Rubrik Security Cloud v1.8.1
Rubrik Security Cloud revolutionizes the data management market, specifically backup/recovery, archival, and DR, by providing a global policy framework, workflow orchestration, and deep data intelligence as cloud-delivered applications. The content pack fetches Rubrik Anomaly Event and provides playbooks to analyze, discover and recover -- to mention a few -- organizational data. The content pack is rich with commands to perform on-demand scans, backups, recoveries and many more features exposed by the RSC API.
Classifiers (2)
Incident fields (77)
- Rubrik Actor ID
- Rubrik Actor Name
- Rubrik Actor Privilege Type
- Rubrik Actor State
- Rubrik Actor Type
- Rubrik CDM Cluster ID
- Rubrik CDM Cluster Location
- Rubrik CDM Cluster Name
- Rubrik Data Categories
- Rubrik Data Types
- Rubrik Detection Time
- Rubrik Domain ID
- Rubrik Domain Name
- Rubrik Entity ID
- Rubrik Entity Name
- Rubrik Event Time
- Rubrik File Match Count
- Rubrik Files At Risk
- Rubrik High Risk Hits
- Rubrik IR Violation Status
- Rubrik Identity Provider
- Rubrik Identity Tags
- Rubrik Last Detected
- Rubrik Low Risk Hits
- Rubrik Manual Remediation Process
- Rubrik Match Types
- Rubrik Medium Risk Hits
- Rubrik Mitre Tactic
- Rubrik Native Type
- Rubrik No Risk Hits
- Rubrik Object Account Name
- Rubrik Object Create Time
- Rubrik Object Location
- Rubrik Object Platform
- Rubrik Object Region
- Rubrik Polaris Activity Series ID
- Rubrik Polaris Activity Type
- Rubrik Polaris Analysis Pipeline
- Rubrik Polaris Analysis Progress Hidden
- Rubrik Polaris CDM Cluster ID Hidden
- Rubrik Polaris CDM Cluster Name Hidden
- Rubrik Polaris Cluster Location Path
- Rubrik Polaris Event Completed
- Rubrik Polaris Event ID
- Rubrik Polaris FID
- Rubrik Polaris Last Activity Status
- Rubrik Polaris Last Updated Hidden
- Rubrik Polaris Message Hidden
- Rubrik Polaris Object ID
- Rubrik Polaris Object Name
- Rubrik Polaris Object Type
- Rubrik Polaris Start Time
- Rubrik Policy Category
- Rubrik Policy Frameworks
- Rubrik Policy Name
- Rubrik Principal Type
- Rubrik Privilege Type
- Rubrik Resource Source
- Rubrik Resource Status
- Rubrik Resource Unique ID
- Rubrik Root Domain ID
- Rubrik Root Domain Name
- Rubrik Snapshot ID
- Rubrik Suspicious File Count
- Rubrik Suspicious File List
- Rubrik Target ID
- Rubrik Target Identity Provider
- Rubrik Target Name
- Rubrik Target Privilege Type
- Rubrik Target Source
- Rubrik Target Status
- Rubrik Target Type
- Rubrik Total Risk Hits
- Rubrik User Principal Name
- Rubrik Violation ID
- Rubrik Violation Name
- Rubrik Violation Status
Incident types (4)
Integrations (1)
Layouts (5)
Playbooks (22)
- Rubrik Anomaly Incident Response - Rubrik Polaris
- Rubrik DSPM Violation Remediation - Rubrik Security Cloud
- Rubrik Data Object Discovery - Rubrik Polaris
- Rubrik File Context Analysis - Rubrik Polaris
- Rubrik Fileset Ransomware Discovery - Rubrik Polaris
- Rubrik IOC Scan - Rubrik Polaris
- Rubrik IOC Scan v2 - Rubrik Polaris
- Rubrik IR Violation Remediation - Rubrik Security Cloud
- Rubrik List Snapshots - Rubrik Polaris
- Rubrik Object Context Analysis - Rubrik Polaris
- Rubrik Polaris - Anomaly Analysis
- Rubrik Poll Async Result - Rubrik Polaris
- Rubrik Quarantine Files General
- Rubrik Quarantine Files using MS Graph Search
- Rubrik Ransomware Discovery and File Recovery - Rubrik Polaris
- Rubrik Ransomware Discovery and VM Recovery - Rubrik Polaris
- Rubrik Retrieve Anomaly Result - Rubrik Security Cloud
- Rubrik Retrieve User Access Information - Rubrik Polaris
- Rubrik Turbo IOC Scan - Rubrik Polaris
- Rubrik Update Anomaly Status- Rubrik Security Cloud
- Rubrik User Access Analysis - Rubrik Polaris
- Rubrik Workload Analysis - Rubrik Security Cloud
Scripts (18)
- DateToTimeStamp
- RubrikCDMClusterConnectionState
- RubrikPullDSPMViolationFileInformation
- RubrikPullDSPMViolationInformation
- RubrikPullIRViolationInformation
- RubrikPushDSPMViolationStatus
- RubrikPushIRViolationStatus
- RubrikRadarFilesAdded
- RubrikRadarFilesDeleted
- RubrikRadarFilesModified
- RubrikSetIncidentSeverityUsingWorkLoadRiskLevel
- RubrikSonarFileHits
- RubrikSonarOpenAccessFileHits
- RubrikSonarOpenAccessFiles
- RubrikSonarSensitiveHits
- RubrikSonarSetIncidentSeverityUsingUserRiskLevel
- RubrikSonarTotalHits
- RubrikSuspiciousFileCount
README
With the prevalence of ransomware in today’s environment, it’s no longer a question of if you’ll be infected but when. Thick walls are no longer enough. When attacks due occur, your choices are to on average pay $847,344 or be down on average for 7+ days. The Rubrik Polaris data firewall allows you to change that conversation by offering:
- An immutable file system that ensures backups cannot be deleted or modified
- The ability to identify anomalies, data classification and assess impact
- Initiate 1-click granular file recoveries
These unique features allow you to move beyond simple backup and recovery into protection from the point of data.
What does this pack do?
When responding to real world threats – not theory real world – you have to quickly build context and then push changes to begin remediation process. You can’t do that without a platform of automation.
So as much time as well spend on our UI/UX, we recognize how important it is to take the information we gather and have it available in Cortex XSOAR where you live on a day in and day out basis. And then more importantly start correlating that data into a more holistic threat picture.
When Rubrik Polaris Radar detects a new anomaly event, a Cortex XSOAR incident will automatically be created for the event. Once created, the incident will also utilize the Rubrik Sonar capabilities to determine if any sensitive data was potentially exposed to data exfiltration.
