id: Rubrik Retrieve Anomaly Result - Rubrik Security Cloud version: -1 name: Rubrik Retrieve Anomaly Result - Rubrik Security Cloud description: This playbook retrieves the list of anomaly files for the provided snapshot ID (or activity series ID) and generates the downloadable links for the file path(s). starttaskid: "0" tasks: "0": id: "0" taskid: 8675aa58-7e77-49e4-835d-975f97135996 type: start task: id: 8675aa58-7e77-49e4-835d-975f97135996 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "18" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 500, "y": -140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: d6370577-e76f-4054-8809-50e816b3fd86 type: title task: id: d6370577-e76f-4054-8809-50e816b3fd86 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 500, "y": 3060 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: d7e12490-e44e-4dc4-8d76-cfd7a4957c47 type: condition task: id: d7e12490-e44e-4dc4-8d76-cfd7a4957c47 version: -1 name: Is Rubrik Polaris integration enabled? description: Checks whether Rubrik Polaris integration is enabled or not. type: condition iscommand: false brand: "" nexttasks: '#default#': - "5" "yes": - "37" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: containsGeneral left: value: simple: modules.brand iscontext: true right: value: simple: RubrikPolaris - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: name iscontext: true continueonerrortype: "" view: |- { "position": { "x": 500, "y": -10 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: b1304e3e-711e-4862-804a-330bd2d2ade5 type: regular task: id: b1304e3e-711e-4862-804a-330bd2d2ade5 version: -1 name: Retrieve anomaly results from RSC using the user-submitted form. description: Retrieve the suspicious list of files for a snapshot ID with detected file anomalies. script: '|||rubrik-radar-suspicious-file-list' type: regular iscommand: true brand: "" nexttasks: '#none#': - "41" '#error#': - "45" scriptarguments: extend-context: simple: suspicious_file_paths=data.anomalyResultOpt.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath::suspicious_file_paths=data.anomalyResultOpt.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath::anomaly_cluster_info=data.snapshot.cluster::anomaly_object_type=data.snapshot.snappableNew.objectType::anomaly_cdm_id=data.snapshot.cdmId::anomaly_object_id=data.anomalyResultOpt.workloadId::cluster_id=data.snapshot.cluster.id::resolution_status=data.anomalyResultOpt.resolutionStatus::anomaly_type=data.anomalyResultOpt.anomalyType snapshot_id: complex: root: inputs.snapshot_id transformers: - operator: trim - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: anomaly_snapshot_id iscontext: true separatecontext: false continueonerrortype: "errorPath" view: |- { "position": { "x": 275, "y": 1250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerror: true fieldMapping: - incidentfield: Rubrik Suspicious File List output: complex: root: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo accessor: sampleAffectedFilesInfo transformers: - operator: append args: item: value: simple: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo iscontext: true - incidentfield: Rubrik Suspicious File Count output: complex: root: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo accessor: totalAffectedFiles "20": id: "20" taskid: 79c68a52-77e5-4b88-8490-0c980ac8c750 type: collection task: id: 79c68a52-77e5-4b88-8490-0c980ac8c750 version: -1 name: Collect the anomaly file paths to generate the downloadable links. description: Collecting anomaly file paths to generate the downloadable links from RSC. type: collection iscommand: false brand: "" nexttasks: '#none#': - "35" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 145, "y": 2540 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Please select the anomaly file paths to generate the downloadable links. methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Select the anomaly file paths to generate the downloadable links. required: true gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: suspicious_file_paths fieldassociated: "" placeholder: "" tooltip: Select the anomaly file paths to generate the downloadable links from RSC. readonly: false title: Collect Anomaly File Paths description: Input arguments required to gather the anomaly file paths to generate the downloadable links. sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: a78c6a84-5f06-4a18-8e04-e0e1ae9d3956 type: condition task: id: a78c6a84-5f06-4a18-8e04-e0e1ae9d3956 version: -1 name: Check whether input file paths are available or not. description: Check whether file paths are available or not from the playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "20" Available: - "35" separatecontext: false conditions: - label: Available condition: - - operator: isNotEmpty left: value: complex: root: inputs.file_paths transformers: - operator: trim iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 32.5, "y": 2360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: fdfc1671-e181-47f4-86ea-b8d9cdd2afce type: collection task: id: fdfc1671-e181-47f4-86ea-b8d9cdd2afce version: -1 name: Collect the anomaly information. description: Collecting Object name, type and the cluster ID to retrieve the anomaly events from RSC. type: collection iscommand: false brand: "" nexttasks: '#none#': - "29" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 500, "y": 745 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Please provide the object name and cluster ID to filter the anomaly events. methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Specify the Object Name. required: true gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: 'The object name to filter the anomaly events. Note: Users can get the list of the object names by executing the "rubrik-polaris-object-list" command.' readonly: false - id: "1" label: "" labelarg: simple: Specify the Cluster ID. required: false gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: 'The optional cluster ID to filter the anomaly events. Note: Users can get the cluster ID by executing the "rubrik-gps-cluster-list" command.' readonly: false - id: "2" label: "" labelarg: simple: Specify the Object Type. required: false gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: 'The optional object type to filter the anomaly events. Possible values are: "OBJECT_TYPE_VOLUME_GROUP", "LINUX_FILESET", "WINDOWS_FILESET", "VMWARE_VM".' readonly: false title: Collect Anomaly Information description: Input arguments required to filter the anomaly events. sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 182fb034-3ae9-4849-8432-a9226fdee5b7 type: regular task: id: 182fb034-3ae9-4849-8432-a9226fdee5b7 version: -1 name: Retrieve the Activity Series ID using the meta information of Object retrieved from the user-submitted form. description: Retrieve the Activity Series ID using the meta information of Object retrieved from the user-submitted form. script: '|||rubrik-event-list' type: regular iscommand: true brand: "" nexttasks: '#none#': - "38" scriptarguments: activity_status: simple: SUCCESS activity_type: simple: ANOMALY cluster_id: complex: root: Collect Anomaly Information.Answers accessor: "1" transformers: - operator: LastArrayElement - operator: trim extend-context: simple: anomaly_snapshot_id=data.activitySeriesConnection.edges.[0].node.activitySeriesId::anomaly_object_type=data.activitySeriesConnection.edges.[0].node.objectType limit: simple: "1" object_name: complex: root: Collect Anomaly Information.Answers accessor: "0" transformers: - operator: LastArrayElement - operator: trim object_type: complex: root: Collect Anomaly Information.Answers accessor: "2" transformers: - operator: LastArrayElement - operator: trim sort_by: simple: OBJECT_NAME sort_order: simple: ASC separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 500, "y": 910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: d4f1be2e-7565-46f7-817f-4fd836416dbe type: regular task: id: d4f1be2e-7565-46f7-817f-4fd836416dbe version: -1 name: Delete context for the specified keys. description: "Delete context for the specified keys.\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: key: complex: root: delete_keys_for_rubrik_retrieve_anomaly_result_playbook transformers: - operator: split args: delimiter: value: simple: ',' subplaybook: simple: auto separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 500, "y": 375 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 92625aaf-5687-42d8-8b82-72a74430ec5b type: condition task: id: 92625aaf-5687-42d8-8b82-72a74430ec5b version: -1 name: Check whether the Snapshot ID is available or not. description: Check whether the snapshot ID is available or not from the playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "25" "YES": - "19" separatecontext: false conditions: - label: "YES" condition: - - operator: isNotEmpty left: value: complex: root: inputs.snapshot_id transformers: - operator: trim iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 360, "y": 550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: 75375940-c7fe-4a86-8add-32c0f5b11f71 type: regular task: id: 75375940-c7fe-4a86-8add-32c0f5b11f71 version: -1 name: Generate request ID for the download of the malicious files. description: |- Generate request ID for the download of the malicious files. Note: To know about the file information and which file can be downloaded, use the "rubrik-gps-snapshot-files-list" command. To know about the status of the downloadable files, use the "rubrik-gps-async-result" command. script: '|||rubrik-gps-snapshot-files-download' type: regular iscommand: true brand: "" nexttasks: '#none#': - "36" scriptarguments: extend-context: simple: request_id_for_anomaly_file_download=data.vsphereVmDownloadSnapshotFiles.id::request_id_for_anomaly_file_download=data.filesetDownloadSnapshotFiles.id::request_id_for_anomaly_file_download=data.downloadVolumeGroupSnapshotFiles.id file_path: complex: root: inputs.file_paths transformers: - operator: trim - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Collect Anomaly File Paths.Answers.0 iscontext: true object_type: complex: root: anomaly_object_type transformers: - operator: LastArrayElement snapshot_id: complex: root: inputs.snapshot_id transformers: - operator: trim - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: anomaly_snapshot_id iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 32.5, "y": 2710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 691325d4-cd8a-425c-8c7c-854bfe35819a type: playbook task: id: 691325d4-cd8a-425c-8c7c-854bfe35819a version: -1 name: Rubrik Poll Async Result - Rubrik Polaris description: Poll async result for any asynchronous request made to rubrik. playbookName: Rubrik Poll Async Result - Rubrik Polaris type: playbook iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: ClusterId: complex: root: anomaly_cluster_info accessor: id transformers: - operator: LastArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: incident.rubrikcdmclusterid iscontext: true PollingInterval: simple: "1" PollingTimeout: simple: "720" RequestId: complex: root: request_id_for_anomaly_file_download transformers: - operator: LastArrayElement cluster_ip_address: complex: root: anomaly_cluster_info accessor: defaultAddress transformers: - operator: LastArrayElement separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 32.5, "y": 2885 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: 2ad835a9-1d02-4189-8fcd-b5f6a54df7d2 type: regular task: id: 2ad835a9-1d02-4189-8fcd-b5f6a54df7d2 version: -1 name: Set the delete keys. description: Set the delete keys in context. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "32" scriptarguments: append: simple: "false" key: simple: delete_keys_for_rubrik_retrieve_anomaly_result_playbook value: simple: anomaly_snapshot_id,Collect Anomaly Information,suspicious_file_paths,Collect Anomaly File Paths,request_id_for_anomaly_file_download,anomaly_cluster_info,anomaly_object_type,anomaly_cdm_id,anomaly_object_id,cluster_id,resolution_status,anomaly_type separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 500, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: de00e1a4-df59-4dd0-8461-8d3ccbed3eb8 type: condition task: id: de00e1a4-df59-4dd0-8461-8d3ccbed3eb8 version: -1 name: Check whether the Activity Series ID is available or not. description: Check whether the Activity Series ID is available or not from the command output. type: condition iscommand: false brand: "" nexttasks: '#default#': - "5" "Yes": - "19" separatecontext: false conditions: - label: "Yes" condition: - - operator: isNotEmpty left: value: complex: root: anomaly_snapshot_id transformers: - operator: LastArrayElement iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 500, "y": 1075 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: 29da60b8-c425-406e-86fa-dd8af8a8503a type: condition task: id: 29da60b8-c425-406e-86fa-dd8af8a8503a version: -1 name: Check whether suspicious file paths are available or not. description: Check whether suspicious file paths are available or not from the command output. type: condition iscommand: false brand: "" nexttasks: '#default#': - "5" Available: - "21" separatecontext: false conditions: - label: Available condition: - - operator: isNotEmpty left: value: complex: root: suspicious_file_paths iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 105, "y": 2185 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: 21e7ed3d-5d15-4440-830d-36b364071846 type: condition task: id: 21e7ed3d-5d15-4440-830d-36b364071846 version: -1 name: Check whether the Download CSV File input parameter is set to True. description: Check whether the Download CSV File input parameter is set to True. type: condition iscommand: false brand: "" nexttasks: '#default#': - "47" "yes": - "46" separatecontext: false conditions: - label: "yes" condition: - - operator: isTrue left: value: complex: root: inputs.download_csv_file transformers: - operator: trim iscontext: true ignorecase: true continueonerror: true continueonerrortype: "" view: |- { "position": { "x": -150, "y": 1630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 8ae2e2ce-a87e-4b52-8d98-7500df07d6ff type: condition task: id: 8ae2e2ce-a87e-4b52-8d98-7500df07d6ff version: -1 name: Is anomaly detection status resolved? description: Check whether the status of the anomaly detection is resolved or not. type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" - "45" "yes": - "42" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: resolution_status iscontext: true right: value: simple: resolved ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 275, "y": 1410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 9a15551c-67f9-483e-80a1-e894a0fed4cb type: regular task: id: 9a15551c-67f9-483e-80a1-e894a0fed4cb version: -1 name: closeInvestigation description: Close the current incident script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "5" scriptarguments: closeNotes: complex: root: inputs.close_notes closeReason: simple: Resolved separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 275, "y": 1630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: 8dfc9543-fad9-4454-8d7c-abd5f77c7755 type: playbook task: id: 8dfc9543-fad9-4454-8d7c-abd5f77c7755 version: -1 name: Rubrik Update Anomaly Status- Rubrik Security Cloud description: This playbook updates status of the Anomaly Detection snapshot for the provided anomaly ID (or activity series ID) and workload ID (or Object ID). playbookName: Rubrik Update Anomaly Status- Rubrik Security Cloud type: playbook iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: anomaly_id: complex: root: inputs.snapshot_id transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: anomaly_snapshot_id iscontext: true anomaly_type: complex: root: anomaly_type workload_id: complex: root: inputs.object_id separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 770, "y": 1805 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: d11caccf-b18c-4149-8891-2e322bc9b25a type: condition task: id: d11caccf-b18c-4149-8891-2e322bc9b25a version: -1 name: Whether want to resolve Anomaly Detection? description: Collect the information to resolve anomaly detection. type: condition iscommand: false brand: "" nexttasks: "No": - "5" "Yes": - "44" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 770, "y": 1630 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Wants to resolve the anomaly detection? methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false replyOptions: - "Yes" - "No" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 481b8c48-0bb7-4e3b-81fc-96ebe0bcc180 type: regular task: id: 481b8c48-0bb7-4e3b-81fc-96ebe0bcc180 version: -1 name: Download the analyzed CSV file for anomaly. description: Request for the analysis and directly download the anomaly CSV analyzed file. script: '|||rubrik-anomaly-csv-analysis-v2' type: regular iscommand: true brand: "" nexttasks: '#none#': - "39" scriptarguments: cluster_id: complex: root: cluster_id transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: incident.rubrikpolariscdmclusterid iscontext: true object_id: complex: root: anomaly_object_id snapshot_id: complex: root: anomaly_cdm_id separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 105, "y": 2010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: d8f0892d-78b5-4315-8943-4f6e43d366d5 type: condition task: id: d8f0892d-78b5-4315-8943-4f6e43d366d5 version: -1 name: Whether to Download the analyzed CSV file for anomaly? description: Whether to Download the analyzed CSV file for anomaly? type: condition iscommand: false brand: "" nexttasks: "No": - "39" "Yes": - "46" separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": -150, "y": 1820 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Whether to download the analyzed CSV file for the anomaly? methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false replyOptions: - "Yes" - "No" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "19_45_#error#": 0.57, "38_5_#default#": 0.65, "39_21_Available": 0.64, "40_47_#default#": 0.49, "41_40_#default#": 0.64, "41_42_yes": 0.67, "41_45_#default#": 0.57, "45_44_Yes": 0.48, "45_5_No": 0.21, "47_39_No": 0.21 }, "paper": { "dimensions": { "height": 3265, "width": 1300, "x": -150, "y": -140 } } } inputs: - key: file_paths value: {} required: false description: The absolute path of the file(s) for which a downloadable link needs to be generated. playbookInputQuery: - key: snapshot_id value: complex: root: incident accessor: rubrikpolarisactivityseriesid transformers: - operator: trim required: false description: |- The snapshot ID for which to retrieve the anomaly results. Default can be received from incident (activity series ID) if present. Note: Users can get the list of the snapshot IDs by executing the "rubrik-polaris-object-snapshot-list" command. For the Activity Series ID, the users can execute the "rubrik-event-list" command with the "activity_type" argument set to "ANOMALY". playbookInputQuery: - key: download_csv_file value: simple: "True" required: false description: If set to True, the playbook downloads the anomaly analysis csv file directly on XSOAR server. playbookInputQuery: - key: close_notes value: simple: Closing the incident as the anomaly detection was resolved in RSC. required: false description: Add notes for closing the incident. playbookInputQuery: - key: object_id value: complex: root: incident accessor: rubrikpolarisobjectid required: false description: |- The Object ID or the Snappable ID. Note: Users can get the list of the object IDs by executing the "rubrik-polaris-object-list" command. playbookInputQuery: outputs: - contextPath: RubrikPolaris.SuspiciousFile.id description: The anomaly result ID. type: string - contextPath: RubrikPolaris.SuspiciousFile.snapshotFid description: The snapshot ID. type: string - contextPath: RubrikPolaris.SuspiciousFile.cluster.id description: The cluster ID. type: string - contextPath: RubrikPolaris.SuspiciousFile.cluster.defaultAddress description: The default address of the cluster. type: string - contextPath: RubrikPolaris.SuspiciousFile.cluster.systemStatusAffectedNodes.ipAddress description: The IP address of the affected node. type: string - contextPath: RubrikPolaris.SuspiciousFile.cluster.name description: The cluster name. type: string - contextPath: RubrikPolaris.SuspiciousFile.cluster.version description: The cluster version. type: string - contextPath: RubrikPolaris.SuspiciousFile.cluster.status description: The cluster status. type: string - contextPath: RubrikPolaris.SuspiciousFile.cluster.__typename description: The type name of the cluster response. type: string - contextPath: RubrikPolaris.SuspiciousFile.cdmId description: The snapshot CDM ID. type: string - contextPath: RubrikPolaris.SuspiciousFile.managedId description: The managed object ID. type: string - contextPath: RubrikPolaris.SuspiciousFile.anomalyProbability description: The probability of the anomaly. type: number - contextPath: RubrikPolaris.SuspiciousFile.workloadId description: The workload ID. type: string - contextPath: RubrikPolaris.SuspiciousFile.location description: The location of the anomaly. type: string - contextPath: RubrikPolaris.SuspiciousFile.isAnomaly description: Indicates if the file is an anomaly. type: boolean - contextPath: RubrikPolaris.SuspiciousFile.objectType description: The object type. type: string - contextPath: RubrikPolaris.SuspiciousFile.snappableNew.objectType description: The object type of the snapshot. type: string - contextPath: RubrikPolaris.SuspiciousFile.severity description: The severity of the anomaly. type: string - contextPath: RubrikPolaris.SuspiciousFile.detectionTime description: The detection time of the anomaly. type: date - contextPath: RubrikPolaris.SuspiciousFile.snapshotDate description: The snapshot date of the anomaly. type: date - contextPath: RubrikPolaris.SuspiciousFile.encryption description: The encryption standard of the anomaly. type: string - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.strainId description: The ID of the Ransomware Strain. type: string - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalAffectedFiles description: The total number of affected files. type: number - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.totalRansomwareNotes description: The total number of ransomware notes. type: number - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.filePath description: The path of the affected file. type: string - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.lastModified description: The last modified time of the affected file. type: date - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.fileSizeBytes description: The size of the affected file in bytes. type: number - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleAffectedFilesInfo.__typename description: The type name of the affected file response. type: string - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.filePath description: The path of the ransomware note file. type: string - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.lastModified description: The last modified time of the ransomware note file. type: date - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.fileSizeBytes description: The size of the ransomware note file in bytes. type: number - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.sampleRansomwareNoteFilesInfo.__typename description: The type name of the ransomware note file response. type: string - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.strainAnalysisInfo.__typename description: The type name of the strain analysis response. type: string - contextPath: RubrikPolaris.SuspiciousFile.anomalyInfo.__typename description: The type name of the anomaly response. type: string - contextPath: RubrikPolaris.SuspiciousFile.__typename description: The type name of the suspicious file response. type: string tests: - RubrikPolaris-Test fromversion: 6.5.0