Rubrik Update Anomaly Status- Rubrik Security Cloud

This playbook updates status of the Anomaly Detection snapshot for the provided anomaly ID (or activity series ID) and workload ID (or Object ID).

Rubrik Security Cloud · 17 tasks · 3 inputs · 0 outputs

Inputs

  • anomaly_type — The type of the anomaly. Note: For Anomaly Type, users can execute the "rubrik-radar-suspicious-file-list" command.
  • anomaly_id — The ID of the Anomaly or Activity Series ID. Note: For Activity Series ID, users can execute the "rubrik-event-list" command with the "activity_type" argument set to "ANOMALY".
  • workload_id — The workload ID (Snappable ID). Note: Users can execute the "rubrik-event-list" command with the "activity_type" argument set to "ANOMALY" and get the value of "fid" from the context.

Commands used

closeInvestigation rubrik-radar-anomaly-status-update

Flowchart

yes Available Direct Resolve False Positive FILESYSTEM HYPERVISOR Available yes Start Start Is Rubrik Polaris integration enabled? Is Rubrik Polaris integra... Check whether anomaly information is available or not. Check whether anomaly inf... Mark Anomaly Detection as false positive or directly resolve. Mark Anomaly Detection as... Check whether anomaly type is File System or Hyper visor. Check whether anomaly typ... Updates the status of the Anomaly detection. - rubrik-radar-anomaly-status-update Updates the status of the... rubrik-radar-anomaly-status-u... Done Done Collect the anomaly information. Collect the anomaly infor... Set the delete keys. - SetAndHandleEmpty Set the delete keys. SetAndHandleEmpty Delete context for the specified keys. - DeleteContext Delete context for the sp... DeleteContext Collect the anomaly type information. Collect the anomaly type ... Check whether anomaly type is available or not. Check whether anomaly typ... Collect the false positive type and reason for FILESYSTEM anomaly. Collect the false positiv... Collect the false positive type and reason for HYPERVISOR anomaly. Collect the false positiv... Close Investigation for Resolved Anomaly. - closeInvestigation Close Investigation for R... closeInvestigation Close Investigation for marked as False Positive Anomaly. - closeInvestigation Close Investigation for m... closeInvestigation Check whether anomaly marked as False Positive or not. Check whether anomaly mar...