Rubrik Object Context Analysis - Rubrik Polaris

This playbook will investigate based on the object type from the Rubrik Anomaly incident to retrieve the policy hits of the files related to the object.

Rubrik Security Cloud · 5 tasks · 2 inputs · 0 outputs

Details

ID	`Rubrik Object Context Analysis - Rubrik Polaris`
From Version	6.5.0
Tasks	5

README

This playbook will investigate based on the object type from the Rubrik Anomaly incident to retrieve the policy hits of the files related to the object.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Rubrik File Context Analysis - Rubrik Polaris

Integrations

RubrikPolaris

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
object_id	The Object ID or the Snappable ID. Default can be received from incident if present.	incident.rubrikpolarisfid	Optional
object_type	The Object type. Default can be received from incident if present.	incident.rubrikpolarisobjecttype	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Rubrik Object Context Analysis - Rubrik Polaris

Inputs

object_id — The Object ID or the Snappable ID. Default can be received from incident if present.
object_type — The Object type. Default can be received from incident if present.

Commands used

rubrik-threat-monitoring-matched-object-get

Flowchart

Source

playbook-Rubrik_Object_Context_Analysis_-_Rubrik_Polaris.yml

Download History Raw

id: Rubrik Object Context Analysis - Rubrik Polaris
version: -1
name: Rubrik Object Context Analysis - Rubrik Polaris
description: This playbook will investigate based on the object type from the Rubrik Anomaly incident to retrieve the policy hits of the files related to the object.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6e742996-a6d3-4c02-871b-9e0e3baff532
    type: start
    task:
      id: 6e742996-a6d3-4c02-871b-9e0e3baff532
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d88be1fd-68cc-4416-8b0b-5b8e053f3ff7
    type: title
    task:
      id: d88be1fd-68cc-4416-8b0b-5b8e053f3ff7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: f4c4eade-6ee0-4516-83ea-05822456483c
    type: condition
    task:
      id: f4c4eade-6ee0-4516-83ea-05822456483c
      version: -1
      name: Is the object type Fileset, Volume Group, or VM?
      description: Checks whether the object type contains fileset, volume group or the VM.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "Yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.object_type
                transformers:
                - operator: trim
            iscontext: true
          right:
            value:
              simple: Fileset
          ignorecase: true
        - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.object_type
                transformers:
                - operator: trim
            iscontext: true
          right:
            value:
              simple: Vm
        - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.object_type
                transformers:
                - operator: trim
            iscontext: true
          right:
            value:
              simple: VolumeGroup
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 96cc3558-fdaa-4113-81cd-819d17611042
    type: playbook
    task:
      id: 96cc3558-fdaa-4113-81cd-819d17611042
      version: -1
      name: Rubrik File Context Analysis - Rubrik Polaris
      description: This playbook fetches file context information for the provided file, folder, or file share name and the object ID to get the policy hits.
      playbookName: Rubrik File Context Analysis - Rubrik Polaris
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      limit:
        simple: "50"
      object_id:
        complex:
          root: inputs.object_id
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 9629042c-938d-4f55-8bfe-ac9ceea6541a
    type: regular
    task:
      id: 9629042c-938d-4f55-8bfe-ac9ceea6541a
      version: -1
      name: Retrieve the object details
      description: Get the matched object for Threat Monitoring.
      script: '|||rubrik-threat-monitoring-matched-object-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      object_id:
        complex:
          root: inputs.object_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 472.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Rubrik Object Location
      output:
        complex:
          root: RubrikPolaris.ThreatMonitoring.logicalPath.name
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: RubrikPolaris.ThreatMonitoring.logicalPath.name
                iscontext: true
              right:
                value:
                  simple: vm
          transformers:
          - operator: ReverseList
          - operator: join
            args:
              separator:
                value:
                  simple: /
    skipunavailable: false
    quietmode: 1
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "7_5_#default#": 0.36,
      "7_8_Yes": 0.48
    },
    "paper": {
      "dimensions": {
        "height": 555,
        "width": 802.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: object_id
  value:
    complex:
      root: incident
      accessor: rubrikpolarisfid
  required: false
  description: The Object ID or the Snappable ID. Default can be received from incident if present.
  playbookInputQuery:
- key: object_type
  value:
    complex:
      root: incident
      accessor: rubrikpolarisobjecttype
  required: false
  description: The Object type. Default can be received from incident if present.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0