Rubrik DSPM Violation Remediation - Rubrik Security Cloud

This playbook remediates DSPM violations by retrieving violation details and affected file information, downloading the affected file details and remediation logs as CSV files, quarantining the affected files and updating the violation status.

Pack

RubrikPolaris

Tasks

19

Inputs

• violation_id — The ID of the DSPM violation. Note: Users can get the violation ID by executing the "rubrik-data-security-violation-list" command.
• object_id — The object ID. Note: Users can retrieve the object ID by executing the "rubrik-polaris-objects-list" command.
• snapshot_id — The snapshot ID. Note: Users can retrieve the snapshot ID by executing the "rubrik-polaris-object-snapshot-list" command.
• object_name — The object Name. Note: If not specified playbook will retrieve it using the "rubrik-data-security-violation-get" command.
• limit — Number of results to retrieve in the response. The maximum allowed size is 1000.
• quarantine_folder_id — The ID of the quarantine folder where the affected files will be moved.

Commands used

• rubrik-data-security-violation-csv-download
• rubrik-data-security-violation-log-download
• rubrik-data-security-violation-status-update