Rubrik Polaris - Anomaly Analysis

id: Rubrik Polaris - Anomaly Analysis
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Rubrik Polaris - Anomaly Analysis
description: Monitor the progress of a Rubrik Radar anomaly event and use Rubrik Sonar
  to check for data classification hits.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: fae6d763-0cba-4538-896c-862699022d87
    type: start
    task:
      id: fae6d763-0cba-4538-896c-862699022d87
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 783581c3-eef8-4931-86a6-c7936b51aeca
    type: regular
    task:
      id: 783581c3-eef8-4931-86a6-c7936b51aeca
      version: -1
      name: Gather the final Radar Analysis results
      description: Retrieve the list of events.
      script: '|||rubrik-event-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      activity_type:
        simple: ANOMALY
      cluster_id:
        complex:
          root: incident
          accessor: rubrikcdmclusterid
      limit:
        simple: "1"
      object_name:
        complex:
          root: incident
          accessor: rubrikpolarisobjectname
      sort_by:
        simple: START_TIME
      sort_order:
        simple: ASC
      start_date:
        complex:
          root: incident
          accessor: rubrikpolarisstarttime
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 9af2f271-c367-4627-85be-1e8a66a41390
    type: playbook
    task:
      id: 9af2f271-c367-4627-85be-1e8a66a41390
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      AdditionalPollingCommandArgNames:
        simple: activity_type,cluster_id,start_date,limit,sort_by,sort_order
      AdditionalPollingCommandArgValues:
        simple: ANOMALY,${incident.rubrikcdmclusterid},${incident.rubrikpolarisstarttime},1,START_TIME,ASC
      Ids:
        complex:
          root: incident
          accessor: rubrikpolarisobjectname
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: object_name
      PollingCommandName:
        simple: rubrik-event-list
      Timeout:
        simple: "1440"
      dt:
        simple: RubrikPolaris.Event(val.lastActivityStatus==='Running').objectName
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 02559b35-31f4-42fa-8379-5deb11c47a65
    type: title
    task:
      id: 02559b35-31f4-42fa-8379-5deb11c47a65
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 068289d2-c787-4823-826e-89faa4f345ef
    type: regular
    task:
      id: 068289d2-c787-4823-826e-89faa4f345ef
      version: -1
      name: Determine the status of the Rubrik Radar analysis process
      description: Retrieve the list of events.
      script: '|||rubrik-event-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      activity_type:
        simple: ANOMALY
      cluster_id:
        complex:
          root: incident
          accessor: rubrikcdmclusterid
      limit:
        simple: "1"
      object_name:
        complex:
          root: incident
          accessor: rubrikpolarisobjectname
      sort_by:
        simple: START_TIME
      sort_order:
        simple: ASC
      start_date:
        complex:
          root: incident
          accessor: rubrikpolarisstarttime
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 4dab685b-3e8a-4fcf-857a-7d6cc4a0e9e7
    type: title
    task:
      id: 4dab685b-3e8a-4fcf-857a-7d6cc4a0e9e7
      version: -1
      name: Radar Ransomware Status
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 8990b8c2-2a13-4ca4-8756-0e1a80596490
    type: title
    task:
      id: 8990b8c2-2a13-4ca4-8756-0e1a80596490
      version: -1
      name: Sonar Data Classification
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 705
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9d0dfc71-9d39-4b4c-845f-ab3edaecc67e
    type: regular
    task:
      id: 9d0dfc71-9d39-4b4c-845f-ab3edaecc67e
      version: -1
      name: rubrik-sonar-sensitive-hits
      description: Find data classification hits on an object.
      script: '|||rubrik-sonar-sensitive-hits'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      objectName:
        complex:
          root: incident
          accessor: rubrikpolarisobjectname
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 388dc4fb-31fb-4210-8d40-1d87aeb54e11
    type: regular
    task:
      id: 388dc4fb-31fb-4210-8d40-1d87aeb54e11
      version: -1
      name: Update the Incident Dashboard
      description: Change the properties of an incident.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      message:
        simple: ${Rubrik.Radar.Message}
      rubrikpolarisanalysispipeline:
        complex:
          root: RubrikPolaris.Event.activityConnection
          accessor: nodes
      rubrikpolariseventcompleted:
        complex:
          root: RubrikPolaris.Event
          accessor: lastActivityStatus
          transformers:
          - operator: If-Then-Else
            args:
              condition: {}
              else:
                value:
                  simple: "False"
              equals:
                value:
                  simple: Success
              lhs: {}
              options: {}
              rhs: {}
              then:
                value:
                  simple: "True"
      rubrikpolarislastactivitystatus:
        complex:
          root: RubrikPolaris.Event
          accessor: lastActivityStatus
      rubrikpolarismessage:
        simple: ${Rubrik.Radar.Message}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: b3323292-ac99-4a3a-89cd-afa3fcf71d1b
    type: regular
    task:
      id: b3323292-ac99-4a3a-89cd-afa3fcf71d1b
      version: -1
      name: rubrik-cdm-cluster-location
      description: Find the CDM GeoLocation of a CDM Cluster.
      script: '|||rubrik-cdm-cluster-location'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      clusterId:
        complex:
          root: incident
          accessor: rubrikcdmclusterid
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Rubrik CDM Cluster Location
      output:
        simple: ${Rubrik.CDM.Cluster.Location}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 344e4284-9b58-4e5a-87ab-c3d022818c2c
    type: regular
    task:
      id: 344e4284-9b58-4e5a-87ab-c3d022818c2c
      version: -1
      name: rubrik-cdm-cluster-connection-state
      description: Find the CDM Connection State of a CDM Cluster.
      script: '|||rubrik-cdm-cluster-connection-state'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      clusterId:
        complex:
          root: incident
          accessor: rubrikcdmclusterid
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: f294d116-8553-4886-8a91-18a6d0fae429
    type: condition
    task:
      id: f294d116-8553-4886-8a91-18a6d0fae429
      version: -1
      name: Is ransomware analysis running?
      description: Checks whether the events have succeeded.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: RubrikPolaris.Event
                accessor: lastActivityStatus
            iscontext: true
          right:
            value:
              simple: Running
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 66985f6c-2750-4060-8c77-6c1dad77aeaf
    type: condition
    task:
      id: 66985f6c-2750-4060-8c77-6c1dad77aeaf
      version: -1
      name: Is Rubrik Polaris integration enabled?
      description: Checks whether Rubrik Polaris integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "11"
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RubrikPolaris
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1405,
        "width": 932.5,
        "x": 50,
        "y": 50
      }
    }
  }
fromversion: 6.0.0
tests:
- RubrikPolaris-Test