Rubrik Ransomware Discovery and File Recovery - Rubrik Polaris

This playbook performs an IOC Scan based on the provided inputs, search the recoverable snapshot and performs recovery on the searched recoverable snapshot. This playbook also creates tickets on ServiceNow using "ServiceNow v2" integration. Supported integrations: - RubrikPolaris - ServiceNow v2

Rubrik Security Cloud · 47 tasks · 2 inputs · 0 outputs

Inputs

  • ObjectId — Object ID of the incident.
  • ClusterId — Cluster ID of the incident.

Commands used

rubrik-gps-vm-recover-files rubrik-gps-vm-snapshot-create rubrik-polaris-vm-object-snapshot-list servicenow-add-comment servicenow-create-ticket servicenow-update-ticket

Flowchart

ERROR FINISHED RUNNING yes yes yes yes yes yes yes RUNNING SUCCESS yes yes yes yes yes Start Start Create Snapshot for evidence - rubrik-gps-vm-snapshot-create Create Snapshot for evidence rubrik-gps-vm-snapshot-create Is IOC scan successful? Is IOC scan successful? Add comment in SNOW Ticket - servicenow-add-comment Add comment in SNOW Ticket servicenow-add-comment Remediating the anomaly Remediating the anomaly Create SNOW Ticket - servicenow-create-ticket Create SNOW Ticket servicenow-create-ticket Done Done Close SNOW Ticket - servicenow-update-ticket Close SNOW Ticket servicenow-update-ticket Is Rubrik Polaris integration enabled? Is Rubrik Polaris integra... Is ServiceNow integration enabled? Is ServiceNow integration... Start IOC Scan Start IOC Scan Create Snapshot Create Snapshot Is BlockFile enabled? Is BlockFile enabled? Print records not found message - PrintErrorEntry Print records not found m... PrintErrorEntry List all Snapshots List all Snapshots List all Snapshots - rubrik-polaris-vm-object-snapshot-list List all Snapshots rubrik-polaris-vm-object-snap... Recover snapshot files - rubrik-gps-vm-recover-files Recover snapshot files rubrik-gps-vm-recover-files Print timeout message - PrintErrorEntry Print timeout message PrintErrorEntry Print error message - PrintErrorEntry Print error message PrintErrorEntry Print unknown status message - PrintErrorEntry Print unknown status message PrintErrorEntry Are there any recoverable snapshots? Are there any recoverable... Is SNOW Ticket created? Is SNOW Ticket created? Rubrik Poll Async Result - Rubrik Polaris - Rubrik Poll Async Result - Rubrik Polaris Rubrik Poll Async Result ... Rubrik Poll Async Result - Ru... Is recovery completed? Is recovery completed? Print success message - Print Print success message Print Print error message - PrintErrorEntry Print error message PrintErrorEntry Collect IOC Scan Data Collect IOC Scan Data Is object type VM? Is object type VM? Print error for not a VM object - PrintErrorEntry Print error for not a VM ... PrintErrorEntry Print success message - Print Print success message Print Rubrik Poll Async Result - Rubrik Polaris - Rubrik Poll Async Result - Rubrik Polaris Rubrik Poll Async Result ... Rubrik Poll Async Result - Ru... Is the snapshot created successfully? Is the snapshot created s... Print error message - PrintErrorEntry Print error message PrintErrorEntry Whether to fetch Yara rule(s) from a URL? Whether to fetch Yara rul... Fetch Yara rule(s) from file URL - http Fetch Yara rule(s) from f... http Is Snapshot creation started? Is Snapshot creation star... Recovery Recovery Set default value for IOC Yara Rule - Set Set default value for IOC... Set Has recovery started? Has recovery started? Print error message - PrintErrorEntry Print error message PrintErrorEntry Collect Recovery data Collect Recovery data Is recovery enabled? Is recovery enabled? Block File - Generic v2 - Block File - Generic v2 Block File - Generic v2 Block File - Generic v2 Rubrik IOC Scan - Rubrik Polaris - Rubrik IOC Scan - Rubrik Polaris Rubrik IOC Scan - Rubrik ... Rubrik IOC Scan - Rubrik Polaris Is the latest snapshot infected? Is the latest snapshot in... Print no recovery message - Print Print no recovery message Print Print timeout message - PrintErrorEntry Print timeout message PrintErrorEntry