Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

id: Rubrik Retrieve Anomaly Result - Rubrik Security Cloud
version: -1
name: Rubrik Retrieve Anomaly Result - Rubrik Security Cloud
description: This playbook retrieves the list of anomaly files for the provided snapshot ID (or activity series ID) and generates the downloadable links for the file path(s).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8675aa58-7e77-49e4-835d-975f97135996
    type: start
    task:
      id: 8675aa58-7e77-49e4-835d-975f97135996
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d6370577-e76f-4054-8809-50e816b3fd86
    type: title
    task:
      id: d6370577-e76f-4054-8809-50e816b3fd86
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 3060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: d7e12490-e44e-4dc4-8d76-cfd7a4957c47
    type: condition
    task:
      id: d7e12490-e44e-4dc4-8d76-cfd7a4957c47
      version: -1
      name: Is Rubrik Polaris integration enabled?
      description: Checks whether Rubrik Polaris integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RubrikPolaris
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: b1304e3e-711e-4862-804a-330bd2d2ade5
    type: regular
    task:
      id: b1304e3e-711e-4862-804a-330bd2d2ade5
      version: -1
      name: Retrieve anomaly results from RSC using the user-submitted form.
      description: Retrieve the suspicious list of files for a snapshot ID with detected file anomalies.
      script: '|||rubrik-radar-suspicious-file-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "41"
      '#error#':
      - "45"
    scriptarguments:
      extend-context:
        simple: suspicious_file_paths=data.anomalyResultOpt.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath::suspicious_file_paths=data.anomalyResultOpt.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath::anomaly_cluster_info=data.snapshot.cluster::anomaly_object_type=data.snapshot.snappableNew.objectType::anomaly_cdm_id=data.snapshot.cdmId::anomaly_object_id=data.anomalyResultOpt.workloadId::cluster_id=data.snapshot.cluster.id::resolution_status=data.anomalyResultOpt.resolutionStatus::anomaly_type=data.anomalyResultOpt.anomalyType
      snapshot_id:
        complex:
          root: inputs.snapshot_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: anomaly_snapshot_id
                iscontext: true
    separatecontext: false
    continueonerrortype: "errorPath"
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerror: true
    fieldMapping:
    - incidentfield: Rubrik Suspicious File List
      output:
        complex:
          root: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo
          accessor: sampleAffectedFilesInfo
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo
                iscontext: true
    - incidentfield: Rubrik Suspicious File Count
      output:
        complex:
          root: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo
          accessor: totalAffectedFiles
  "20":
    id: "20"
    taskid: 79c68a52-77e5-4b88-8490-0c980ac8c750
    type: collection
    task:
      id: 79c68a52-77e5-4b88-8490-0c980ac8c750
      version: -1
      name: Collect the anomaly file paths to generate the downloadable links.
      description: Collecting anomaly file paths to generate the downloadable links from RSC.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 145,
          "y": 2540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Please select the anomaly file paths to generate the downloadable links.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select the anomaly file paths to generate the downloadable links.
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: suspicious_file_paths
        fieldassociated: ""
        placeholder: ""
        tooltip: Select the anomaly file paths to generate the downloadable links from RSC.
        readonly: false
      title: Collect Anomaly File Paths
      description: Input arguments required to gather the anomaly file paths to generate the downloadable links.
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: a78c6a84-5f06-4a18-8e04-e0e1ae9d3956
    type: condition
    task:
      id: a78c6a84-5f06-4a18-8e04-e0e1ae9d3956
      version: -1
      name: Check whether input file paths are available or not.
      description: Check whether file paths are available or not from the playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      Available:
      - "35"
    separatecontext: false
    conditions:
    - label: Available
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.file_paths
                transformers:
                - operator: trim
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 32.5,
          "y": 2360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: fdfc1671-e181-47f4-86ea-b8d9cdd2afce
    type: collection
    task:
      id: fdfc1671-e181-47f4-86ea-b8d9cdd2afce
      version: -1
      name: Collect the anomaly information.
      description: Collecting Object name, type and the cluster ID to retrieve the anomaly events from RSC.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Please provide the object name and cluster ID to filter the anomaly events.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Specify the Object Name.
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: 'The object name to filter the anomaly events. Note: Users can get the list of the object names by executing the "rubrik-polaris-object-list" command.'
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Specify the Cluster ID.
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: 'The optional cluster ID to filter the anomaly events. Note: Users can get the cluster ID by executing the "rubrik-gps-cluster-list" command.'
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: Specify the Object Type.
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: 'The optional object type to filter the anomaly events. Possible values are: "OBJECT_TYPE_VOLUME_GROUP", "LINUX_FILESET", "WINDOWS_FILESET", "VMWARE_VM".'
        readonly: false
      title: Collect Anomaly Information
      description: Input arguments required to filter the anomaly events.
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 182fb034-3ae9-4849-8432-a9226fdee5b7
    type: regular
    task:
      id: 182fb034-3ae9-4849-8432-a9226fdee5b7
      version: -1
      name: Retrieve the Activity Series ID using the meta information of Object retrieved from the user-submitted form.
      description: Retrieve the Activity Series ID using the meta information of Object retrieved from the user-submitted form.
      script: '|||rubrik-event-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      activity_status:
        simple: SUCCESS
      activity_type:
        simple: ANOMALY
      cluster_id:
        complex:
          root: Collect Anomaly Information.Answers
          accessor: "1"
          transformers:
          - operator: LastArrayElement
          - operator: trim
      extend-context:
        simple: anomaly_snapshot_id=data.activitySeriesConnection.edges.[0].node.activitySeriesId::anomaly_object_type=data.activitySeriesConnection.edges.[0].node.objectType
      limit:
        simple: "1"
      object_name:
        complex:
          root: Collect Anomaly Information.Answers
          accessor: "0"
          transformers:
          - operator: LastArrayElement
          - operator: trim
      object_type:
        complex:
          root: Collect Anomaly Information.Answers
          accessor: "2"
          transformers:
          - operator: LastArrayElement
          - operator: trim
      sort_by:
        simple: OBJECT_NAME
      sort_order:
        simple: ASC
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: d4f1be2e-7565-46f7-817f-4fd836416dbe
    type: regular
    task:
      id: d4f1be2e-7565-46f7-817f-4fd836416dbe
      version: -1
      name: Delete context for the specified keys.
      description: "Delete context for the specified keys.\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      key:
        complex:
          root: delete_keys_for_rubrik_retrieve_anomaly_result_playbook
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 375
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 92625aaf-5687-42d8-8b82-72a74430ec5b
    type: condition
    task:
      id: 92625aaf-5687-42d8-8b82-72a74430ec5b
      version: -1
      name: Check whether the Snapshot ID is available or not.
      description: Check whether the snapshot ID is available or not from the playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "YES":
      - "19"
    separatecontext: false
    conditions:
    - label: "YES"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.snapshot_id
                transformers:
                - operator: trim
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 360,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 75375940-c7fe-4a86-8add-32c0f5b11f71
    type: regular
    task:
      id: 75375940-c7fe-4a86-8add-32c0f5b11f71
      version: -1
      name: Generate request ID for the download of the malicious files.
      description: |-
        Generate request ID for the download of the malicious files.

        Note: To know about the file information and which file can be downloaded, use the "rubrik-gps-snapshot-files-list" command. To know about the status of the downloadable files, use the "rubrik-gps-async-result" command.
      script: '|||rubrik-gps-snapshot-files-download'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      extend-context:
        simple: request_id_for_anomaly_file_download=data.vsphereVmDownloadSnapshotFiles.id::request_id_for_anomaly_file_download=data.filesetDownloadSnapshotFiles.id::request_id_for_anomaly_file_download=data.downloadVolumeGroupSnapshotFiles.id
      file_path:
        complex:
          root: inputs.file_paths
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect Anomaly File Paths.Answers.0
                iscontext: true
      object_type:
        complex:
          root: anomaly_object_type
          transformers:
          - operator: LastArrayElement
      snapshot_id:
        complex:
          root: inputs.snapshot_id
          transformers:
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: anomaly_snapshot_id
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 32.5,
          "y": 2710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 691325d4-cd8a-425c-8c7c-854bfe35819a
    type: playbook
    task:
      id: 691325d4-cd8a-425c-8c7c-854bfe35819a
      version: -1
      name: Rubrik Poll Async Result - Rubrik Polaris
      description: Poll async result for any asynchronous request made to rubrik.
      playbookName: Rubrik Poll Async Result - Rubrik Polaris
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      ClusterId:
        complex:
          root: anomaly_cluster_info
          accessor: id
          transformers:
          - operator: LastArrayElement
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: incident.rubrikcdmclusterid
                iscontext: true
      PollingInterval:
        simple: "1"
      PollingTimeout:
        simple: "720"
      RequestId:
        complex:
          root: request_id_for_anomaly_file_download
          transformers:
          - operator: LastArrayElement
      cluster_ip_address:
        complex:
          root: anomaly_cluster_info
          accessor: defaultAddress
          transformers:
          - operator: LastArrayElement
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 32.5,
          "y": 2885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 2ad835a9-1d02-4189-8fcd-b5f6a54df7d2
    type: regular
    task:
      id: 2ad835a9-1d02-4189-8fcd-b5f6a54df7d2
      version: -1
      name: Set the delete keys.
      description: Set the delete keys in context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: delete_keys_for_rubrik_retrieve_anomaly_result_playbook
      value:
        simple: anomaly_snapshot_id,Collect Anomaly Information,suspicious_file_paths,Collect Anomaly File Paths,request_id_for_anomaly_file_download,anomaly_cluster_info,anomaly_object_type,anomaly_cdm_id,anomaly_object_id,cluster_id,resolution_status,anomaly_type
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: de00e1a4-df59-4dd0-8461-8d3ccbed3eb8
    type: condition
    task:
      id: de00e1a4-df59-4dd0-8461-8d3ccbed3eb8
      version: -1
      name: Check whether the Activity Series ID is available or not.
      description: Check whether the Activity Series ID  is available or not from the command output.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "Yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: anomaly_snapshot_id
                transformers:
                - operator: LastArrayElement
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 29da60b8-c425-406e-86fa-dd8af8a8503a
    type: condition
    task:
      id: 29da60b8-c425-406e-86fa-dd8af8a8503a
      version: -1
      name: Check whether suspicious file paths are available or not.
      description: Check whether suspicious file paths are available or not from the command output.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      Available:
      - "21"
    separatecontext: false
    conditions:
    - label: Available
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: suspicious_file_paths
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 105,
          "y": 2185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 21e7ed3d-5d15-4440-830d-36b364071846
    type: condition
    task:
      id: 21e7ed3d-5d15-4440-830d-36b364071846
      version: -1
      name: Check whether the Download CSV File input parameter is set to True.
      description: Check whether the Download CSV File input parameter is set to True.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "47"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isTrue
          left:
            value:
              complex:
                root: inputs.download_csv_file
                transformers:
                - operator: trim
            iscontext: true
          ignorecase: true
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -150,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 8ae2e2ce-a87e-4b52-8d98-7500df07d6ff
    type: condition
    task:
      id: 8ae2e2ce-a87e-4b52-8d98-7500df07d6ff
      version: -1
      name: Is anomaly detection status resolved?
      description: Check whether the status of the anomaly detection is resolved or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      - "45"
      "yes":
      - "42"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: resolution_status
            iscontext: true
          right:
            value:
              simple: resolved
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 9a15551c-67f9-483e-80a1-e894a0fed4cb
    type: regular
    task:
      id: 9a15551c-67f9-483e-80a1-e894a0fed4cb
      version: -1
      name: closeInvestigation
      description: Close the current incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      closeNotes:
        complex:
          root: inputs.close_notes
      closeReason:
        simple: Resolved
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 8dfc9543-fad9-4454-8d7c-abd5f77c7755
    type: playbook
    task:
      id: 8dfc9543-fad9-4454-8d7c-abd5f77c7755
      version: -1
      name: Rubrik Update Anomaly Status- Rubrik Security Cloud
      description: This playbook updates status of the Anomaly Detection snapshot for the provided anomaly ID (or activity series ID) and workload ID (or Object ID).
      playbookName: Rubrik Update Anomaly Status- Rubrik Security Cloud
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      anomaly_id:
        complex:
          root: inputs.snapshot_id
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: anomaly_snapshot_id
                iscontext: true
      anomaly_type:
        complex:
          root: anomaly_type
      workload_id:
        complex:
          root: inputs.object_id
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: d11caccf-b18c-4149-8891-2e322bc9b25a
    type: condition
    task:
      id: d11caccf-b18c-4149-8891-2e322bc9b25a
      version: -1
      name: Whether want to resolve Anomaly Detection?
      description: Collect the information to resolve anomaly detection.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "5"
      "Yes":
      - "44"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Wants to resolve the anomaly detection?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 481b8c48-0bb7-4e3b-81fc-96ebe0bcc180
    type: regular
    task:
      id: 481b8c48-0bb7-4e3b-81fc-96ebe0bcc180
      version: -1
      name: Download the analyzed CSV file for anomaly.
      description: Request for the analysis and directly download the anomaly CSV analyzed file.
      script: '|||rubrik-anomaly-csv-analysis-v2'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      cluster_id:
        complex:
          root: cluster_id
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: incident.rubrikpolariscdmclusterid
                iscontext: true
      object_id:
        complex:
          root: anomaly_object_id
      snapshot_id:
        complex:
          root: anomaly_cdm_id
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 105,
          "y": 2010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: d8f0892d-78b5-4315-8943-4f6e43d366d5
    type: condition
    task:
      id: d8f0892d-78b5-4315-8943-4f6e43d366d5
      version: -1
      name: Whether to Download the analyzed CSV file for anomaly?
      description: Whether to Download the analyzed CSV file for anomaly?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "39"
      "Yes":
      - "46"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -150,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Whether to download the analyzed CSV file for the anomaly?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "19_45_#error#": 0.57,
      "38_5_#default#": 0.65,
      "39_21_Available": 0.64,
      "40_47_#default#": 0.49,
      "41_40_#default#": 0.64,
      "41_42_yes": 0.67,
      "41_45_#default#": 0.57,
      "45_44_Yes": 0.48,
      "45_5_No": 0.21,
      "47_39_No": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 3265,
        "width": 1300,
        "x": -150,
        "y": -140
      }
    }
  }
inputs:
- key: file_paths
  value: {}
  required: false
  description: The absolute path of the file(s) for which a downloadable link needs to be generated.
  playbookInputQuery:
- key: snapshot_id
  value:
    complex:
      root: incident
      accessor: rubrikpolarisactivityseriesid
      transformers:
      - operator: trim
  required: false
  description: |-
    The snapshot ID for which to retrieve the anomaly results. Default can be received from incident (activity series ID) if present.

    Note: Users can get the list of the snapshot IDs by executing the "rubrik-polaris-object-snapshot-list" command. For the Activity Series ID, the users can execute the "rubrik-event-list" command with the "activity_type" argument set to "ANOMALY".
  playbookInputQuery:
- key: download_csv_file
  value:
    simple: "True"
  required: false
  description: If set to True, the playbook downloads the anomaly analysis csv file directly on XSOAR server.
  playbookInputQuery:
- key: close_notes
  value:
    simple: Closing the incident as the anomaly detection was resolved in RSC.
  required: false
  description: Add notes for closing the incident.
  playbookInputQuery:
- key: object_id
  value:
    complex:
      root: incident
      accessor: rubrikpolarisobjectid
  required: false
  description: |-
    The Object ID or the Snappable ID.

    Note: Users can get the list of the object IDs by executing the "rubrik-polaris-object-list" command.
  playbookInputQuery:
outputs:
- contextPath: RubrikPolaris.SuspiciousFile.id
  description: The anomaly result ID.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.snapshotFid
  description: The snapshot ID.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.cluster.id
  description: The cluster ID.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.cluster.defaultAddress
  description: The default address of the cluster.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.cluster.systemStatusAffectedNodes.ipAddress
  description: The IP address of the affected node.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.cluster.name
  description: The cluster name.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.cluster.version
  description: The cluster version.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.cluster.status
  description: The cluster status.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.cluster.__typename
  description: The type name of the cluster response.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.cdmId
  description: The snapshot CDM ID.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.managedId
  description: The managed object ID.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.anomalyProbability
  description: The probability of the anomaly.
  type: number
- contextPath: RubrikPolaris.SuspiciousFile.workloadId
  description: The workload ID.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.location
  description: The location of the anomaly.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.isAnomaly
  description: Indicates if the file is an anomaly.
  type: boolean
- contextPath: RubrikPolaris.SuspiciousFile.objectType
  description: The object type.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.snappableNew.objectType
  description: The object type of the snapshot.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.severity
  description: The severity of the anomaly.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.detectionTime
  description: The detection time of the anomaly.
  type: date
- contextPath: RubrikPolaris.SuspiciousFile.snapshotDate
  description: The snapshot date of the anomaly.
  type: date
- contextPath: RubrikPolaris.SuspiciousFile.encryption
  description: The encryption standard of the anomaly.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.strainId
  description: The ID of the Ransomware Strain.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalAffectedFiles
  description: The total number of affected files.
  type: number
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalRansomwareNotes
  description: The total number of ransomware notes.
  type: number
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath
  description: The path of the affected file.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.lastModified
  description: The last modified time of the affected file.
  type: date
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.fileSizeBytes
  description: The size of the affected file in bytes.
  type: number
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.__typename
  description: The type name of the affected file response.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath
  description: The path of the ransomware note file.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.lastModified
  description: The last modified time of the ransomware note file.
  type: date
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.fileSizeBytes
  description: The size of the ransomware note file in bytes.
  type: number
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.__typename
  description: The type name of the ransomware note file response.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.__typename
  description: The type name of the strain analysis response.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.__typename
  description: The type name of the anomaly response.
  type: string
- contextPath: RubrikPolaris.SuspiciousFile.__typename
  description: The type name of the suspicious file response.
  type: string
tests:
- RubrikPolaris-Test
fromversion: 6.5.0