Rubrik Data Object Discovery - Rubrik Polaris

Data discovery of the object available in the incident.

Rubrik Security Cloud · 11 tasks · 2 inputs · 0 outputs

Details

IDRubrik Data Object Discovery - Rubrik Polaris
From Version6.0.0
Tasks11

README

Data discovery of the object available in the incident.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Rubrik List Snapshots - Rubrik Polaris

Integrations

This playbook does not use any integrations.

Scripts

  • PrintErrorEntry
  • Print

Commands

  • rubrik-polaris-object-snapshot-list
  • rubrik-polaris-object-search

Playbook Inputs


Name Description Default Value Required
object_name Name of the object to discover. incident.rubrikpolarisobjectname Optional
object_id ID of the object to discover. incident.rubrikpolarisfid Optional

Playbook Outputs


There are no outputs for this playbook.

Playbook Image


Rubrik Data Object Discovery - Rubrik Polaris

Inputs

  • object_name — Name of the object to discover.
  • object_id — ID of the object to discover.

Commands used

rubrik-polaris-object-search rubrik-polaris-object-snapshot-list

Flowchart

yes yes yes yes Start Start Search the global objects - rubrik-polaris-object-search Search the global objects rubrik-polaris-object-search Is there an Object Name? Is there an Object Name? Is there an Object ID? Is there an Object ID? Done Done List the snapshots for all objects - rubrik-polaris-object-snapshot-list List the snapshots for al... rubrik-polaris-object-snapsho... Is Snapshot data returned? Is Snapshot data returned? Data not found - Print Data not found Print Input required - PrintErrorEntry Input required PrintErrorEntry Is Rubrik Polaris Integration enabled? Is Rubrik Polaris Integra... Rubrik List Snapshots - Rubrik Polaris - Rubrik List Snapshots - Rubrik Polaris Rubrik List Snapshots - R... Rubrik List Snapshots - Rubri...
id: Rubrik Data Object Discovery - Rubrik Polaris
version: -1
name: Rubrik Data Object Discovery - Rubrik Polaris
description: Data discovery of the object available in the incident.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 24cb6f30-e8dc-4c2b-87b8-0a3a9187cbef
    type: start
    task:
      id: 24cb6f30-e8dc-4c2b-87b8-0a3a9187cbef
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: d7d4d0c6-63b5-49b8-8178-0b8f765cc8c4
    type: regular
    task:
      id: d7d4d0c6-63b5-49b8-8178-0b8f765cc8c4
      version: -1
      name: Search the global objects
      description: Search for Rubrik discovered objects of any type, return zero or more matches.
      script: '|||rubrik-polaris-object-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      object_name:
        complex:
          root: inputs.object_name
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1032.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 33f43136-82bc-4252-8c1b-1bc9f27179f7
    type: condition
    task:
      id: 33f43136-82bc-4252-8c1b-1bc9f27179f7
      version: -1
      name: Is there an Object Name?
      description: Checks whether object_name input is available or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.object_name
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 83c77205-1816-42f3-8990-96ff53fff43c
    type: condition
    task:
      id: 83c77205-1816-42f3-8990-96ff53fff43c
      version: -1
      name: Is there an Object ID?
      description: Checks whether object_id input is available or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "21"
      "yes":
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.object_id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 6d6199c7-359e-4b93-88a2-4563819724da
    type: title
    task:
      id: 6d6199c7-359e-4b93-88a2-4563819724da
      version: -1
      name: Done
      description: |-
        Pretty-print data using Python's pprint library.  This is useful for seeing the structure of incident and context data.  Here's how to use it:

        !PrettyPrint value=${incident}
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: a1bf2bfb-d0b4-4517-8f92-24107e58d963
    type: regular
    task:
      id: a1bf2bfb-d0b4-4517-8f92-24107e58d963
      version: -1
      name: List the snapshots for all objects
      description: Retrieve Rubrik snapshot(s) of an object, based on the provided object ID.
      script: '|||rubrik-polaris-object-snapshot-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      object_id:
        complex:
          root: inputs.object_id
      sort_order:
        simple: DESC
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 4e9a4364-0d16-4012-88a1-507df2b0cc57
    type: condition
    task:
      id: 4e9a4364-0d16-4012-88a1-507df2b0cc57
      version: -1
      name: Is Snapshot data returned?
      description: Checks certain fields related to Snapshot.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RubrikPolaris.Object
                accessor: id
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RubrikPolaris.Object.Snapshot
                accessor: id
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RubrikPolaris.Object.Snapshot
                accessor: date
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 93a50774-ba34-46b1-8849-699ffee3d955
    type: regular
    task:
      id: 93a50774-ba34-46b1-8849-699ffee3d955
      version: -1
      name: Data not found
      description: Prints text to war room (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      value:
        simple: No data for this type was obtained
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 50b28a50-9fa6-41a2-8a46-e7862ceab984
    type: regular
    task:
      id: 50b28a50-9fa6-41a2-8a46-e7862ceab984
      version: -1
      name: Input required
      description: Prints an error entry with a message.
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      message:
        simple: Either object_name or object_id input must be provided.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 00f6cfe8-f764-45b9-85e4-4b7a8c2f6c1c
    type: condition
    task:
      id: 00f6cfe8-f764-45b9-85e4-4b7a8c2f6c1c
      version: -1
      name: Is Rubrik Polaris Integration enabled?
      description: Skips the playbook if no enabled Rubrik Polaris integration is found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RubrikPolaris
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 8171d0d4-7bf0-45be-8130-cfd5f1a0ba42
    type: playbook
    task:
      id: 8171d0d4-7bf0-45be-8130-cfd5f1a0ba42
      version: -1
      name: Rubrik List Snapshots - Rubrik Polaris
      description: List snapshots for all objects.
      playbookName: Rubrik List Snapshots - Rubrik Polaris
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      object_id:
        complex:
          root: RubrikPolaris.GlobalSearchObject
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: RubrikPolaris.GlobalSearchObject.name
                iscontext: true
              right:
                value:
                  simple: inputs.object_name
                iscontext: true
          accessor: id
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
      forEach: true
    view: |-
      {
        "position": {
          "x": 1032.5,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 1362.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
  - key: object_name
    value:
      complex:
        root: incident
        accessor: rubrikpolarisobjectname
    required: false
    description: Name of the object to discover.
    playbookInputQuery:
  - key: object_id
    value:
      complex:
        root: incident
        accessor: rubrikpolarisfid
    required: false
    description: ID of the object to discover.
    playbookInputQuery:
outputs: []
tests:
- RubrikPolaris-Test
fromversion: 6.0.0