Rubrik IOC Scan - Rubrik Polaris

This playbook starts an IOC Scan with the provided IOC values. It can be looped until recoverable snapshots are obtained or the limit to loop is reached.

Rubrik Security Cloud · 38 tasks · 17 inputs · 3 outputs

Inputs

  • ClusterId — Cluster ID of the object.
  • ObjectId — ID of the object.
  • StartDate — Start Date for IOC Scan. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Examples of more supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates.
  • EndDate — End Date for IOC Scan. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. Examples of more supported values can be found at https://dateparser.readthedocs.io/en/latest/#relative-dates.
  • IOCPath — Path of IOC to scan. Supports comma separated multiple values. Note: Do not provide quoted values.
  • IOCHash — Hash of IOC to scan. Supports comma separated multiple values. Note: Do not provide quoted values.
  • IOCYaraRule — Yara Rule(s) for IOC scan. Note: Do not provide quoted values.
  • PollingInterval — Frequency that the IOC scan command will run (minutes).
  • PollingTimeout — Amount of time to poll before declaring a timeout and resuming the playbook (in minutes).
  • TimeDelta — Provide the time delta to move backward while looping to find out the recoverable snapshot. If not provided, it defaults to the time difference between provided start date, and end date.
  • PathsToInclude — Paths to include in the scan. Supports comma separated values. Format accepted: path_to_include_1, path_to_include_2
  • PathsToExclude — Paths to exclude from the scan. Supports comma separated values. Format accepted: path_to_exclude_1, path_to_exclude_2
  • PathsToExempt — Paths to exempt from exclusion. Supports comma separated values. Format accepted: path_to_exempt_1, path_to_exempt_2
  • Limit — The maximum number of times to run IOC scans to find recoverable snapshot.
  • RequestedHashType — The type of the hash values of the matched files to be blocked, if enabled.
  • ScanName — Name of the scan. Default value is "PAXSOAR-1.1.0".
  • MaxFileSize — Maximum size of the file in bytes that will be included in the scan. The maximum allowed size is 15000000 bytes.

Outputs

  • RubrikPolaris.RecoverableSnapshot.id — ID of the snapshot that can be recovered.
  • RubrikPolaris.RadarIOCScan — The results of the IOC scan.
  • RubrikPolaris.RecoverableSnapshot.isLatestInfected — Boolean value to indicate whether the newest snapshot is infected or not.

Commands used

rubrik-radar-ioc-scan rubrik-radar-ioc-scan-results

Flowchart

FINISHED yes yes yes yes yes yes yes yes yes yes Start Start Start IOC scan - rubrik-radar-ioc-scan Start IOC scan rubrik-radar-ioc-scan GenericPolling - GenericPolling GenericPolling GenericPolling Done Done Prepare IOC Path - Set Prepare IOC Path Set Prepare IOC Hash - Set Prepare IOC Hash Set Prepare Advance IOC - Set Prepare Advance IOC Set Get scan results - rubrik-radar-ioc-scan-results Get scan results rubrik-radar-ioc-scan-results Is scan successfull? Is scan successfull? Decrease limit - Set Decrease limit Set Set recoverable snapshots - Set Set recoverable snapshots Set Update the start date - Set Update the start date Set Update the end date - Set Update the end date Set Set limit to zero - Set Set limit to zero Set Convert start date to epochs - Set Convert start date to epochs Set Convert end date to epochs - Set Convert end date to epochs Set Is time delta available? Is time delta available? Is limit reached? Is limit reached? Update the start date using time delta - Set Update the start date usi... Set Prepare advance IOC value Prepare advance IOC value Skip IOC Scan Skip IOC Scan Set limit from input - Set Set limit from input Set Is limit set? Is limit set? Are there any recoverable snapshots? Are there any recoverable... Prepare IOC Yara Rule - Set Prepare IOC Yara Rule Set Is start date set? Is start date set? Is end date set? Is end date set? Set start date from input - Set Set start date from input Set Set end date from input - Set Set end date from input Set Set looping fields Set looping fields Is advance IOC prepared? Is advance IOC prepared? Start IOC scan Start IOC scan Update looping fields Update looping fields Is this the first playbook run? Is this the first playboo... Is the latest snapshot infected? Is the latest snapshot in... Set isLatestInfected to true - Set Set isLatestInfected to true Set Set isLatestInfected to false - Set Set isLatestInfected to f... Set Are recoverable snapshot ID(s) obtained? Are recoverable snapshot ...