISPLACED"],
    }

    dspm_next_run, incidents = fetch_dspm_violations(client, last_run, params, 10)

    # Verify only two incidents are returned (duplicate skipped)
    assert incidents == expected_incidents[1:]  # Skip first incident (already fetched)

    # Verify already_fetched list contains all three IDs
    already_fetched = dspm_next_run.get("already_fetched", [])
    assert len(already_fetched) == 3
    assert "00000000-0000-0000-0000-000000000001" in already_fetched
    assert "00000000-0000-0000-0000-000000000002" in already_fetched
    assert "00000000-0000-0000-0000-000000000003" in already_fetched


def test_fetch_dspm_violations_empty_response(client, requests_mock):
    """
    Test Case : Success with empty response.
    Tests fetch_dspm_violations function returns empty incidents when no violations found.
    """
    from RubrikPolaris import fetch_dspm_violations

    fetch_response = util_load_json("test_data/fetch_dspm_violations_empty_response.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=fetch_response)

    last_run = {
        "dspm_violation": {
            "last_fetch": last_fetch,
            "next_page_token": "page_cursor",
            "already_fetched": ["00000000-0000-0000-0000-000000000001"],
        }
    }

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "dspm_violation_status": ["OPEN"],
        "dspm_violation_severity": ["HIGH", "MEDIUM"],
        "dspm_violation_sensitivity": ["HIGH"],
        "dspm_violation_category": ["MISPLACED"],
    }

    dspm_next_run, incidents = fetch_dspm_violations(client, last_run, params, 10)

    # Verify empty incidents
    assert len(incidents) == 0
    assert dspm_next_run == last_run["dspm_violation"]


def test_fetch_incidents_with_all_fetch_types(client, requests_mock):
    """
    Test Case : Success scenario with all fetch types in fetch_incidents.
    Tests fetch_incidents function when all four fetch types are selected.
    """
    from RubrikPolaris import fetch_incidents

    # Load test data for all fetch types
    threat_monitoring_response = util_load_json("test_data/fetch_threat_monitoring_objects_response.json")
    event_response = util_load_json("test_data/fetch_incidents_success_response.json")
    dspm_response = util_load_json("test_data/fetch_dspm_violations_success_response.json")
    ir_response = util_load_json("test_data/fetch_ir_violations_success_response.json")
    enum_values = util_load_json("test_data/enum_values.json")

    # Mock responses for all fetch types
    # Order matches execution: Threat Monitoring -> DSPM Violations -> IR Violations -> Events (with 3 enum calls)
    responses = [
        {"json": threat_monitoring_response},  # Threat monitoring first
        {"json": dspm_response},  # DSPM violations second
        {"json": ir_response},  # IR violations third
        {"json": enum_values.get("activity_type_enum")},  # Events enum calls
        {"json": enum_values.get("event_sort_by_enum")},
        {"json": enum_values.get("event_sort_order_enum")},
        {"json": event_response},  # Events last
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 12,
        "rsc_fetch_types": ["Threat Monitoring Object", "DSPM Violation", "IR Violation", "Event"],
    }

    next_run, incidents = fetch_incidents(client, {}, params)

    # Verify incidents
    assert len(incidents) == 12

    # Verify next_run contains state for all fetch types
    assert "threat_monitoring" in next_run
    assert "dspm_violation" in next_run
    assert "ir_violation" in next_run
    assert "last_fetch" in next_run  # Events state

    # Verify DSPM violation state
    assert "last_fetch" in next_run["dspm_violation"]
    assert "already_fetched" in next_run["dspm_violation"]

    # Verify IR violation state
    assert "last_fetch" in next_run["ir_violation"]
    assert "already_fetched" in next_run["ir_violation"]


@pytest.mark.parametrize(
    "invalid_param, invalid_value, expected_error",
    [
        (
            "dspm_violation_status",
            ["INVALID_STATUS"],
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_STATUS", "dspm_violation_status", DSPM_VIOLATION_STATUS),
        ),
        (
            "dspm_violation_severity",
            ["INVALID_SEVERITY"],
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_SEVERITY", "dspm_violation_severity", DSPM_VIOLATION_SEVERITY),
        ),
        (
            "dspm_violation_sensitivity",
            ["INVALID_SENSITIVITY"],
            ERROR_MESSAGES["INVALID_SELECT"].format(
                "INVALID_SENSITIVITY", "dspm_violation_sensitivity", DSPM_VIOLATION_SENSITIVITY
            ),
        ),
        (
            "dspm_violation_status",
            ["OPEN", "INVALID"],
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID", "dspm_violation_status", DSPM_VIOLATION_STATUS),
        ),
        (
            "dspm_violation_severity",
            ["HIGH", "SUPER_HIGH"],
            ERROR_MESSAGES["INVALID_SELECT"].format("SUPER_HIGH", "dspm_violation_severity", DSPM_VIOLATION_SEVERITY),
        ),
    ],
)
def test_fetch_dspm_violations_invalid_filter_parameters(client, invalid_param, invalid_value, expected_error):
    """
    Test Case : Invalid filter parameter with parameterize.
    Tests that invalid filter values raise appropriate ValueError.
    """
    from RubrikPolaris import fetch_dspm_violations

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "dspm_violation_status": ["OPEN"],
        "dspm_violation_severity": ["HIGH"],
        "dspm_violation_sensitivity": ["HIGH"],
        "dspm_violation_category": ["MISPLACED"],
    }

    # Override with invalid parameter
    params[invalid_param] = invalid_value

    with pytest.raises(ValueError) as exc_info:
        fetch_dspm_violations(client, {}, params, 10)

    assert expected_error in str(exc_info.value)


def test_fetch_ir_violations_success_without_last_run(client, requests_mock):
    """
    Test Case : Success scenario with all filter parameters without last run.
    Tests fetch_ir_violations function to return incidents and new last run with provided empty last run.
    """
    from RubrikPolaris import fetch_ir_violations

    fetch_response = util_load_json("test_data/fetch_ir_violations_success_response.json")
    expected_incidents = util_load_json("test_data/fetch_ir_violations_incidents.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=fetch_response)

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "ir_violation_status": ["OPEN", "IN_PROGRESS"],
        "ir_violation_severity": ["HIGH", "CRITICAL"],
        "ir_violation_category": ["IDENTITY_HYGIENE"],
        "ir_violation_policy_type": ["IDENTITY"],
        "ir_violation_identity_provider": ["ENTRA_ID"],
        "ir_violation_identity_tag": ["PRIVILEGED"],
    }

    ir_next_run, incidents = fetch_ir_violations(client, {}, params, 10)

    # Verify next_run state
    already_fetched = ir_next_run.get("already_fetched", [])
    assert "last_fetch" in ir_next_run
    assert ir_next_run.get("next_page_token") == "cursor_5"
    assert len(already_fetched) == 6
    assert "00000000-0000-0000-0000-000000000001" in already_fetched
    assert "00000000-0000-0000-0000-000000000002" in already_fetched
    assert "00000000-0000-0000-0000-000000000003" in already_fetched
    assert "00000000-0000-0000-0000-000000000004" in already_fetched
    assert "00000000-0000-0000-0000-000000000005" in already_fetched
    assert "00000000-0000-0000-0000-000000000006" in already_fetched

    # Verify incidents match expected
    assert incidents == expected_incidents


def test_fetch_ir_violations_success_with_last_run(client, requests_mock):
    """
    Test Case : Success scenario with last run.
    Tests fetch_ir_violations function with existing last_run state.
    """
    from RubrikPolaris import fetch_ir_violations

    fetch_response = util_load_json("test_data/fetch_ir_violations_success_response.json")
    expected_incidents = util_load_json("test_data/fetch_ir_violations_incidents.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=fetch_response)

    last_run = {
        "ir_violation": {
            "last_fetch": last_fetch,
            "next_page_token": "page_cursor",
            "already_fetched": [],
        }
    }

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "ir_violation_status": ["OPEN", "IN_PROGRESS"],
        "ir_violation_severity": ["HIGH", "CRITICAL"],
        "ir_violation_category": ["IDENTITY_HYGIENE"],
        "ir_violation_policy_type": ["IDENTITY"],
        "ir_violation_identity_provider": ["ENTRA_ID"],
        "ir_violation_identity_tag": ["PRIVILEGED"],
    }

    ir_next_run, incidents = fetch_ir_violations(client, last_run, params, 10)

    # Verify next_run state is updated
    assert ir_next_run.get("last_fetch") == last_fetch
    assert ir_next_run.get("next_page_token") == "cursor_5"
    assert len(ir_next_run.get("already_fetched", [])) == 6

    # Verify incidents match expected
    assert incidents == expected_incidents


def test_fetch_ir_violations_with_duplicates(client, requests_mock):
    """
    Test Case : Success with duplicate scenario.
    Tests that duplicate IR violations are skipped and logged.
    """
    from RubrikPolaris import fetch_ir_violations

    fetch_response = util_load_json("test_data/fetch_ir_violations_success_response.json")
    expected_incidents = util_load_json("test_data/fetch_ir_violations_incidents.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=fetch_response)

    last_run = {"ir_violation": {"last_fetch": last_fetch, "already_fetched": ["00000000-0000-0000-0000-000000000001"]}}

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "ir_violation_status": ["OPEN", "IN_PROGRESS"],
        "ir_violation_severity": ["HIGH", "CRITICAL"],
        "ir_violation_category": ["IDENTITY_HYGIENE"],
        "ir_violation_policy_type": ["IDENTITY"],
        "ir_violation_identity_provider": ["ENTRA_ID"],
        "ir_violation_identity_tag": ["PRIVILEGED"],
    }

    ir_next_run, incidents = fetch_ir_violations(client, last_run, params, 10)

    assert incidents == expected_incidents[1:]  # Skip first incident (already fetched)

    already_fetched = ir_next_run.get("already_fetched", [])
    assert len(already_fetched) == 6
    assert "00000000-0000-0000-0000-000000000001" in already_fetched
    assert "00000000-0000-0000-0000-000000000002" in already_fetched
    assert "00000000-0000-0000-0000-000000000003" in already_fetched
    assert "00000000-0000-0000-0000-000000000004" in already_fetched
    assert "00000000-0000-0000-0000-000000000005" in already_fetched
    assert "00000000-0000-0000-0000-000000000006" in already_fetched


def test_fetch_ir_violations_empty_response(client, requests_mock):
    """
    Test Case : Success with empty response.
    Tests fetch_ir_violations function returns empty incidents when no violations found.
    """
    from RubrikPolaris import fetch_ir_violations

    fetch_response = util_load_json("test_data/fetch_ir_violations_empty_response.json")

    requests_mock.post(BASE_URL_GRAPHQL, json=fetch_response)

    last_run = {
        "ir_violation": {
            "last_fetch": last_fetch,
            "next_page_token": "page_cursor",
            "already_fetched": ["00000000-0000-0000-0000-000000000001"],
        }
    }

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "ir_violation_status": ["OPEN", "IN_PROGRESS"],
        "ir_violation_severity": ["HIGH", "CRITICAL"],
        "ir_violation_category": ["IDENTITY_HYGIENE"],
        "ir_violation_policy_type": ["IDENTITY"],
        "ir_violation_identity_provider": ["ENTRA_ID"],
        "ir_violation_identity_tag": ["PRIVILEGED"],
    }

    ir_next_run, incidents = fetch_ir_violations(client, last_run, params, 10)

    # Verify empty incidents
    assert len(incidents) == 0
    assert ir_next_run == last_run["ir_violation"]


@pytest.mark.parametrize(
    "invalid_param, invalid_value, expected_error",
    [
        (
            "ir_violation_status",
            ["INVALID_STATUS"],
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_STATUS", "ir_violation_status", IR_VIOLATION_STATUS),
        ),
        (
            "ir_violation_severity",
            ["INVALID_SEVERITY"],
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_SEVERITY", "ir_violation_severity", IR_VIOLATION_SEVERITY),
        ),
        (
            "ir_violation_policy_type",
            ["INVALID_POLICY_TYPE"],
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_POLICY_TYPE", "ir_violation_policy_type", IR_VIOLATION_POLICY_TYPE),
        ),
        (
            "ir_violation_status",
            ["OPEN", "INVALID"],
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID", "ir_violation_status", IR_VIOLATION_STATUS),
        ),
        (
            "ir_violation_severity",
            ["HIGH", "SUPER_HIGH"],
            ERROR_MESSAGES["INVALID_SELECT"].format("SUPER_HIGH", "ir_violation_severity", IR_VIOLATION_SEVERITY),
        ),
        (
            "ir_violation_policy_type",
            ["IDENTITY", "UNKNOWN_TYPE"],
            ERROR_MESSAGES["INVALID_SELECT"].format("UNKNOWN_TYPE", "ir_violation_policy_type", IR_VIOLATION_POLICY_TYPE),
        ),
        (
            "ir_violation_identity_provider",
            ["ENTRA_ID", "INVALID_IDP"],
            ERROR_MESSAGES["INVALID_SELECT"].format(
                "INVALID_IDP", "ir_violation_identity_provider", IR_VIOLATION_IDENTITY_PROVIDER
            ),
        ),
        (
            "ir_violation_identity_tag",
            ["PRIVILEGED", "INVALID_TAG"],
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_TAG", "ir_violation_identity_tag", IR_VIOLATION_IDENTITY_TAG),
        ),
    ],
)
def test_fetch_ir_violations_invalid_filter_parameters(client, invalid_param, invalid_value, expected_error):
    """
    Test Case : Invalid filter parameter with parameterize.
    Tests that invalid filter values raise appropriate ValueError.
    """
    from RubrikPolaris import fetch_ir_violations

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "ir_violation_status": ["OPEN", "IN_PROGRESS"],
        "ir_violation_severity": ["HIGH"],
        "ir_violation_category": ["IDENTITY_HYGIENE"],
        "ir_violation_policy_type": ["IDENTITY"],
        "ir_violation_identity_provider": ["ENTRA_ID"],
        "ir_violation_identity_tag": ["PRIVILEGED"],
    }

    # Override with invalid parameter
    params[invalid_param] = invalid_value

    with pytest.raises(ValueError) as exc_info:
        fetch_ir_violations(client, {}, params, 10)

    assert expected_error in str(exc_info.value)


def test_data_security_violation_list_command_success(client, requests_mock):
    """Tests success for rubrik-data-security-violation-list command."""
    from RubrikPolaris import rubrik_data_security_violation_list_command

    dspm_response = util_load_json("test_data/dspm_violation_list_response.json")

    dspm_response_hr = util_load_text_data("test_data/dspm_violation_list_response_hr.md")

    args = {"status": "OPEN", "severity": "MEDIUM", "sort_order": "DESC"}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": dspm_response.get("raw_response")}])
    response = rubrik_data_security_violation_list_command(client, args=args)

    assert response.raw_response == dspm_response.get("raw_response")
    assert response.outputs == remove_empty_elements(dspm_response.get("outputs"))
    assert response.readable_output == dspm_response_hr


def test_data_security_violation_list_command_success_when_empty_response(client, requests_mock):
    """Tests success when empty response is received for rubrik-data-security-violation-list command."""
    from RubrikPolaris import rubrik_data_security_violation_list_command

    dspm_empty_response = util_load_json("test_data/dspm_violation_list_empty_response.json")

    args = {}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": dspm_empty_response}])
    response = rubrik_data_security_violation_list_command(client, args=args)
    assert response.readable_output == f"#### {MESSAGES['NO_RECORDS_FOUND'].format('DSPM violations')}"


@pytest.mark.parametrize(
    "args, exception, error",
    [
        (
            {"limit": "0"},
            ValueError,
            ERROR_MESSAGES["INVALID_LIMIT"].format(0),
        ),
        (
            {"limit": "1001"},
            ValueError,
            ERROR_MESSAGES["INVALID_LIMIT"].format(1001),
        ),
        (
            {"sort_order": "INVALID"},
            ValueError,
            ERROR_MESSAGES["INVALID_SORT_ORDER"].format("INVALID"),
        ),
        (
            {"sort_by": "INVALID_FIELD"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_FIELD", "sort_by", DSPM_VIOLATION_SORT_BY),
        ),
        (
            {"status": "INVALID"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID", "status", DSPM_VIOLATION_STATUS),
        ),
        (
            {"severity": "SUPER_HIGH"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("SUPER_HIGH", "severity", DSPM_VIOLATION_SEVERITY),
        ),
        (
            {"sensitivity": "SUPER_SENSITIVE"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("SUPER_SENSITIVE", "sensitivity", DSPM_VIOLATION_SENSITIVITY),
        ),
        (
            {"detection_start_date": "2026-01-01"},
            ValueError,
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("detection_start_date", "detection_end_date"),
        ),
        (
            {"resolved_end_date": "2026-03-01"},
            ValueError,
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("resolved_start_date", "resolved_end_date"),
        ),
        (
            {"detection_start_date": "2026-03-01", "detection_end_date": "2026-01-01"},
            ValueError,
            ERROR_MESSAGES["INVALID_DATE_RANGE"].format("detection_start_date", "detection_end_date"),
        ),
        (
            {"resolved_start_date": "2026-03-01", "resolved_end_date": "2026-01-01"},
            ValueError,
            ERROR_MESSAGES["INVALID_DATE_RANGE"].format("resolved_start_date", "resolved_end_date"),
        ),
    ],
)
def test_data_security_violation_list_command_when_arguments_failure(client, args, exception, error):
    """Tests failure for rubrik-data-security-violation-list command with invalid arguments."""
    from RubrikPolaris import rubrik_data_security_violation_list_command

    with pytest.raises(exception) as e:
        rubrik_data_security_violation_list_command(client, args)

    assert str(e.value) == error


def test_rubrik_data_security_violation_get_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_data_security_violation_get_command with valid case.

    When:
        - Calling rubrik_data_security_violation_get_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_data_security_violation_get_command

    response_data = util_load_json("test_data/dspm_violation_get_response.json")
    hr_data = util_load_text_data("test_data/dspm_violation_get_response_hr.md")

    args = {"violation_id": "00000000-0000-0000-0000-000000000001"}

    requests_mock.post(BASE_URL_GRAPHQL, json=response_data.get("raw_response"))
    response = rubrik_data_security_violation_get_command(client, args=args)

    assert response.outputs == remove_empty_elements(response_data.get("context"))
    assert response.readable_output == hr_data


def test_rubrik_data_security_violation_get_command_empty_response(client, requests_mock):
    """
    Test case scenario for rubrik_data_security_violation_get_command with empty response.

    When:
        - Calling rubrik_data_security_violation_get_command with empty response.
    Then:
        - Verifies that NO_RESPONSE message is returned.
    """
    from RubrikPolaris import rubrik_data_security_violation_get_command

    response_data = {"data": {"policyViolation": {}}}

    args = {"violation_id": "invalid-violation-id"}

    requests_mock.post(BASE_URL_GRAPHQL, json=response_data)
    response = rubrik_data_security_violation_get_command(client, args=args)

    assert response.readable_output == f"#### {MESSAGES['NO_RESPONSE']}"


@pytest.mark.parametrize(
    "args, error",
    [
        ({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("violation_id")),
        ({"violation_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("violation_id")),
    ],
)
def test_rubrik_data_security_violation_get_command_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_data_security_violation_get_command.

    Given:
        - args: Contains arguments for the command.
    When:
        - Invalid value is passed in arguments
    Then:
        - Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_data_security_violation_get_command

    with pytest.raises(ValueError) as e:
        rubrik_data_security_violation_get_command(client, args=args)
    assert str(e.value) == error


def test_rubrik_data_security_violation_status_update_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_data_security_violation_status_update_command with valid case.

    When:
        - Calling rubrik_data_security_violation_status_update_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_data_security_violation_status_update_command

    response_data = util_load_json("test_data/dspm_violation_status_update_response.json")

    hr_data = "#### Successfully updated the DSPM violation status to In Progress"

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "status": "IN_PROGRESS",
    }

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_data_security_violation_status_update_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs == remove_empty_elements(response_data.get("outputs"))
    assert response.readable_output == hr_data
    assert response.outputs_key_field == ["policyViolationId"]
    assert response.outputs_prefix == OUTPUT_PREFIX["DSPM_VIOLATION"]


@pytest.mark.parametrize(
    "args, error",
    [
        ({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("violation_id")),
        ({"violation_id": "00000000-0000-0000-0000-000000000001"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("status")),
        (
            {"violation_id": "00000000-0000-0000-0000-000000000001", "status": "INVALID_STATUS"},
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_STATUS", "status", DSPM_VIOLATION_STATUS),
        ),
    ],
)
def test_rubrik_data_security_violation_status_update_command_with_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_data_security_violation_status_update_command.

    Given:
        -args: Contains arguments for the command.
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_data_security_violation_status_update_command

    with pytest.raises(ValueError) as e:
        rubrik_data_security_violation_status_update_command(client, args=args)
    assert str(e.value) == error


def test_data_security_violation_file_list_command_success(client, requests_mock):
    """Tests success for rubrik-data-security-violation-file-list command."""
    from RubrikPolaris import rubrik_data_security_violation_file_list_command

    response_data = util_load_json("test_data/dspm_violation_file_list_response.json")

    hr_output = util_load_text_data("test_data/dspm_violation_file_list_response_hr.md")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "snapshot_id": "00000000-0000-0000-0000-000000010001",
        "file_name": "fileName.txt",
        "sensitivity": "high,LOW",
        "exposure": "not_OPEN",
        "access_via": "groUP",
        "sort_order": "asc",
    }
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_data_security_violation_file_list_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs == remove_empty_elements(response_data.get("outputs"))
    assert response.readable_output == hr_output


def test_data_security_violation_file_list_command_success_when_empty_response(client, requests_mock):
    """Tests success when empty response is received for rubrik-data-security-violation-file-list command."""
    from RubrikPolaris import rubrik_data_security_violation_file_list_command

    response_data = util_load_json("test_data/dspm_violation_file_list_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "snapshot_id": "00000000-0000-0000-0000-000000010001",
        "file_name": "NotExistFileName.txt",
    }
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("empty_response")}])
    response = rubrik_data_security_violation_file_list_command(client, args=args)

    assert response.readable_output == f"#### {MESSAGES['NO_RECORDS_FOUND'].format('DSPM violation Files')}"


@pytest.mark.parametrize(
    "args, error",
    [
        (
            {"limit": "0"},
            ERROR_MESSAGES["INVALID_LIMIT"].format(0),
        ),
        (
            {"limit": "1001"},
            ERROR_MESSAGES["INVALID_LIMIT"].format(1001),
        ),
        (
            {"sort_order": "INVALID"},
            ERROR_MESSAGES["INVALID_SORT_ORDER"].format("INVALID"),
        ),
        (
            {"sort_by": "INVALID_FIELD"},
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_FIELD", "sort_by", DSPM_VIOLATION_FILE_LIST_SORT_BY),
        ),
        (
            {"exposure": "INVALID"},
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID", "exposure", DSPM_VIOLATION_FILE_LIST_EXPOSURE),
        ),
        (
            {"sensitivity": "High,SUPER_SENSITIVE"},
            ERROR_MESSAGES["INVALID_SELECT"].format("SUPER_SENSITIVE", "sensitivity", DSPM_VIOLATION_FILE_LIST_SENSITIVITY),
        ),
        (
            {"access_via": "Invalid"},
            ERROR_MESSAGES["INVALID_SELECT"].format("Invalid", "access_via", DSPM_VIOLATION_FILE_LIST_ACCESS_VIA),
        ),
        (
            {"last_access_start_date": "2026-01-01"},
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("last_access_start_date", "last_access_end_date"),
        ),
        (
            {"last_access_end_date": "2026-01-01"},
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("last_access_start_date", "last_access_end_date"),
        ),
        (
            {"last_access_start_date": "2026-03-01", "last_access_end_date": "2026-01-01"},
            ERROR_MESSAGES["INVALID_DATE_RANGE"].format("last_access_start_date", "last_access_end_date"),
        ),
        (
            {"last_modified_start_date": "2026-03-01"},
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("last_modified_start_date", "last_modified_end_date"),
        ),
        (
            {"last_modified_end_date": "2026-03-01"},
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("last_modified_start_date", "last_modified_end_date"),
        ),
        (
            {"last_modified_start_date": "2026-03-01", "last_modified_end_date": "2026-01-01"},
            ERROR_MESSAGES["INVALID_DATE_RANGE"].format("last_modified_start_date", "last_modified_end_date"),
        ),
        (
            {"creation_start_date": "2026-03-01"},
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("creation_start_date", "creation_end_date"),
        ),
        (
            {"creation_end_date": "2026-03-01"},
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("creation_start_date", "creation_end_date"),
        ),
        (
            {"creation_start_date": "2026-03-01", "creation_end_date": "2026-01-01"},
            ERROR_MESSAGES["INVALID_DATE_RANGE"].format("creation_start_date", "creation_end_date"),
        ),
        (
            {"last_scan_start_date": "2026-03-01"},
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("last_scan_start_date", "last_scan_end_date"),
        ),
        (
            {"last_scan_end_date": "2026-03-01"},
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("last_scan_start_date", "last_scan_end_date"),
        ),
        (
            {"last_scan_start_date": "2026-03-01", "last_scan_end_date": "2026-01-01"},
            ERROR_MESSAGES["INVALID_DATE_RANGE"].format("last_scan_start_date", "last_scan_end_date"),
        ),
    ],
)
def test_data_security_violation_file_list_command_invalid_arguments(client, args, error):
    """Tests failure for rubrik-data-security-violation-file-list command with invalid arguments."""
    from RubrikPolaris import rubrik_data_security_violation_file_list_command

    args.update(
        {
            "violation_id": "00000000-0000-0000-0000-000000000001",
            "object_id": "00000000-0000-0000-0000-000000000002",
            "snapshot_id": "00000000-0000-0000-0000-000000010001",
        }
    )
    with pytest.raises(ValueError) as e:
        rubrik_data_security_violation_file_list_command(client, args)

    assert str(e.value) == error


@pytest.mark.parametrize("empty_response", [True, False])
def test_rubrik_data_security_violation_csv_download_initial_request_success(client, requests_mock, empty_response):
    """Test initial CSV download request (non-polling) returns success status."""
    from RubrikPolaris import rubrik_data_security_violation_csv_download_command

    response_data = util_load_json("test_data/dspm_violation_csv_download_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "snapshot_id": "00000000-0000-0000-0000-000000010001",
        "polling": False,
    }

    violation_response = response_data.get("violation_response")
    if empty_response:
        raw_response = response_data.get("empty_response")
        requests_mock.post(BASE_URL_GRAPHQL, [{"json": violation_response}, {"json": raw_response}])
        result = rubrik_data_security_violation_csv_download_command(client, args)
        assert result[0].readable_output == f"#### {MESSAGES['NO_RESPONSE']}"
    else:
        raw_response = response_data.get("initial_request_success", {}).get("raw_response")
        requests_mock.post(BASE_URL_GRAPHQL, [{"json": violation_response}, {"json": raw_response}])
        result = rubrik_data_security_violation_csv_download_command(client, args)

        assert len(result) == 1
        assert result[0].raw_response == response_data.get("initial_request_success", {}).get("raw_response")
        assert result[0].outputs == remove_empty_elements(response_data.get("initial_request_success", {}).get("outputs"))
        assert result[0].readable_output == "#### Successfully initiated the downloading of the CSV file."


def test_rubrik_data_security_violation_csv_download_polling_file_ready(client, requests_mock):
    """Test polling execution when CSV file is ready - should download and return file."""
    from RubrikPolaris import rubrik_data_security_violation_csv_download_command

    response_data = util_load_json("test_data/dspm_violation_csv_download_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "snapshot_id": "00000000-0000-0000-0000-000000010001",
        "object_name": "test_object",
        "polling": True,
    }

    user_files_response = response_data.get("polling_file_ready", {}).get("raw_response")

    file_data = util_load_text_data("test_data/dspm_violation_csv_file.csv")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)
    requests_mock.get(
        "https://demo.my.rubrik.com/file-downloads/00000000-0000-0000-0000-000000000011", text=file_data, status_code=200
    )

    result = rubrik_data_security_violation_csv_download_command(client, args)

    assert len(result) == 2
    assert result[0].raw_response == response_data.get("polling_file_ready", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(response_data.get("polling_file_ready", {}).get("outputs"))
    assert result[0].readable_output == "#### Successfully downloaded the Files at Risk CSV file."
    if isinstance(result[1], dict):
        assert result[1].get("File") == "test_object-violating-files_file_results_1775629027.csv"


def test_rubrik_data_security_violation_csv_download_polling_file_not_ready(client, requests_mock):
    """Test polling execution when CSV file is not ready yet - should return polling status."""
    from RubrikPolaris import rubrik_data_security_violation_csv_download_command

    response_data = util_load_json("test_data/dspm_violation_csv_download_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "snapshot_id": "00000000-0000-0000-0000-000000010001",
        "object_name": "test_object",
        "polling": True,
    }

    user_files_response = response_data.get("polling_file_not_ready", {}).get("raw_response")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)

    result = rubrik_data_security_violation_csv_download_command(client, args)

    assert len(result) == 1
    assert result[0].raw_response == response_data.get("polling_file_not_ready", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(response_data.get("polling_file_not_ready", {}).get("outputs"))
    assert result[0].readable_output == "#### Polling for CSV file availability. The command will automatically retry..."


def test_rubrik_data_security_violation_csv_download_polling_file_failed(client, requests_mock):
    """Test polling execution when CSV file status is failed."""
    from RubrikPolaris import rubrik_data_security_violation_csv_download_command

    response_data = util_load_json("test_data/dspm_violation_csv_download_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "snapshot_id": "00000000-0000-0000-0000-000000010001",
        "object_name": "test_object",
        "polling": True,
    }

    user_files_response = response_data.get("polling_file_failed", {}).get("raw_response")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)

    result = rubrik_data_security_violation_csv_download_command(client, args)

    assert len(result) == 1
    assert result[0].raw_response == response_data.get("polling_file_failed", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(response_data.get("polling_file_failed", {}).get("outputs"))
    assert result[0].readable_output == "#### Failed to download the Files at Risk CSV file."


@pytest.mark.parametrize(
    "args, error_message",
    [
        (
            {"object_id": "00000000-0000-0000-0000-000000000002", "snapshot_id": "00000000-0000-0000-0000-000000010001"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("violation_id"),
        ),
        (
            {"violation_id": "00000000-0000-0000-0000-000000000001", "object_id": "00000000-0000-0000-0000-000000000002"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id"),
        ),
        (
            {"violation_id": "00000000-0000-0000-0000-000000000001", "snapshot_id": "00000000-0000-0000-0000-000000010001"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id"),
        ),
    ],
)
def test_rubrik_data_security_violation_csv_download_invalid_arguments_are_provided(client, args, error_message):
    """Test that missing required arguments raise ValueError."""
    from RubrikPolaris import rubrik_data_security_violation_csv_download_command

    with pytest.raises(ValueError) as e:
        rubrik_data_security_violation_csv_download_command(client, args)

    assert error_message in str(e.value)


def test_run_polling_command_completed_data_security_violation_csv_download(client, requests_mock):
    """
    Test run_polling_command when DSPM violation csv download job is completed"""
    from RubrikPolaris import rubrik_data_security_violation_csv_download_command, run_polling_command

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "snapshot_id": "00000000-0000-0000-0000-000000010001",
        "object_name": "test_object",
        "polling": True,
    }
    response_data = util_load_json("test_data/dspm_violation_csv_download_response.json")

    user_files_response = response_data.get("polling_file_ready", {}).get("raw_response")

    file_data = util_load_text_data("test_data/dspm_violation_csv_file.csv")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)
    requests_mock.get(
        "https://demo.my.rubrik.com/file-downloads/00000000-0000-0000-0000-000000000011", text=file_data, status_code=200
    )

    result = run_polling_command(
        client, args, "rubrik-data-security-violation-csv-download", rubrik_data_security_violation_csv_download_command
    )

    assert isinstance(result, list)
    assert len(result) == 2
    assert result[0].outputs.get("isSuccessful") is True


@pytest.mark.parametrize("empty_response", [True, False])
def test_rubrik_data_security_violation_log_download_command_initial_request_success(client, requests_mock, empty_response):
    """Test initial CSV download request (non-polling) returns success status."""
    from RubrikPolaris import rubrik_data_security_violation_log_download_command

    response_data = util_load_json("test_data/dspm_violation_log_download_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "polling": False,
    }

    violation_response = response_data.get("violation_response")
    if empty_response:
        raw_response = response_data.get("empty_response")
        requests_mock.post(BASE_URL_GRAPHQL, [{"json": violation_response}, {"json": raw_response}])
        result = rubrik_data_security_violation_log_download_command(client, args)
        assert result[0].readable_output == f"#### {MESSAGES['NO_RESPONSE']}"
    else:
        raw_response = response_data.get("initial_request_success", {}).get("raw_response")
        requests_mock.post(BASE_URL_GRAPHQL, [{"json": violation_response}, {"json": raw_response}])
        result = rubrik_data_security_violation_log_download_command(client, args)

        assert len(result) == 1
        assert result[0].raw_response == response_data.get("initial_request_success", {}).get("raw_response")
        assert result[0].outputs == remove_empty_elements(response_data.get("initial_request_success", {}).get("outputs"))
        assert result[0].readable_output == "#### Successfully initiated the downloading of the Remediation Log file."


def test_rubrik_data_security_violation_log_download_command_polling_file_ready(client, requests_mock):
    """Test polling execution when CSV file is ready - should download and return file."""
    from RubrikPolaris import rubrik_data_security_violation_log_download_command

    response_data = util_load_json("test_data/dspm_violation_log_download_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "object_name": "test_object",
        "polling": True,
    }

    user_files_response = response_data.get("polling_file_ready", {}).get("raw_response")

    file_data = util_load_text_data("test_data/dspm_violation_log_file.csv")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)
    requests_mock.get(
        "https://demo.my.rubrik.com/file-downloads/00000000-0000-0000-0000-000000000011", text=file_data, status_code=200
    )

    result = rubrik_data_security_violation_log_download_command(client, args)

    assert len(result) == 2
    assert result[0].raw_response == response_data.get("polling_file_ready", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(response_data.get("polling_file_ready", {}).get("outputs"))
    assert result[0].readable_output == "#### Successfully downloaded the Remediation Log file."
    if isinstance(result[1], dict):
        assert result[1].get("File") == "test_object actions log.csv"


def test_rubrik_data_security_violation_log_download_command_polling_file_not_ready(client, requests_mock):
    """Test polling execution when CSV file is not ready yet - should return polling status."""
    from RubrikPolaris import rubrik_data_security_violation_log_download_command

    response_data = util_load_json("test_data/dspm_violation_log_download_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "object_name": "test_object",
        "polling": True,
    }

    user_files_response = response_data.get("polling_file_not_ready", {}).get("raw_response")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)

    result = rubrik_data_security_violation_log_download_command(client, args)

    assert len(result) == 1
    assert result[0].raw_response == response_data.get("polling_file_not_ready", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(response_data.get("polling_file_not_ready", {}).get("outputs"))
    assert (
        result[0].readable_output == "#### Polling for Remediation Log file availability. The command will automatically retry..."
    )


def test_rubrik_data_security_violation_log_download_command_polling_file_failed(client, requests_mock):
    """Test polling execution when CSV file status is failed."""
    from RubrikPolaris import rubrik_data_security_violation_log_download_command

    response_data = util_load_json("test_data/dspm_violation_log_download_response.json")

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "snapshot_id": "00000000-0000-0000-0000-000000010001",
        "object_name": "test_object",
        "polling": True,
    }

    user_files_response = response_data.get("polling_file_failed", {}).get("raw_response")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)

    result = rubrik_data_security_violation_log_download_command(client, args)

    assert len(result) == 1
    assert result[0].raw_response == response_data.get("polling_file_failed", {}).get("raw_response")
    assert result[0].outputs == remove_empty_elements(response_data.get("polling_file_failed", {}).get("outputs"))
    assert result[0].readable_output == "#### Failed to download the Remediation Log file."


@pytest.mark.parametrize(
    "args, error_message",
    [
        (
            {"object_id": "00000000-0000-0000-0000-000000000002", "snapshot_id": "00000000-0000-0000-0000-000000010001"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("violation_id"),
        ),
        (
            {"violation_id": "00000000-0000-0000-0000-000000000001", "snapshot_id": "00000000-0000-0000-0000-000000010001"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id"),
        ),
    ],
)
def test_rubrik_data_security_violation_log_download_command_invalid_arguments_are_provided(client, args, error_message):
    """Test that missing required arguments raise ValueError."""
    from RubrikPolaris import rubrik_data_security_violation_log_download_command

    with pytest.raises(ValueError) as e:
        rubrik_data_security_violation_log_download_command(client, args)

    assert error_message in str(e.value)


def test_run_polling_command_completed_data_security_violation_log_download(client, requests_mock):
    """
    Test run_polling_command when DSPM violation log download is completed"""
    from RubrikPolaris import rubrik_data_security_violation_log_download_command, run_polling_command

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "object_id": "00000000-0000-0000-0000-000000000002",
        "object_name": "test_object",
        "polling": True,
    }
    response_data = util_load_json("test_data/dspm_violation_log_download_response.json")

    user_files_response = response_data.get("polling_file_ready", {}).get("raw_response")

    file_data = util_load_text_data("test_data/dspm_violation_log_file.csv")

    requests_mock.post(BASE_URL_GRAPHQL, json=user_files_response)
    requests_mock.get(
        "https://demo.my.rubrik.com/file-downloads/00000000-0000-0000-0000-000000000011", text=file_data, status_code=200
    )

    result = run_polling_command(
        client, args, "rubrik-data-security-violation-log-download", rubrik_data_security_violation_log_download_command
    )

    assert isinstance(result, list)
    assert len(result) == 2
    assert result[0].outputs.get("isSuccessful") is True


def test_rubrik_identity_resilience_violation_list_command_success(client, requests_mock):
    """Tests success for rubrik-identity-resilience-violation-list command."""
    from RubrikPolaris import rubrik_identity_resilience_violation_list_command

    ir_response = util_load_json("test_data/ir_violation_list_response.json")
    ir_response_hr = util_load_text_data("test_data/ir_violation_list_response_hr.md")

    args = {
        "status": "OPEN",
        "severity": "HIGH",
        "policy_type": "IDENTITY",
        "identity_provider": "ENTRA_ID",
        "identity_tag": "PRIVILEGED",
        "detection_start_date": "2026-03-01",
        "detection_end_date": "2026-03-31",
        "resolved_start_date": "2026-03-01",
        "resolved_end_date": "2026-03-31",
    }
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": ir_response.get("raw_response")}])
    response = rubrik_identity_resilience_violation_list_command(client, args=args)

    assert response.raw_response == ir_response.get("raw_response")
    assert response.outputs == remove_empty_elements(ir_response.get("outputs"))
    assert response.readable_output == ir_response_hr


def test_rubrik_identity_resilience_violation_list_command_success_when_empty_response(client, requests_mock):
    """Tests success when empty response is received for rubrik-identity-resilience-violation-list command."""
    from RubrikPolaris import rubrik_identity_resilience_violation_list_command

    ir_response = util_load_json("test_data/ir_violation_list_response.json")

    args = {}
    requests_mock.post(BASE_URL_GRAPHQL, [{"json": ir_response.get("empty_response")}])
    response = rubrik_identity_resilience_violation_list_command(client, args=args)
    assert response.readable_output == f"#### {MESSAGES['NO_RECORDS_FOUND'].format('IR violations')}"


@pytest.mark.parametrize(
    "args, exception, error",
    [
        (
            {"limit": "0"},
            ValueError,
            ERROR_MESSAGES["INVALID_LIMIT"].format(0),
        ),
        (
            {"limit": "1001"},
            ValueError,
            ERROR_MESSAGES["INVALID_LIMIT"].format(1001),
        ),
        (
            {"sort_order": "INVALID"},
            ValueError,
            ERROR_MESSAGES["INVALID_SORT_ORDER"].format("INVALID"),
        ),
        (
            {"sort_by": "INVALID_FIELD"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_FIELD", "sort_by", IR_VIOLATION_SORT_BY),
        ),
        (
            {"status": "INVALID"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID", "status", IR_VIOLATION_STATUS),
        ),
        (
            {"severity": "SUPER_HIGH"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("SUPER_HIGH", "severity", IR_VIOLATION_SEVERITY),
        ),
        (
            {"policy_type": "INVALID_TYPE"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_TYPE", "policy_type", IR_VIOLATION_POLICY_TYPE),
        ),
        (
            {"identity_provider": "INVALID_PROVIDER"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_PROVIDER", "identity_provider", IR_VIOLATION_IDENTITY_PROVIDER),
        ),
        (
            {"identity_tag": "INVALID_TAG"},
            ValueError,
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_TAG", "identity_tag", IR_VIOLATION_IDENTITY_TAG),
        ),
        (
            {"detection_start_date": "2026-01-01"},
            ValueError,
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("detection_start_date", "detection_end_date"),
        ),
        (
            {"resolved_end_date": "2026-03-01"},
            ValueError,
            ERROR_MESSAGES["MISSING_TWO_REQUIRED_FIELD"].format("resolved_start_date", "resolved_end_date"),
        ),
        (
            {"detection_start_date": "2026-03-01", "detection_end_date": "2026-01-01"},
            ValueError,
            ERROR_MESSAGES["INVALID_DATE_RANGE"].format("detection_start_date", "detection_end_date"),
        ),
        (
            {"resolved_start_date": "2026-03-01", "resolved_end_date": "2026-01-01"},
            ValueError,
            ERROR_MESSAGES["INVALID_DATE_RANGE"].format("resolved_start_date", "resolved_end_date"),
        ),
    ],
)
def test_rubrik_identity_resilience_violation_list_command_when_arguments_failure(client, args, exception, error):
    """Tests failure for rubrik-identity-resilience-violation-list command with invalid arguments."""
    from RubrikPolaris import rubrik_identity_resilience_violation_list_command

    with pytest.raises(exception) as e:
        rubrik_identity_resilience_violation_list_command(client, args)

    assert str(e.value) == error


def test_rubrik_identity_resilience_violation_get_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_identity_resilience_violation_get_command with valid case.

    When:
        - Calling rubrik_identity_resilience_violation_get_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_identity_resilience_violation_get_command

    response_data = util_load_json("test_data/ir_violation_get_response.json")
    hr_data = util_load_text_data("test_data/ir_violation_get_response_hr.md")

    args = {"violation_id": "00000000-0000-0000-0000-000000000001", "policy_type": "IDENTITY"}

    responses = [
        {"json": response_data.get("violation_response")},
        {"json": response_data.get("principal_summary_response")},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)
    response = rubrik_identity_resilience_violation_get_command(client, args=args)

    assert response.outputs == remove_empty_elements(response_data.get("context"))
    assert response.readable_output == hr_data


def test_rubrik_identity_resilience_violation_get_command_empty_response(client, requests_mock):
    """
    Test case scenario for rubrik_identity_resilience_violation_get_command with empty response.

    When:
        - Calling rubrik_identity_resilience_violation_get_command with empty response.
    Then:
        - Verifies that NO_RESPONSE message is returned.
    """
    from RubrikPolaris import rubrik_identity_resilience_violation_get_command

    violation_response = {"data": {"policyViolation": {}}}

    args = {"violation_id": "invalid-violation-id"}

    requests_mock.post(BASE_URL_GRAPHQL, json=violation_response)
    response = rubrik_identity_resilience_violation_get_command(client, args=args)

    assert response.readable_output == f"#### {MESSAGES['NO_RESPONSE']}"


@pytest.mark.parametrize(
    "args, error",
    [
        ({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("violation_id")),
        ({"violation_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("violation_id")),
        (
            {"violation_id": "some-id", "policy_type": "INVALID"},
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID", "policy_type", IR_VIOLATION_POLICY_TYPE),
        ),
    ],
)
def test_rubrik_identity_resilience_violation_get_command_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_identity_resilience_violation_get_command.

    Given:
        - args: Contains arguments for the command.
    When:
        - Invalid value is passed in arguments
    Then:
        - Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_identity_resilience_violation_get_command

    with pytest.raises(ValueError) as e:
        rubrik_identity_resilience_violation_get_command(client, args=args)
    assert str(e.value) == error


@pytest.mark.parametrize(
    "status_value, expected_display",
    [
        ("OPEN", "Open"),
        ("IN_PROGRESS", "In Progress"),
        ("REMEDIATED", "Remediated"),
        ("DISMISSED", "Dismissed"),
        ("CLOSED", "Closed"),
    ],
)
def test_rubrik_identity_resilience_violation_status_update_command_success(
    client, requests_mock, status_value, expected_display
):
    """
    Test case scenario for rubrik_identity_resilience_violation_status_update_command with valid case.

    When:
        - Calling rubrik_identity_resilience_violation_status_update_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_identity_resilience_violation_status_update_command

    response_data = util_load_json("test_data/ir_violation_status_update_response.json")

    hr_data = f"#### Successfully updated the IR violation status to {expected_display}"

    response_data["outputs"]["status"] = f"POLICY_VIOLATION_STATUS_{status_value}"

    args = {
        "violation_id": "00000000-0000-0000-0000-000000000001",
        "status": status_value,
    }

    requests_mock.post(BASE_URL_GRAPHQL, [{"json": response_data.get("raw_response")}])
    response = rubrik_identity_resilience_violation_status_update_command(client, args=args)

    assert response.raw_response == response_data.get("raw_response")
    assert response.outputs == remove_empty_elements(response_data.get("outputs"))
    assert response.readable_output == hr_data
    assert response.outputs_key_field == ["policyViolationId"]
    assert response.outputs_prefix == OUTPUT_PREFIX["IR_VIOLATION"]


@pytest.mark.parametrize(
    "args, error",
    [
        ({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("violation_id")),
        ({"violation_id": "00000000-0000-0000-0000-000000000001"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("status")),
        (
            {"violation_id": "00000000-0000-0000-0000-000000000001", "status": "INVALID_STATUS"},
            ERROR_MESSAGES["INVALID_SELECT"].format("INVALID_STATUS", "status", IR_VIOLATION_STATUS),
        ),
    ],
)
def test_rubrik_identity_resilience_violation_status_update_command_with_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_identity_resilience_violation_status_update_command.

    Given:
        -args: Contains arguments for the command.
    When:
        -Invalid value is passed in arguments
    Then:
        -Raises ValueError and asserts error message
    """
    from RubrikPolaris import rubrik_identity_resilience_violation_status_update_command

    with pytest.raises(ValueError) as e:
        rubrik_identity_resilience_violation_status_update_command(client, args=args)
    assert str(e.value) == error


def test_fetch_sensitive_data_objects_success_without_last_run(client, requests_mock):
    """
    Test Case : Success scenario with all filter parameters without last run.
    Tests fetch_sensitive_data_objects function to return incidents and new last run with provided empty last run.
    """
    from RubrikPolaris import fetch_sensitive_data_objects

    events_response = util_load_json("test_data/fetch_sensitive_data_objects_events_success_response.json")
    object_detail_responses = util_load_json("test_data/fetch_sensitive_data_objects_list_response.json")
    expected_incidents = util_load_json("test_data/fetch_sensitive_data_objects_incidents.json")

    detail_responses = [{"json": detail} for detail in object_detail_responses]

    responses = [
        {"json": events_response},
        *detail_responses,
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "sensitive_data_object_sensitivity": ["HIGH", "MEDIUM"],
        "sensitive_data_object_type": ["O365Onedrive", "AWS_NATIVE_S3_BUCKET", "NutanixVirtualMachine"],
    }

    sdo_next_run, incidents = fetch_sensitive_data_objects(client, {}, params, 10)

    already_fetched = sdo_next_run.get("already_fetched", [])
    assert "last_fetch" in sdo_next_run
    assert sdo_next_run.get("next_page_token") == "cursor_5"
    assert len(already_fetched) == 3
    assert "00000000-0000-0000-0000-000000000001" in already_fetched
    assert "00000000-0000-0000-0000-000000000002" in already_fetched
    assert "00000000-0000-0000-0000-000000000003" in already_fetched

    assert incidents == expected_incidents


def test_fetch_sensitive_data_objects_success_with_last_run(client, requests_mock):
    """
    Test Case : Success scenario with last run.
    Tests fetch_sensitive_data_objects function with existing last_run state.
    """
    from RubrikPolaris import fetch_sensitive_data_objects

    events_response = util_load_json("test_data/fetch_sensitive_data_objects_events_success_response.json")
    object_detail_responses = util_load_json("test_data/fetch_sensitive_data_objects_list_response.json")
    expected_incidents = util_load_json("test_data/fetch_sensitive_data_objects_incidents.json")

    detail_responses = [{"json": detail} for detail in object_detail_responses]

    responses = [
        {"json": events_response},
        *detail_responses,
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    last_run = {
        "sensitive_data_object": {
            "last_fetch": last_fetch,
            "next_page_token": "page_cursor",
            "already_fetched": [],
        }
    }

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "sensitive_data_object_sensitivity": ["HIGH", "MEDIUM"],
        "sensitive_data_object_type": ["O365Onedrive", "AWS_NATIVE_S3_BUCKET", "NutanixVirtualMachine"],
    }

    sdo_next_run, incidents = fetch_sensitive_data_objects(client, last_run, params, 10)

    already_fetched = sdo_next_run.get("already_fetched", [])
    assert sdo_next_run.get("last_fetch") == last_fetch
    assert sdo_next_run.get("next_page_token") == "cursor_5"
    assert len(already_fetched) == 3
    assert "00000000-0000-0000-0000-000000000001" in already_fetched
    assert "00000000-0000-0000-0000-000000000002" in already_fetched
    assert "00000000-0000-0000-0000-000000000003" in already_fetched

    assert incidents == expected_incidents


def test_fetch_sensitive_data_objects_with_duplicates(client, requests_mock):
    """
    Test Case : Success with duplicate scenario.
    Tests that duplicate sensitive data objects are skipped.
    """
    from RubrikPolaris import fetch_sensitive_data_objects

    events_response = util_load_json("test_data/fetch_sensitive_data_objects_events_success_response.json")
    object_detail_responses = util_load_json("test_data/fetch_sensitive_data_objects_list_response.json")
    expected_incidents = util_load_json("test_data/fetch_sensitive_data_objects_incidents.json")

    # Object 1 is already fetched; mock detail for objects 2-6 only
    detail_responses = [{"json": detail} for detail in object_detail_responses[1:]]

    responses = [
        {"json": events_response},
        *detail_responses,
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    last_run = {"sensitive_data_object": {"last_fetch": last_fetch, "already_fetched": ["00000000-0000-0000-0000-000000000001"]}}

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "sensitive_data_object_sensitivity": ["HIGH", "MEDIUM"],
        "sensitive_data_object_type": ["O365Onedrive", "AWS_NATIVE_S3_BUCKET", "NutanixVirtualMachine"],
    }

    sdo_next_run, incidents = fetch_sensitive_data_objects(client, last_run, params, 10)

    assert incidents == expected_incidents[1:]  # Skip first incident (already fetched)

    already_fetched = sdo_next_run.get("already_fetched", [])
    assert len(already_fetched) == 3
    assert "00000000-0000-0000-0000-000000000001" in already_fetched
    assert "00000000-0000-0000-0000-000000000002" in already_fetched
    assert "00000000-0000-0000-0000-000000000003" in already_fetched


def test_fetch_sensitive_data_objects_empty_response(client, requests_mock):
    """
    Test Case : Success with empty response.
    Tests fetch_sensitive_data_objects function returns empty incidents when no events found.
    """
    from RubrikPolaris import fetch_sensitive_data_objects

    empty_response = util_load_json("test_data/fetch_sensitive_data_objects_empty_response.json")

    responses = [
        {"json": empty_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    last_run = {
        "sensitive_data_object": {
            "last_fetch": last_fetch,
            "next_page_token": "page_cursor",
            "already_fetched": ["00000000-0000-0000-0000-000000000001"],
        }
    }

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "sensitive_data_object_sensitivity": ["HIGH"],
    }

    sdo_next_run, incidents = fetch_sensitive_data_objects(client, last_run, params, 10)

    assert len(incidents) == 0
    assert sdo_next_run == last_run["sensitive_data_object"]


def test_fetch_sensitive_data_objects_no_policy_obj(client, requests_mock):
    """
    Test Case : Snapshot resolves but policyObj detail returns empty or raises an exception.
    Tests that objects with no detail response or a failed detail query are skipped.
    """
    from RubrikPolaris import fetch_sensitive_data_objects

    events_response = util_load_json("test_data/fetch_sensitive_data_objects_events_success_response.json")

    empty_policy_obj_response = {"data": {"policyObj": None}}
    matched_object_count = 6

    # Alternate between empty policyObj and exception to cover both skip paths
    detail_responses = [
        {"exc": Exception("Connection timeout")} if i % 2 == 0 else {"json": empty_policy_obj_response}
        for i in range(matched_object_count)
    ]

    responses = [
        {"json": events_response},
        *detail_responses,
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    params = {"first_fetch": first_fetch, "max_fetch": 10}

    sdo_next_run, incidents = fetch_sensitive_data_objects(client, {}, params, 10)

    assert len(incidents) == 0
    assert sdo_next_run.get("already_fetched", []) == []


def test_fetch_sensitive_data_objects_no_matching_events(client, requests_mock):
    """
    Test Case : Activity series returns events but none match the classification message filter.
    Tests that no inventory query is made and no incidents are returned.
    """
    from RubrikPolaris import fetch_sensitive_data_objects

    events_response = util_load_json("test_data/fetch_sensitive_data_objects_no_match_events_response.json")

    responses = [
        {"json": events_response},
    ]
    requests_mock.post(BASE_URL_GRAPHQL, responses)

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
    }

    sdo_next_run, incidents = fetch_sensitive_data_objects(client, {}, params, 10)

    assert len(incidents) == 0
    assert "last_fetch" in sdo_next_run
    assert sdo_next_run.get("next_page_token") == "cursor_5"
    assert sdo_next_run.get("already_fetched", []) == []


@pytest.mark.parametrize(
    "invalid_param, invalid_value, expected_error",
    [
        (
            "sensitive_data_object_sensitivity",
            ["INVALID_SENSITIVITY"],
            ERROR_MESSAGES["INVALID_SELECT"].format(
                "INVALID_SENSITIVITY", "sensitive_data_object_sensitivity", SENSITIVE_DATA_OBJECT_SENSITIVITY
            ),
        ),
        (
            "sensitive_data_object_sensitivity",
            ["HIGH", "SUPER_HIGH"],
            ERROR_MESSAGES["INVALID_SELECT"].format(
                "SUPER_HIGH", "sensitive_data_object_sensitivity", SENSITIVE_DATA_OBJECT_SENSITIVITY
            ),
        ),
    ],
)
def test_fetch_sensitive_data_objects_invalid_filter_parameters(client, invalid_param, invalid_value, expected_error):
    """
    Test Case : Invalid filter parameter with parameterize.
    Tests that invalid filter values raise appropriate ValueError.
    """
    from RubrikPolaris import fetch_sensitive_data_objects

    params = {
        "first_fetch": first_fetch,
        "max_fetch": 10,
        "sensitive_data_object_sensitivity": ["HIGH"],
    }

    params[invalid_param] = invalid_value

    with pytest.raises(ValueError) as exc_info:
        fetch_sensitive_data_objects(client, {}, params, 10)

    assert expected_error in str(exc_info.value)


def test_rubrik_sensitive_data_object_get_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_sensitive_data_object_get_command with valid case.

    Given:
        - args: Contains valid object_id, snapshot_id, and include_whitelisted_results.
    When:
        - Calling rubrik_sensitive_data_object_get_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sensitive_data_object_get_command

    response_data = util_load_json("test_data/sensitive_data_object_get_response.json")
    hr_data = util_load_text_data("test_data/sensitive_data_object_get_response_hr.md")

    args = {
        "object_id": "00000000-0000-0000-0000-000000000001",
        "snapshot_id": "00000000-0000-0000-0000-000000000002",
        "include_whitelisted_results": "False",
    }

    requests_mock.post(BASE_URL_GRAPHQL, json=response_data.get("api_response"))
    response = rubrik_sensitive_data_object_get_command(client, args=args)

    assert response.outputs == remove_empty_elements(response_data.get("context"))
    assert response.outputs_prefix == OUTPUT_PREFIX["SENSITIVE_DATA_OBJECT"]
    assert response.outputs_key_field == "id"
    assert response.readable_output == hr_data


def test_rubrik_sensitive_data_object_get_command_empty_response(client, requests_mock):
    """
    Test case scenario for rubrik_sensitive_data_object_get_command with empty response.

    Given:
        - args: Contains valid object_id and snapshot_id.
    When:
        - API returns empty policyObj.
    Then:
        - Verifies that NO_RECORDS_FOUND message is returned.
    """
    from RubrikPolaris import rubrik_sensitive_data_object_get_command

    empty_response = {"data": {"policyObj": {}}}

    args = {
        "object_id": "00000000-0000-0000-0000-000000000001",
        "snapshot_id": "00000000-0000-0000-0000-000000000002",
    }

    requests_mock.post(BASE_URL_GRAPHQL, json=empty_response)
    response = rubrik_sensitive_data_object_get_command(client, args=args)

    assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("sensitive data object")


@pytest.mark.parametrize(
    "args, error",
    [
        ({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
        ({"object_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
        ({"object_id": "some-id"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        ({"object_id": "some-id", "snapshot_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
    ],
)
def test_rubrik_sensitive_data_object_get_command_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_sensitive_data_object_get_command.

    Given:
        - args: Contains invalid or missing arguments.
    When:
        - Invalid value is passed in arguments.
    Then:
        - Raises ValueError and asserts error message.
    """
    from RubrikPolaris import rubrik_sensitive_data_object_get_command

    with pytest.raises(ValueError) as e:
        rubrik_sensitive_data_object_get_command(client, args=args)
    assert str(e.value) == error


def test_rubrik_sensitive_data_object_file_get_command_success(client, requests_mock):
    """
    Test case scenario for rubrik_sensitive_data_object_file_get_command with valid case.

    Given:
        - args: Contains valid object_id, snapshot_id, file_path, and resolve_sids.
    When:
        - Calling rubrik_sensitive_data_object_file_get_command.
    Then:
        - Verifies mock response with actual response.
    """
    from RubrikPolaris import rubrik_sensitive_data_object_file_get_command

    response_data = util_load_json("test_data/sensitive_data_object_file_get_response.json")

    args = {
        "object_id": "00000000-0000-0000-0000-000000000001",
        "snapshot_id": "00000000-0000-0000-0000-000000000002",
        "file_path": "/C:/DummyPath/DummyFile.xlsx",
        "resolve_sids": "true",
    }

    requests_mock.post(
        BASE_URL_GRAPHQL,
        [{"json": response_data.get("access_api_response")}, {"json": response_data.get("details_api_response")}],
    )
    response = rubrik_sensitive_data_object_file_get_command(client, args=args)

    hr_data = util_load_text_data("test_data/sensitive_data_object_file_get_response_hr.md")

    assert response.outputs == remove_empty_elements(response_data.get("context"))
    assert response.outputs_prefix == OUTPUT_PREFIX["SENSITIVE_DATA_OBJECT_FILE"]
    assert response.outputs_key_field == ["objectId", "stdPath"]
    assert response.readable_output == hr_data


def test_rubrik_sensitive_data_object_file_get_command_no_access_data(client, requests_mock):
    """
    Test case scenario for rubrik_sensitive_data_object_file_get_command when datagovSecDesc is not available.

    Given:
        - args: Contains valid object_id, snapshot_id, and file_path.
    When:
        - FILE_ACCESS_QUERY raises an exception (object type does not support datagovSecDesc).
    Then:
        - Verifies that command succeeds using only sensitiveFileDetails data.
    """
    from RubrikPolaris import rubrik_sensitive_data_object_file_get_command

    response_data = util_load_json("test_data/sensitive_data_object_file_get_response.json")

    args = {
        "object_id": "00000000-0000-0000-0000-000000000001",
        "snapshot_id": "00000000-0000-0000-0000-000000000002",
        "file_path": "/C:/DummyPath/DummyFile.xlsx",
    }

    requests_mock.post(
        BASE_URL_GRAPHQL,
        [
            {"exc": Exception("datagovSecDesc not supported for this object type")},
            {"json": response_data.get("details_api_response")},
        ],
    )
    response = rubrik_sensitive_data_object_file_get_command(client, args=args)

    hr_data = util_load_text_data("test_data/sensitive_data_object_file_get_no_access_hr.md")

    assert response.outputs == remove_empty_elements(response_data.get("context_no_access"))
    assert response.outputs_prefix == OUTPUT_PREFIX["SENSITIVE_DATA_OBJECT_FILE"]
    assert response.outputs_key_field == ["objectId", "stdPath"]
    assert response.readable_output == hr_data


def test_rubrik_sensitive_data_object_file_get_command_empty_response(client, requests_mock):
    """
    Test case scenario for rubrik_sensitive_data_object_file_get_command with empty response.

    Given:
        - args: Contains valid object_id, snapshot_id, and file_path.
    When:
        - Both API calls return empty data.
    Then:
        - Verifies that NO_RECORDS_FOUND message is returned.
    """
    from RubrikPolaris import rubrik_sensitive_data_object_file_get_command

    args = {
        "object_id": "00000000-0000-0000-0000-000000000001",
        "snapshot_id": "00000000-0000-0000-0000-000000000002",
        "file_path": "/C:/DummyPath/DummyFile.xlsx",
    }

    requests_mock.post(
        BASE_URL_GRAPHQL, [{"json": {"data": {"datagovSecDesc": {}}}}, {"json": {"data": {"sensitiveFileDetails": {}}}}]
    )
    response = rubrik_sensitive_data_object_file_get_command(client, args=args)

    assert response.readable_output == MESSAGES["NO_RECORDS_FOUND"].format("sensitive data object file information")


@pytest.mark.parametrize(
    "args, error",
    [
        ({}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
        ({"object_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("object_id")),
        ({"object_id": "some-id"}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        ({"object_id": "some-id", "snapshot_id": ""}, ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("snapshot_id")),
        (
            {"object_id": "some-id", "snapshot_id": "some-snap"},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("file_path"),
        ),
        (
            {"object_id": "some-id", "snapshot_id": "some-snap", "file_path": ""},
            ERROR_MESSAGES["MISSING_REQUIRED_FIELD"].format("file_path"),
        ),
    ],
)
def test_rubrik_sensitive_data_object_file_get_command_invalid_args(client, args, error):
    """
    Test case scenario for invalid arguments for rubrik_sensitive_data_object_file_get_command.

    Given:
        - args: Contains invalid or missing arguments.
    When:
        - Invalid value is passed in arguments.
    Then:
        - Raises ValueError and asserts error message.
    """
    from RubrikPolaris import rubrik_sensitive_data_object_file_get_command

    with pytest.raises(ValueError) as e:
        rubrik_sensitive_data_object_file_get_command(client, args=args)
    assert str(e.value) == error

File Name	File Path	File Size	Matched Snapshot ID	Matched Snapshot Date	Matched Snapshot Expired
file1.txt	/dummy/path/file1.txt	1234	dummy-snapshot-fid-1	2025-01-02T00:00:00.000Z	false
file2.txt	/dummy/path/file2.txt	5678	dummy-snapshot-fid-2	2025-01-04T00:00:00.000Z	true

ID	Violation Name	Severity	Object Name	Violation Status	High Risk Hits	Medium Risk Hits	Low Risk Hits	No Risk Hits	Detection On
00000000-0000-0000-0000-000000000001	Secrets stored outside of vault	Medium	DEMO-RADAR02	Open	0	1	2	37	2026-03-06T06:30:45.000Z
00000000-0000-0000-0000-000000000002	Stale sensitive data - not modified for over a year	Low	file-store	Open	7	0	0	83	2026-02-25T15:30:25.000Z

File Path	File Size in Bytes	Total Risk Hits	High Risk Hits	Medium Risk Hits	Low Risk Hits	No Risk Hits	Last Access Time	Last Modified Time	Data Categories
/Sales Department/fileName.txt	67615	3022	0	1533	0	1489	1970-01-01T00:00:00Z	2023-05-24T19:47:56Z	- id: 00000000-0000-0000-0000-000000000008 *name: Personal totalViolatedHits: 1533 - id: 00000000-0000-0000-0000-000000000007 name: Geographical totalViolatedHits*: 1489
/Sales Department/fileName1.txt	25653	790	0	393	0	397	1970-01-01T00:00:00Z	2023-05-24T19:42:35Z	- id: 00000000-0000-0000-0000-000000000007 *name: Geographical totalViolatedHits: 397 - id: 00000000-0000-0000-0000-000000000008 name: Personal totalViolatedHits*: 393

ID	Policy Name	Display Name	Domain	Status	Severity	Policy Type	Category	Root Domain	Detected On
00000000-0000-0000-0000-000000000001	Excessive admin privileges	John Doe	rubrikdemo.com	Open	High	Identity	Identity Hygiene		2026-03-25T09:29:55.000Z
00000000-0000-0000-0000-000000000003	Overly permissive IDP configuration		rubrikdemo.com	Open	Medium	Idp	Identity Provider Security	rubrikdemo.com	2026-03-25T16:45:30.000Z