Rubrik Ransomware Discovery and VM Recovery - Rubrik Polaris

Use this playbook to recover a virtual machine using the "RubrikPolaris" integration by either exporting or live-mounting a backup snapshot. This playbook also creates tickets on ServiceNow using "ServiceNow v2" integration. Supported integrations: - RubrikPolaris - ServiceNow v2

Rubrik Security Cloud · 52 tasks · 2 inputs · 0 outputs

Inputs

  • ObjectId — Object ID of the incident.
  • ClusterId — Cluster ID of the incident.

Commands used

rubrik-gps-vm-datastore-list rubrik-gps-vm-export rubrik-gps-vm-host-list rubrik-gps-vm-livemount rubrik-gps-vm-snapshot-create rubrik-polaris-vm-object-metadata-get servicenow-add-comment servicenow-create-ticket servicenow-update-ticket

Flowchart

ERROR FINISHED RUNNING yes yes yes LIVE-MOUNT yes yes yes yes RUNNING SUCCESS yes yes yes yes yes yes Start Start Create Snapshot for evidence - rubrik-gps-vm-snapshot-create Create Snapshot for evidence rubrik-gps-vm-snapshot-create Is IOC Scan successful? Is IOC Scan successful? Add comment in SNOW Ticket - servicenow-add-comment Add comment in SNOW Ticket servicenow-add-comment Is Object Type VM? Is Object Type VM? Create SNOW Ticket - servicenow-create-ticket Create SNOW Ticket servicenow-create-ticket Done Done Close SNOW Ticket - servicenow-update-ticket Close SNOW Ticket servicenow-update-ticket Is Rubrik Polaris integration enabled? Is Rubrik Polaris integra... Is ServiceNow integration enabled? Is ServiceNow integration... Start IOC Scan Start IOC Scan Create Snapshot Create Snapshot Print records not found message - PrintErrorEntry Print records not found m... PrintErrorEntry Which recovery to perform? Which recovery to perform? Print timeout message - PrintErrorEntry Print timeout message PrintErrorEntry Print error message - PrintErrorEntry Print error message PrintErrorEntry Print unknown status message - PrintErrorEntry Print unknown status message PrintErrorEntry Are there any recoverable snapshots? Are there any recoverable... Is SNOW Ticket created? Is SNOW Ticket created? Is recovery successfully completed? Is recovery successfully ... Print success message - Print Print success message Print Print error message - PrintErrorEntry Print error message PrintErrorEntry Live-Mount recovered snapshot - rubrik-gps-vm-livemount Live-Mount recovered snap... rubrik-gps-vm-livemount Export recovered snapshot - rubrik-gps-vm-export Export recovered snapshot rubrik-gps-vm-export Rubrik Poll Async Result - Rubrik Polaris - Rubrik Poll Async Result - Rubrik Polaris Rubrik Poll Async Result ... Rubrik Poll Async Result - Ru... Print error for not a VM object - PrintErrorEntry Print error for not a VM ... PrintErrorEntry Collect IOC scan and general recovery data Collect IOC scan and gene... Whether to fetch Yara rule(s) from a URL? Whether to fetch Yara rul... Fetch Yara rule(s) from file URL - http Fetch Yara rule(s) from f... http Collect recovery data for live-mounting VM Collect recovery data for... Collect recovery data for exporting VM Collect recovery data for... Rubrik Poll Async Result - Rubrik Polaris - Rubrik Poll Async Result - Rubrik Polaris Rubrik Poll Async Result ... Rubrik Poll Async Result - Ru... Is the snapshot created successfully? Is the snapshot created s... Print success message - Print Print success message Print Print error message - PrintErrorEntry Print error message PrintErrorEntry Has snapshot creation started? Has snapshot creation sta... Get VM metadata - rubrik-polaris-vm-object-metadata-get Get VM metadata rubrik-polaris-vm-object-meta... Set empty Yara rule in context - Set Set empty Yara rule in co... Set Get Vsphere Host ID - rubrik-gps-vm-host-list Get Vsphere Host ID rubrik-gps-vm-host-list Set default value of Host ID - SetAndHandleEmpty Set default value of Host ID SetAndHandleEmpty Get Vsphere Host ID - rubrik-gps-vm-host-list Get Vsphere Host ID rubrik-gps-vm-host-list Get Vsphere Datastore ID - rubrik-gps-vm-datastore-list Get Vsphere Datastore ID rubrik-gps-vm-datastore-list Is Vsphere host name provided? Is Vsphere host name prov... Is Vsphere host name provided? Is Vsphere host name prov... Has recovery started? Has recovery started? Print error message - PrintErrorEntry Print error message PrintErrorEntry Start VM recovery Start VM recovery Whether to perform recovery? Whether to perform recovery? Is the latest snapshot infected? Is the latest snapshot in... Rubrik IOC Scan - Rubrik Polaris - Rubrik IOC Scan - Rubrik Polaris Rubrik IOC Scan - Rubrik ... Rubrik IOC Scan - Rubrik Polaris Print no recovery needed - Print Print no recovery needed Print Print timeout message - PrintErrorEntry Print timeout message PrintErrorEntry