Rubrik File Context Analysis - Rubrik Polaris

This playbook fetches file context information for the provided file, folder, or file share name and the object ID to get the policy hits.

Pack

RubrikPolaris

Tasks

14

Inputs

• object_id — The Object ID or the Snappable ID. Default can be received from incident if present. Note: Users can get the list of the object IDs by executing the "rubrik-polaris-object-list" command.
• file_name — Specify the name of the file, folder, or file share object.
• file_path — Specify the standard folder/directory path to filter with.
• user_id — Specify the user ID to filter with. Note: Users can get the list of the user IDs by executing the "rubrik-sonar-user-access-list" command.
• limit — Number of results to retrieve in the response. The maximum allowed size is 1000.

Outputs

• RubrikPolaris.FileContext.nativePath — The native path of the file.
• RubrikPolaris.FileContext.stdPath — The standardized path of the file.
• RubrikPolaris.FileContext.filename — The filename.
• RubrikPolaris.FileContext.mode — The file mode.
• RubrikPolaris.FileContext.size — The file size in bytes.
• RubrikPolaris.FileContext.lastAccessTime — The last access time of the file in milliseconds since the epoch.
• RubrikPolaris.FileContext.lastModifiedTime — The last modified time of the file in milliseconds since the epoch.
• RubrikPolaris.FileContext.directory — The value of Directory.
• RubrikPolaris.FileContext.numDescendantFiles — The number of descendant files of the file.
• RubrikPolaris.FileContext.numDescendantErrorFiles — The number of descendant files of the file that could not be processed.
• RubrikPolaris.FileContext.numDescendantSkippedExtFiles — The number of descendant files of the file that were skipped because of their file extension.
• RubrikPolaris.FileContext.numDescendantSkippedSizeFiles — The number of descendant files of the file that were skipped because of their file size.
• RubrikPolaris.FileContext.errorCode — The error code, if any, for the file.
• RubrikPolaris.FileContext.hits.totalHits — The total number of hits for the file.
• RubrikPolaris.FileContext.hits.violations — The number of violations for the file.
• RubrikPolaris.FileContext.hits.violationsDelta — The change in the number of violations for the file since the last scan.
• RubrikPolaris.FileContext.hits.totalHitsDelta — The change in the total number of hits for the file since the last scan.
• RubrikPolaris.FileContext.hits.__typename — The type of the hits field.
• RubrikPolaris.FileContext.filesWithHits.totalHits — The total number of files with hits.
• RubrikPolaris.FileContext.filesWithHits.violations — The number of files with violations.
• RubrikPolaris.FileContext.filesWithHits.__typename — The type of the files with hits field.
• RubrikPolaris.FileContext.openAccessFilesWithHits.totalHits — The total number of open access files with hits.
• RubrikPolaris.FileContext.openAccessFilesWithHits.violations — The number of open access files with violations.
• RubrikPolaris.FileContext.openAccessFilesWithHits.__typename — The type of the open access files with hits field.
• RubrikPolaris.FileContext.staleFilesWithHits.totalHits — The total number of stale files with hits.
• RubrikPolaris.FileContext.staleFilesWithHits.violations — The number of stale files with violations.
• RubrikPolaris.FileContext.staleFilesWithHits.__typename — The type of the stale files with hits field.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.groupType — The type of the analyzer group.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.id — The ID of the analyzer group.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.name — The name of the analyzer group.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerGroup.__typename — The type of the analyzer group field.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.totalHits — The total number of hits for the analyzer results.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.violations — The number of violations for the analyzer results.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.hits.__typename — The type of the hits field.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.id — The ID of the analyzer.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.name — The name of the analyzer.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.analyzerType — The type of the analyzer.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.analyzer.__typename — The type of the analyzer field.
• RubrikPolaris.FileContext.analyzerGroupResults.analyzerResults.__typename — The type of the analyzer results field.
• RubrikPolaris.FileContext.analyzerGroupResults.hits.totalHits — The total number of hits for the analyzer group results.
• RubrikPolaris.FileContext.analyzerGroupResults.hits.violations — The number of violations for the analyzer group results.
• RubrikPolaris.FileContext.analyzerGroupResults.hits.violationsDelta — The change in the number of violations for the analyzer group results since the last scan.
• RubrikPolaris.FileContext.analyzerGroupResults.hits.totalHitsDelta — The change in the total number of hits for the analyzer group results since the last scan.
• RubrikPolaris.FileContext.analyzerGroupResults.hits.__typename — The type of the hits field.
• RubrikPolaris.FileContext.analyzerGroupResults.__typename — The type of the analyzer group results field.
• RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.totalCount — The total number of high-risk files for the policy object.
• RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.violatedCount — The number of high-risk files for the policy object that violates policies.
• RubrikPolaris.FileContext.sensitiveFiles.highRiskFileCount.__typename — The type of the high-risk file count field.
• RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.totalCount — Total number of medium-risk files for the policy object.
• RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.violatedCount — The number of medium-risk files for the policy object that violates policies.
• RubrikPolaris.FileContext.sensitiveFiles.mediumRiskFileCount.__typename — The type of the medium risk file count field.
• RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.totalCount — Total number of low-risk files for the policy object.
• RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.violatedCount — The number of low-risk files for the policy object that violates policies.
• RubrikPolaris.FileContext.sensitiveFiles.lowRiskFileCount.__typename — The type of the low-risk file count field.
• RubrikPolaris.FileContext.sensitiveFiles.__typename — The type of the sensitive files field.
• RubrikPolaris.FileContext.openAccessType — The open access type for the file.
• RubrikPolaris.FileContext.stalenessType — The staleness type for the file.
• RubrikPolaris.FileContext.numActivities — The number of activities for the file.
• RubrikPolaris.FileContext.numActivitiesDelta — The change in the number of activities for the file since the last time it was checked.
• RubrikPolaris.FileContext.__typename — The type of the file context field.
• RubrikPolaris.PageToken.FileContext.name — Name of the command.
• RubrikPolaris.PageToken.FileContext.endCursor — The end cursor for the current page.
• RubrikPolaris.PageToken.FileContext.hasNextPage — Whether the result has the next page or not.

Commands used

• rubrik-polaris-object-snapshot-list
• rubrik-sonar-file-context-list