Rubrik IR Violation Remediation - Rubrik Security Cloud

This playbook remediates Identity Resilience (IR) violations by retrieving the latest violation details and updating the violation status.

Rubrik Security Cloud · 13 tasks · 2 inputs · 0 outputs

Inputs

  • violation_id — The ID of the IR violation. Note: Users can get the violation ID by executing the "rubrik-identity-resilience-violation-list" command.
  • policy_type — The policy type of the violation. Note: Users can get the policy type by executing the "rubrik-identity-resilience-violation-list" command. Possible values are: IDENTITY, IDP, IDENTITY_EVENT, CROWDSTRIKE, MICROSOFT_DEFENDER

Commands used

rubrik-identity-resilience-violation-status-update

Flowchart

yes YES No Yes Start Start Is Rubrik Security Cloud integration enabled? Is Rubrik Security Cloud ... Set the delete keys - Set Set the delete keys Set Clear Previous Inputs - DeleteContext Clear Previous Inputs DeleteContext Check whether the IR Violation information is available in playbook input Check whether the IR Viol... Collect the IR violation information Collect the IR violation ... Sync the Violation Information Sync the Violation Inform... Retrieve IR violation data - RubrikPullIRViolationInformation Retrieve IR violation data RubrikPullIRViolationInformation Whether to update the status of the violation Whether to update the sta... Collect the new status of the violation Collect the new status of... Update the status of the IR violation - rubrik-identity-resilience-violation-status-update Update the status of the ... rubrik-identity-resilience-vi... Done Done Update the violation status Update the violation status