Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

This playbook retrieves the list of anomaly files for the provided snapshot ID (or activity series ID) and generates the downloadable links for the file path(s).

Rubrik Security Cloud · 22 tasks · 5 inputs · 35 outputs

Inputs

  • file_paths — The absolute path of the file(s) for which a downloadable link needs to be generated.
  • snapshot_id — The snapshot ID for which to retrieve the anomaly results. Default can be received from incident (activity series ID) if present. Note: Users can get the list of the snapshot IDs by executing the "rubrik-polaris-object-snapshot-list" command. For the Activity Series ID, the users can execute the "rubrik-event-list" command with the "activity_type" argument set to "ANOMALY".
  • download_csv_file — If set to True, the playbook downloads the anomaly analysis csv file directly on XSOAR server.
  • close_notes — Add notes for closing the incident.
  • object_id — The Object ID or the Snappable ID. Note: Users can get the list of the object IDs by executing the "rubrik-polaris-object-list" command.

Outputs

  • RubrikPolaris.SuspiciousFile.id — The anomaly result ID.
  • RubrikPolaris.SuspiciousFile.snapshotFid — The snapshot ID.
  • RubrikPolaris.SuspiciousFile.cluster.id — The cluster ID.
  • RubrikPolaris.SuspiciousFile.cluster.defaultAddress — The default address of the cluster.
  • RubrikPolaris.SuspiciousFile.cluster.systemStatusAffectedNodes.ipAddress — The IP address of the affected node.
  • RubrikPolaris.SuspiciousFile.cluster.name — The cluster name.
  • RubrikPolaris.SuspiciousFile.cluster.version — The cluster version.
  • RubrikPolaris.SuspiciousFile.cluster.status — The cluster status.
  • RubrikPolaris.SuspiciousFile.cluster.__typename — The type name of the cluster response.
  • RubrikPolaris.SuspiciousFile.cdmId — The snapshot CDM ID.
  • RubrikPolaris.SuspiciousFile.managedId — The managed object ID.
  • RubrikPolaris.SuspiciousFile.anomalyProbability — The probability of the anomaly.
  • RubrikPolaris.SuspiciousFile.workloadId — The workload ID.
  • RubrikPolaris.SuspiciousFile.location — The location of the anomaly.
  • RubrikPolaris.SuspiciousFile.isAnomaly — Indicates if the file is an anomaly.
  • RubrikPolaris.SuspiciousFile.objectType — The object type.
  • RubrikPolaris.SuspiciousFile.snappableNew.objectType — The object type of the snapshot.
  • RubrikPolaris.SuspiciousFile.severity — The severity of the anomaly.
  • RubrikPolaris.SuspiciousFile.detectionTime — The detection time of the anomaly.
  • RubrikPolaris.SuspiciousFile.snapshotDate — The snapshot date of the anomaly.
  • RubrikPolaris.SuspiciousFile.encryption — The encryption standard of the anomaly.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.strainId — The ID of the Ransomware Strain.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalAffectedFiles — The total number of affected files.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalRansomwareNotes — The total number of ransomware notes.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath — The path of the affected file.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.lastModified — The last modified time of the affected file.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.fileSizeBytes — The size of the affected file in bytes.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.__typename — The type name of the affected file response.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath — The path of the ransomware note file.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.lastModified — The last modified time of the ransomware note file.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.fileSizeBytes — The size of the ransomware note file in bytes.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.__typename — The type name of the ransomware note file response.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.__typename — The type name of the strain analysis response.
  • RubrikPolaris.SuspiciousFile.anomalyInfo.__typename — The type name of the anomaly response.
  • RubrikPolaris.SuspiciousFile.__typename — The type name of the suspicious file response.

Commands used

closeInvestigation rubrik-anomaly-csv-analysis-v2 rubrik-event-list rubrik-gps-snapshot-files-download rubrik-radar-suspicious-file-list

Flowchart

yes #error# Available YES Yes Available yes yes No Yes No Yes Start Start Done Done Is Rubrik Polaris integration enabled? Is Rubrik Polaris integra... Retrieve anomaly results from RSC using the user-submitted form. - rubrik-radar-suspicious-file-list Retrieve anomaly results ... rubrik-radar-suspicious-file-... Collect the anomaly file paths to generate the downloadable links. Collect the anomaly file ... Check whether input file paths are available or not. Check whether input file ... Collect the anomaly information. Collect the anomaly infor... Retrieve the Activity Series ID using the meta information of Object retrieved from the user-submitted form. - rubrik-event-list Retrieve the Activity Ser... rubrik-event-list Delete context for the specified keys. - DeleteContext Delete context for the sp... DeleteContext Check whether the Snapshot ID is available or not. Check whether the Snapsho... Generate request ID for the download of the malicious files. - rubrik-gps-snapshot-files-download Generate request ID for t... rubrik-gps-snapshot-files-dow... Rubrik Poll Async Result - Rubrik Polaris - Rubrik Poll Async Result - Rubrik Polaris Rubrik Poll Async Result ... Rubrik Poll Async Result - Ru... Set the delete keys. - Set Set the delete keys. Set Check whether the Activity Series ID is available or not. Check whether the Activit... Check whether suspicious file paths are available or not. Check whether suspicious ... Check whether the Download CSV File input parameter is set to True. Check whether the Downloa... Is anomaly detection status resolved? Is anomaly detection stat... closeInvestigation - closeInvestigation closeInvestigation closeInvestigation Rubrik Update Anomaly Status- Rubrik Security Cloud - Rubrik Update Anomaly Status- Rubrik Security Cloud Rubrik Update Anomaly Sta... Rubrik Update Anomaly Status-... Whether want to resolve Anomaly Detection? Whether want to resolve A... Download the analyzed CSV file for anomaly. - rubrik-anomaly-csv-analysis-v2 Download the analyzed CSV... rubrik-anomaly-csv-analysis-v2 Whether to Download the analyzed CSV file for anomaly? Whether to Download the a...