Rubrik Turbo IOC Scan - Rubrik Polaris

Inputs

• ioc — The value of the indicator to scan for. Supports comma separated values. Note: Users can retrieve the Md5, SHA1 or SHA256 by executing the "rubrik-threat-monitoring-matched-file-get" command.
• scan_name — Name of the new turbo threat hunt scan.
• cluster_id — The ID of the cluster on which to perform a scan. If not provided, all the clusters will be scanned. Note: Users can retrieve the list of the cluster IDs by executing the "rubrik-gps-cluster-list" command.
• start_time — Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.
• end_time — Filter the snapshots until the provided date. Any snapshots taken after the provided date-time will be excluded. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.
• max_snapshots_per_object — Maximum number of snapshots to scan per object.
• polling_interval — Frequency that the IOC scan command will run (minutes).
• polling_timeout — Amount of time to poll before declaring a timeout and resuming the playbook (in minutes).

Outputs

• RubrikPolaris.IOCScan — Result of the Turbo IOC scan.

Commands used