id: Rubrik Object Context Analysis - Rubrik Polaris
version: -1
name: Rubrik Object Context Analysis - Rubrik Polaris
description: This playbook will investigate based on the object type from the Rubrik Anomaly incident to retrieve the policy hits of the files related to the object.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6e742996-a6d3-4c02-871b-9e0e3baff532
    type: start
    task:
      id: 6e742996-a6d3-4c02-871b-9e0e3baff532
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d88be1fd-68cc-4416-8b0b-5b8e053f3ff7
    type: title
    task:
      id: d88be1fd-68cc-4416-8b0b-5b8e053f3ff7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: f4c4eade-6ee0-4516-83ea-05822456483c
    type: condition
    task:
      id: f4c4eade-6ee0-4516-83ea-05822456483c
      version: -1
      name: Is the object type Fileset, Volume Group, or VM?
      description: Checks whether the object type contains fileset, volume group or the VM.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "Yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.object_type
                transformers:
                - operator: trim
            iscontext: true
          right:
            value:
              simple: Fileset
          ignorecase: true
        - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.object_type
                transformers:
                - operator: trim
            iscontext: true
          right:
            value:
              simple: Vm
        - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.object_type
                transformers:
                - operator: trim
            iscontext: true
          right:
            value:
              simple: VolumeGroup
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 96cc3558-fdaa-4113-81cd-819d17611042
    type: playbook
    task:
      id: 96cc3558-fdaa-4113-81cd-819d17611042
      version: -1
      name: Rubrik File Context Analysis - Rubrik Polaris
      description: This playbook fetches file context information for the provided file, folder, or file share name and the object ID to get the policy hits.
      playbookName: Rubrik File Context Analysis - Rubrik Polaris
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      limit:
        simple: "50"
      object_id:
        complex:
          root: inputs.object_id
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 9629042c-938d-4f55-8bfe-ac9ceea6541a
    type: regular
    task:
      id: 9629042c-938d-4f55-8bfe-ac9ceea6541a
      version: -1
      name: Retrieve the object details
      description: Get the matched object for Threat Monitoring.
      script: '|||rubrik-threat-monitoring-matched-object-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      object_id:
        complex:
          root: inputs.object_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 472.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Rubrik Object Location
      output:
        complex:
          root: RubrikPolaris.ThreatMonitoring.logicalPath.name
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: RubrikPolaris.ThreatMonitoring.logicalPath.name
                iscontext: true
              right:
                value:
                  simple: vm
          transformers:
          - operator: ReverseList
          - operator: join
            args:
              separator:
                value:
                  simple: /
    skipunavailable: false
    quietmode: 1
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "7_5_#default#": 0.36,
      "7_8_Yes": 0.48
    },
    "paper": {
      "dimensions": {
        "height": 555,
        "width": 802.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: object_id
  value:
    complex:
      root: incident
      accessor: rubrikpolarisfid
  required: false
  description: The Object ID or the Snappable ID. Default can be received from incident if present.
  playbookInputQuery:
- key: object_type
  value:
    complex:
      root: incident
      accessor: rubrikpolarisobjecttype
  required: false
  description: The Object type. Default can be received from incident if present.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0