Rubrik Turbo IOC Scan - Rubrik Polaris

This playbook starts a Turbo IOC scan with the specified IOC values and shows the results upon completion.

Inputs

ioc — The value of the indicator to scan for. Supports comma separated values. Note: Users can retrieve the Md5, SHA1 or SHA256 by executing the "rubrik-threat-monitoring-matched-file-get" command.
scan_name — Name of the new turbo threat hunt scan.
cluster_id — The ID of the cluster on which to perform a scan. If not provided, all the clusters will be scanned. Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.
start_time — Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.
end_time — Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.
max_snapshots_per_object — Maximum number of snapshots to scan per object.
polling_interval — Frequency that the IOC scan command will run (minutes).
polling_timeout — Amount of time to poll before declaring a timeout and resuming the playbook (in minutes).