Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

This playbook retrieves the list of anomaly files for the provided snapshot ID (or activity series ID) and generates the downloadable links for the file path(s).

Pack

RubrikPolaris

Tasks

22

Inputs

• file_paths — The absolute path of the file(s) for which a downloadable link needs to be generated.
• snapshot_id — The snapshot ID for which to retrieve the anomaly results. Default can be received from incident (activity series ID) if present. Note: Users can get the list of the snapshot IDs by executing the "rubrik-polaris-object-snapshot-list" command. For the Activity Series ID, the users can execute the "rubrik-event-list" command with the "activity_type" argument set to "ANOMALY".
• download_csv_file — If set to True, the playbook downloads the anomaly analysis csv file directly on XSOAR server.
• close_notes — Add notes for closing the incident.
• object_id — The Object ID or the Snappable ID. Note: Users can get the list of the object IDs by executing the "rubrik-polaris-object-list" command.

Outputs

• RubrikPolaris.SuspiciousFile.id — The anomaly result ID.
• RubrikPolaris.SuspiciousFile.snapshotFid — The snapshot ID.
• RubrikPolaris.SuspiciousFile.cluster.id — The cluster ID.
• RubrikPolaris.SuspiciousFile.cluster.defaultAddress — The default address of the cluster.
• RubrikPolaris.SuspiciousFile.cluster.systemStatusAffectedNodes.ipAddress — The IP address of the affected node.
• RubrikPolaris.SuspiciousFile.cluster.name — The cluster name.
• RubrikPolaris.SuspiciousFile.cluster.version — The cluster version.
• RubrikPolaris.SuspiciousFile.cluster.status — The cluster status.
• RubrikPolaris.SuspiciousFile.cluster.__typename — The type name of the cluster response.
• RubrikPolaris.SuspiciousFile.cdmId — The snapshot CDM ID.
• RubrikPolaris.SuspiciousFile.managedId — The managed object ID.
• RubrikPolaris.SuspiciousFile.anomalyProbability — The probability of the anomaly.
• RubrikPolaris.SuspiciousFile.workloadId — The workload ID.
• RubrikPolaris.SuspiciousFile.location — The location of the anomaly.
• RubrikPolaris.SuspiciousFile.isAnomaly — Indicates if the file is an anomaly.
• RubrikPolaris.SuspiciousFile.objectType — The object type.
• RubrikPolaris.SuspiciousFile.snappableNew.objectType — The object type of the snapshot.
• RubrikPolaris.SuspiciousFile.severity — The severity of the anomaly.
• RubrikPolaris.SuspiciousFile.detectionTime — The detection time of the anomaly.
• RubrikPolaris.SuspiciousFile.snapshotDate — The snapshot date of the anomaly.
• RubrikPolaris.SuspiciousFile.encryption — The encryption standard of the anomaly.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.strainId — The ID of the Ransomware Strain.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalAffectedFiles — The total number of affected files.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalRansomwareNotes — The total number of ransomware notes.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath — The path of the affected file.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.lastModified — The last modified time of the affected file.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.fileSizeBytes — The size of the affected file in bytes.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.__typename — The type name of the affected file response.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath — The path of the ransomware note file.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.lastModified — The last modified time of the ransomware note file.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.fileSizeBytes — The size of the ransomware note file in bytes.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.__typename — The type name of the ransomware note file response.
• RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.__typename — The type name of the strain analysis response.
• RubrikPolaris.SuspiciousFile.anomalyInfo.__typename — The type name of the anomaly response.
• RubrikPolaris.SuspiciousFile.__typename — The type name of the suspicious file response.

Commands used

• closeInvestigation
• rubrik-anomaly-csv-analysis-v2
• rubrik-event-list
• rubrik-gps-snapshot-files-download
• rubrik-radar-suspicious-file-list