Rubrik DSPM Violation Remediation - Rubrik Security Cloud

This playbook remediates DSPM violations by retrieving violation details and affected file information, downloading the affected file details and remediation logs as CSV files, quarantining the affected files and updating the violation status.
Rubrik Security Cloud · 19 tasks · 6 inputs · 0 outputs
Details

ID	`Rubrik DSPM Violation Remediation - Rubrik Security Cloud`
From Version	6.10.0
Tasks	19
README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Rubrik Quarantine Files General
Integrations

This playbook does not use any integrations.
Scripts

DeleteContext
RubrikPullDSPMViolationFileInformation
RubrikPullDSPMViolationInformation
Set
Commands

rubrik-data-security-violation-csv-download
rubrik-data-security-violation-log-download
rubrik-data-security-violation-status-update
Playbook Inputs

Name	Description	Default Value	Required
violation_id	The ID of the DSPM violation. Note: Users can get the violation ID by executing the “rubrik-data-security-violation-list” command.	incident.rubrikviolationid	Optional
object_id	The object ID. Note: Users can retrieve the object ID by executing the “rubrik-polaris-objects-list” command.	incident.rubrikpolarisobjectid	Optional
snapshot_id	The snapshot ID. Note: Users can retrieve the snapshot ID by executing the “rubrik-polaris-object-snapshot-list” command.	incident.rubriksnapshotid	Optional
object_name	The object Name. Note: If not specified playbook will retrieve it using the “rubrik-data-security-violation-get” command.	incident.rubrikpolarisobjectname	Optional
limit	Number of results to retrieve in the response. The maximum allowed size is 1000.	1000	Optional
quarantine_folder_id	The ID of the quarantine folder where the affected files will be moved.		Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Rubrik DSPM Violation Remediation - Rubrik Security Cloud
Inputs

violation_id — The ID of the DSPM violation. Note: Users can get the violation ID by executing the "rubrik-data-security-violation-list" command.
object_id — The object ID. Note: Users can retrieve the object ID by executing the "rubrik-polaris-objects-list" command.
snapshot_id — The snapshot ID. Note: Users can retrieve the snapshot ID by executing the "rubrik-polaris-object-snapshot-list" command.
object_name — The object Name. Note: If not specified playbook will retrieve it using the "rubrik-data-security-violation-get" command.
limit — Number of results to retrieve in the response. The maximum allowed size is 1000.
quarantine_folder_id — The ID of the quarantine folder where the affected files will be moved.
Commands used

rubrik-data-security-violation-csv-download rubrik-data-security-violation-log-download rubrik-data-security-violation-status-update
Flowchart

Source

playbook-Rubrik_DSPM_Violation_Remediation_-_Rubrik_Security_Cloud.yml
Download History Raw
id: Rubrik DSPM Violation Remediation - Rubrik Security Cloud
version: -1
name: Rubrik DSPM Violation Remediation - Rubrik Security Cloud
description: This playbook remediates DSPM violations by retrieving violation details and affected file information, downloading the affected file details and remediation logs as CSV files, quarantining the affected files and updating the violation status.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 386b67db-16c0-44e2-8d22-0979c7265754
    type: start
    task:
      id: 386b67db-16c0-44e2-8d22-0979c7265754
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 367.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 71f679f7-fd6e-4024-8c20-62917cd2edd6
    type: condition
    task:
      id: 71f679f7-fd6e-4024-8c20-62917cd2edd6
      version: -1
      name: Is Rubrik Security Cloud integration enabled?
      description: Checks whether Rubrik Security Cloud integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RubrikPolaris
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 367.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 4d4f1f45-7b1c-4b35-8b1e-7aa26e98363e
    type: regular
    task:
      id: 4d4f1f45-7b1c-4b35-8b1e-7aa26e98363e
      version: -1
      name: Set the delete keys
      description: Set the custom context keys to delete.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: delete_keys_for_rubrik_dspm_violation_remediation_playbook
      value:
        simple: Collect DSPM violation Information, Provide the Update status for the violation, FileInformation
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: aead3c76-e168-467e-85f6-6405dd454c75
    type: regular
    task:
      id: aead3c76-e168-467e-85f6-6405dd454c75
      version: -1
      name: Clear Previous Inputs
      description: Delete the custom keys from the context.
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        complex:
          root: delete_keys_for_rubrik_dspm_violation_remediation_playbook
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: aea8f33d-dccc-409d-8246-6e638bd83b22
    type: condition
    task:
      id: aea8f33d-dccc-409d-8246-6e638bd83b22
      version: -1
      name: Check whether the DSPM Violation information is available in playbook input
      description: Check whether the violation ID, object ID and snapshot ID are available or not in the playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "YES":
      - "7"
    separatecontext: false
    conditions:
    - label: "YES"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.violation_id
                transformers:
                - operator: trim
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.object_id
                transformers:
                - operator: trim
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.snapshot_id
                transformers:
                - operator: trim
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: bf69965d-4f1e-40e9-8fcc-ab1ee72ba2c1
    type: collection
    task:
      id: bf69965d-4f1e-40e9-8fcc-ab1ee72ba2c1
      version: -1
      name: Collect the DSPM violation information
      description: Collecting violation ID, object ID and snapshot ID to retrieve the DSPM violation and violation files data.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Please provide the violation ID, object ID and snapshot ID.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Specify the Violation ID.
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: 'The DSPM violation ID. Note: Users can get the violation ID by executing the "rubrik-data-security-violation-list" command.'
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Specify the Object ID.
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: 'The Object ID. Note: Users can retrieve the object ID by executing the "rubrik-polaris-objects-list" command.'
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: Specify the Snapshot ID.
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: 'The Snapshot ID. Note: Users can retrieve the snapshot ID by executing the "rubrik-polaris-object-snapshot-list" command.'
        readonly: false
      title: Collect DSPM violation Information
      description: ""
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 2fe902fd-4a92-4769-8cd3-c7ef121543d5
    type: title
    task:
      id: 2fe902fd-4a92-4769-8cd3-c7ef121543d5
      version: -1
      name: Sync the Violation Information
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
      - "9"
      - "10"
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 9d9899c7-3ca1-4575-8f41-07095199618e
    type: regular
    task:
      id: 9d9899c7-3ca1-4575-8f41-07095199618e
      version: -1
      name: Retrieve DSPM violation files information
      description: Syncs the violation file information from RSC to XSOAR.
      scriptName: RubrikPullDSPMViolationFileInformation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      extend-context:
        simple: FileInformation=data.policyObj.fileResultConnection.edges={"path":val.node.stdPath,"name":val.node.filename }
      limit:
        complex:
          root: inputs.limit
          transformers:
          - operator: trim
      object_id:
        complex:
          root: inputs.object_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.1
                iscontext: true
          - operator: trim
      snapshot_id:
        complex:
          root: inputs.snapshot_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.2
                iscontext: true
          - operator: trim
      violation_id:
        complex:
          root: inputs.violation_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.0
                iscontext: true
          - operator: trim
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: acda9f44-1660-446c-8d62-8a37a729d195
    type: regular
    task:
      id: acda9f44-1660-446c-8d62-8a37a729d195
      version: -1
      name: Download the files at risk CSV file
      description: Download all files at risk as CSV file for the specified data security violation.
      script: '|||rubrik-data-security-violation-csv-download'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      object_id:
        complex:
          root: inputs.object_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.1
                iscontext: true
          - operator: trim
      object_name:
        complex:
          root: inputs.object_name
          transformers:
          - operator: trim
      snapshot_id:
        complex:
          root: inputs.snapshot_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.2
                iscontext: true
          - operator: trim
      violation_id:
        complex:
          root: inputs.violation_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.0
                iscontext: true
          - operator: trim
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 30bcf7db-f31b-4cfd-8730-d79b34c18c90
    type: regular
    task:
      id: 30bcf7db-f31b-4cfd-8730-d79b34c18c90
      version: -1
      name: Download the remediation Log file
      description: Download remediation logs as CSV file for the specified data security violation.
      script: '|||rubrik-data-security-violation-log-download'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      object_id:
        complex:
          root: inputs.object_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.1
                iscontext: true
          - operator: trim
      object_name:
        complex:
          root: inputs.object_name
          transformers:
          - operator: trim
      violation_id:
        complex:
          root: inputs.violation_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.0
                iscontext: true
          - operator: trim
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: d8395560-cd02-4161-8961-bf3e55ed0e33
    type: condition
    task:
      id: d8395560-cd02-4161-8961-bf3e55ed0e33
      version: -1
      name: Whether to update the status of the violation
      description: Update the status of DSPM violation?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "No":
      - "14"
      "Yes":
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 2035
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Update the status of violation?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 59db632f-fbe3-4d3b-8ce1-b95851d157b8
    type: collection
    task:
      id: 59db632f-fbe3-4d3b-8ce1-b95851d157b8
      version: -1
      name: Collect the new status of the violation
      description: Collect the new status of the DSPM violation.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 2210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Collect the status of DSPM violation
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Specify status to update for violation.
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - {}
        - simple: OPEN
        - simple: IN_PROGRESS
        - simple: REMEDIATED
        - simple: DISMISSED
        - simple: CLOSED
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Provide the Update status for the violation
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 7c6bd1e2-933d-4020-84b4-dd715474908b
    type: regular
    task:
      id: 7c6bd1e2-933d-4020-84b4-dd715474908b
      version: -1
      name: Update the status of the DSPM violation
      description: Updates the status of the DSPM violation.
      script: '|||rubrik-data-security-violation-status-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      status:
        complex:
          root: Provide the Update status for the violation.Answers
          accessor: "0"
          transformers:
          - operator: trim
      violation_id:
        complex:
          root: inputs.violation_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.0
                iscontext: true
          - operator: trim
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 2385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: a939017b-6071-4ee9-8d0e-fca3db38ba00
    type: title
    task:
      id: a939017b-6071-4ee9-8d0e-fca3db38ba00
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 390,
          "y": 2560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: a859db50-f365-4b6d-8f15-c905a1c420f7
    type: regular
    task:
      id: a859db50-f365-4b6d-8f15-c905a1c420f7
      version: -1
      name: Retrieve DSPM violation data
      description: Syncs the DSPM violation information from RSC to XSOAR.
      scriptName: RubrikPullDSPMViolationInformation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      violation_id:
        complex:
          root: inputs.violation_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect DSPM violation Information.Answers.0
                iscontext: true
          - operator: trim
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 31ad4689-454b-4cb7-86cc-ac6e05ec3cf0
    type: title
    task:
      id: 31ad4689-454b-4cb7-86cc-ac6e05ec3cf0
      version: -1
      name: Quarantine the files
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 4b9f6038-6906-4394-82ec-f6ea55a53983
    type: title
    task:
      id: 4b9f6038-6906-4394-82ec-f6ea55a53983
      version: -1
      name: Update the violation status
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 7636b0e5-20f4-4129-8192-313087e2fda1
    type: condition
    task:
      id: 7636b0e5-20f4-4129-8192-313087e2fda1
      version: -1
      name: Are the file paths available?
      description: Checks whether the file paths of the affected files are available in the incident context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FileInformation
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 1545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 4490422a-f1ea-4583-8f21-9a4e39c9b452
    type: playbook
    task:
      id: 4490422a-f1ea-4583-8f21-9a4e39c9b452
      version: -1
      name: Rubrik Quarantine Files General
      description: This playbook quarantines files using the Microsoft Graph Search (O365 File Management) integration.
      playbookName: Rubrik Quarantine Files General
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      file_information:
        complex:
          root: FileInformation
          transformers:
          - operator: Stringify
      quarantine_folder_id:
        complex:
          root: inputs.quarantine_folder_id
          transformers:
          - operator: trim
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 950,
          "y": 1720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "11_12_Yes": 0.5,
      "11_14_No": 0.53,
      "19_18_#default#": 0.44,
      "19_20_yes": 0.55,
      "1_14_#default#": 0.28,
      "1_2_yes": 0.46,
      "4_5_#default#": 0.56,
      "4_7_YES": 0.52
    },
    "paper": {
      "dimensions": {
        "height": 2575,
        "width": 1670,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: violation_id
  value:
    complex:
      root: incident
      accessor: rubrikviolationid
  required: false
  description: |-
    The ID of the DSPM violation.

    Note: Users can get the violation ID by executing the "rubrik-data-security-violation-list" command.
  playbookInputQuery:
- key: object_id
  value:
    complex:
      root: incident
      accessor: rubrikpolarisobjectid
  required: false
  description: |-
    The object ID.

    Note: Users can retrieve the object ID by executing the "rubrik-polaris-objects-list" command.
  playbookInputQuery:
- key: snapshot_id
  value:
    complex:
      root: incident
      accessor: rubriksnapshotid
  required: false
  description: |-
    The snapshot ID.

    Note: Users can retrieve the snapshot ID by executing the "rubrik-polaris-object-snapshot-list" command.
  playbookInputQuery:
- key: object_name
  value:
    complex:
      root: incident
      accessor: rubrikpolarisobjectname
  required: false
  description: |-
    The object Name.

    Note: If not specified playbook will retrieve it using the "rubrik-data-security-violation-get" command.
  playbookInputQuery:
- key: limit
  value:
    simple: "1000"
  required: false
  description: Number of results to retrieve in the response. The maximum allowed size is 1000.
  playbookInputQuery:
- key: quarantine_folder_id
  value: {}
  required: false
  description: The ID of the quarantine folder where the affected files will be moved.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0