Rubrik IR Violation Remediation - Rubrik Security Cloud

This playbook remediates Identity Resilience (IR) violations by retrieving the latest violation details and updating the violation status.

Rubrik Security Cloud · 13 tasks · 2 inputs · 0 outputs

Details

ID	`Rubrik IR Violation Remediation - Rubrik Security Cloud`
From Version	6.10.0
Tasks	13

README

This playbook remediates Identity Resilience (IR) violations by retrieving the latest violation details and updating the violation status.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

DeleteContext
RubrikPullIRViolationInformation
Set

Commands

rubrik-identity-resilience-violation-status-update

Playbook Inputs

Name	Description	Default Value	Required
violation_id	The ID of the IR violation. Note: Users can get the violation ID by executing the “rubrik-identity-resilience-violation-list” command.	incident.rubrikviolationid	Optional
policy_type	The policy type of the violation. Note: Users can get the policy type by executing the “rubrik-identity-resilience-violation-list” command. Possible values are: IDENTITY, IDP, IDENTITY_EVENT, CROWDSTRIKE, MICROSOFT_DEFENDER	incident.policytype	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Rubrik IR Violation Remediation - Rubrik Security Cloud

Inputs

violation_id — The ID of the IR violation. Note: Users can get the violation ID by executing the "rubrik-identity-resilience-violation-list" command.
policy_type — The policy type of the violation. Note: Users can get the policy type by executing the "rubrik-identity-resilience-violation-list" command. Possible values are: IDENTITY, IDP, IDENTITY_EVENT, CROWDSTRIKE, MICROSOFT_DEFENDER

Commands used

rubrik-identity-resilience-violation-status-update

Flowchart

Source

playbook-Rubrik_IR_Violation_Remediation_-_Rubrik_Security_Cloud.yml

Download History Raw

id: Rubrik IR Violation Remediation - Rubrik Security Cloud
version: -1
name: Rubrik IR Violation Remediation - Rubrik Security Cloud
description: This playbook remediates Identity Resilience (IR) violations by retrieving the latest violation details and updating the violation status.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 3370187a-8eba-4181-82f1-a7323b71eb21
    type: start
    task:
      id: 3370187a-8eba-4181-82f1-a7323b71eb21
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 597.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 6be7d9bb-55d7-4c18-8999-ee4b6f9020a4
    type: condition
    task:
      id: 6be7d9bb-55d7-4c18-8999-ee4b6f9020a4
      version: -1
      name: Is Rubrik Security Cloud integration enabled?
      description: Checks whether Rubrik Security Cloud integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RubrikPolaris
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 597.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: f27eaa4e-1954-4615-85c4-8043a3b99105
    type: regular
    task:
      id: f27eaa4e-1954-4615-85c4-8043a3b99105
      version: -1
      name: Set the delete keys
      description: Set the custom context keys to delete.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: delete_keys_for_rubrik_ir_violation_remediation_playbook
      value:
        simple: Collect IR violation Information, Provide the Update status for the violation
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: dfbf1f41-1c8c-4108-83f6-0a76a79a5ba2
    type: regular
    task:
      id: dfbf1f41-1c8c-4108-83f6-0a76a79a5ba2
      version: -1
      name: Clear Previous Inputs
      description: Delete the custom keys from the context.
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        complex:
          root: delete_keys_for_rubrik_ir_violation_remediation_playbook
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 5382a26a-4b5d-4100-802f-6a1f18455e1c
    type: condition
    task:
      id: 5382a26a-4b5d-4100-802f-6a1f18455e1c
      version: -1
      name: Check whether the IR Violation information is available in playbook input
      description: Check whether the violation ID is available in the playbook input or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "YES":
      - "6"
    separatecontext: false
    conditions:
    - label: "YES"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.violation_id
                transformers:
                - operator: trim
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 6c65bc85-b036-4556-82d3-7cb34f8581ec
    type: collection
    task:
      id: 6c65bc85-b036-4556-82d3-7cb34f8581ec
      version: -1
      name: Collect the IR violation information
      description: Collecting violation ID, policy type to retrieve the IR violation data.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1000,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Please provide the violation ID and policy type.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Specify the Violation ID.
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: 'The IR violation ID. Note: Users can get the violation ID by executing the "rubrik-identity-resilience-violation-list" command.'
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Specify the Policy type.
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - {}
        - simple: IDENTITY
        - simple: IDP
        - simple: IDENTITY_EVENT
        - simple: CROWDSTRIKE
        - simple: MICROSOFT_DEFENDER
        fieldassociated: ""
        placeholder: ""
        tooltip: 'The policy type of the violation. Note: Users can get the violation ID by executing the "rubrik-identity-resilience-violation-list" command.'
        readonly: false
      title: Collect IR violation Information
      description: ""
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 799615be-aa57-4e48-836a-cc9a8598294c
    type: title
    task:
      id: 799615be-aa57-4e48-836a-cc9a8598294c
      version: -1
      name: Sync the Violation Information
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: a8db1237-bb5c-4bbf-8780-90a8366bc099
    type: regular
    task:
      id: a8db1237-bb5c-4bbf-8780-90a8366bc099
      version: -1
      name: Retrieve IR violation data
      description: Syncs the IR violation information from RSC to Cortex XSOAR.
      scriptName: RubrikPullIRViolationInformation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      policy_type:
        complex:
          root: inputs.policy_type
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect IR violation Information.Answers.1
                iscontext: true
          - operator: trim
      violation_id:
        complex:
          root: inputs.violation_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect IR violation Information.Answers.0
                iscontext: true
          - operator: trim
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 82755731-81fd-4fe1-8f94-a4ff2b2f8980
    type: condition
    task:
      id: 82755731-81fd-4fe1-8f94-a4ff2b2f8980
      version: -1
      name: Whether to update the status of the violation
      description: Update the status of IR violation?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "No":
      - "11"
      "Yes":
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Update the status of violation?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: aa16c86d-2c75-45fd-848a-d58d45f1036b
    type: collection
    task:
      id: aa16c86d-2c75-45fd-848a-d58d45f1036b
      version: -1
      name: Collect the new status of the violation
      description: Collect the new status of the IR violation.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Collect the status of IR violation
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Specify status to update for violation.
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - {}
        - simple: OPEN
        - simple: IN_PROGRESS
        - simple: REMEDIATED
        - simple: DISMISSED
        - simple: CLOSED
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Provide the Update status for the violation
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 2dba504a-c117-4f89-8edc-d272da68c7da
    type: regular
    task:
      id: 2dba504a-c117-4f89-8edc-d272da68c7da
      version: -1
      name: Update the status of the IR violation
      description: Updates the status of the Identity Resilience (IR) violation.
      script: '|||rubrik-identity-resilience-violation-status-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      status:
        complex:
          root: Provide the Update status for the violation.Answers
          accessor: "0"
          transformers:
          - operator: trim
      violation_id:
        complex:
          root: inputs.violation_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect IR violation Information.Answers.0
                iscontext: true
          - operator: trim
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 1f8ddc81-5020-4953-86ef-4e17b87a4410
    type: title
    task:
      id: 1f8ddc81-5020-4953-86ef-4e17b87a4410
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 2050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: f1dc08e6-ad19-474c-8a61-076bb6a7c409
    type: title
    task:
      id: f1dc08e6-ad19-474c-8a61-076bb6a7c409
      version: -1
      name: Update the violation status
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_11_#default#": 0.44,
      "1_2_yes": 0.52,
      "4_5_#default#": 0.48,
      "4_6_YES": 0.49,
      "8_11_No": 0.4,
      "8_9_Yes": 0.49
    },
    "paper": {
      "dimensions": {
        "height": 2065,
        "width": 880,
        "x": 500,
        "y": 50
      }
    }
  }
inputs:
- key: violation_id
  value:
    complex:
      root: incident
      accessor: rubrikviolationid
  required: false
  description: |-
    The ID of the IR violation.

    Note: Users can get the violation ID by executing the "rubrik-identity-resilience-violation-list" command.
  playbookInputQuery:
- key: policy_type
  value:
    complex:
      root: incident
      accessor: policytype
  required: false
  description: |-
    The policy type of the violation.

    Note: Users can get the policy type by executing the "rubrik-identity-resilience-violation-list" command.

    Possible values are: IDENTITY, IDP,
    IDENTITY_EVENT, CROWDSTRIKE, MICROSOFT_DEFENDER
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0