Changes related to the Rubrik release 1.3.1

[crestdatasystems]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

Description

Integrations: Rubrik Security Cloud

• Updated the command rubrik-gps-snapshot-files-download with the added support for the Windows File Set, Linux File Set, and Volume Group object types.
• Added the command rubrik-radar-suspicious-file-list.

New Playbook: Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

• This playbook retrieves the list of anomaly files for the provided snapshot ID (or activity series ID) and generates the downloadable links for the file path(s). (Available from Cortex XSOAR 6.5.0).

Must have

• Tests
• Documentation

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @moishce will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

[melamedbn]

Hi @crestdatasystems,

Playbooks

Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

1. Please consider checking if the mandatory input is provided before executing anything else. This could ensure smoother execution, making task '34' the first in order.
2. In Task '34', could you kindly explain why 'trim' was used?
3. Tasks '37' and '32' seem similar; merging them into one task where you only put the relevant keys in the delete context command could simplify the playbook.
4. Could you please explain where the 'anomaly_snapshot_id' key used in task '38' and 'suspicious_file_paths' in task '39' are created?

Rubrik Poll Async Result - Rubrik Polaris

1. It would be very helpful to see the modification made in action. Could you please provide a short recording or prepare it for our upcoming demo?

Mapper

Rubrik Polaris Radar - Mapping

1. I noticed the 'ObjectID' field was changed to 'fid'. Could you kindly explain the reason behind this change?

Thank you for considering these suggestions. Let me know if you need further clarification or if there are additional details you'd like to include.

Best regards,
Ben

[crestdatasystems]

Hi @crestdatasystems,

Playbooks

Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

1. Please consider checking if the mandatory input is provided before executing anything else. This could ensure smoother execution, making task '34' the first in order.
2. In Task '34', could you kindly explain why 'trim' was used?
3. Tasks '37' and '32' seem similar; merging them into one task where you only put the relevant keys in the delete context command could simplify the playbook.
4. Could you please explain where the 'anomaly_snapshot_id' key used in task '38' and 'suspicious_file_paths' in task '39' are created?

Rubrik Poll Async Result - Rubrik Polaris

1. It would be very helpful to see the modification made in action. Could you please provide a short recording or prepare it for our upcoming demo?

Mapper

Rubrik Polaris Radar - Mapping

1. I noticed the 'ObjectID' field was changed to 'fid'. Could you kindly explain the reason behind this change?

Thank you for considering these suggestions. Let me know if you need further clarification or if there are additional details you'd like to include.

Best regards, Ben

Hello Ben, Thanks for the review!

Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

1. Before 'task 34' 2 tasks are generic, it's just deleting keys irrespective of the inputs.
2. Just in case if someone is providing whitespace then it would be handled by trim
3. In the Task 37, we are setting the comma separated custom keys in the context for which we have to run the Delete Context tasks. Task 32, we are spliting those keys, so that, Delete Context task will run for all those keys. Which we think more straight forward instead of writing a automation to combine this. OR you can suggest a better way to handle this.
4. We are setting the 'anomaly_snapshot_id' key from the task 29. It may be possible that, user provided values don't have any outputs. So, to handle that, we are checking that, do we have received this key from the context or not. For the task '39' as well, we are checking that, we have received any suspicious file paths or not. If not, then we doesn't have run the susbsequent tasks which requires set of file paths.

Rubrik Poll Async Result - Rubrik Polaris

Yes sure, we can display those changes in the upcoming demo.
For brief, we have added one argument related to the IP address which we require for current use case. Previously, that playbook input was not available which can be use by the underlining command in this playbook. To not break the other playbooks, we have just made one branch for IP address if it is available from the playbook input.

Rubrik Polaris Radar - Mapping

Previously it was incorrectly mapped and Rubrik team suggest to map with fid.

Please let me know if you've any other points to discuss before jumping on to a quick demo.

[melamedbn]

Hi @crestdatasystems,

Playbooks

Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

1. Please consider checking if the mandatory input is provided before executing anything else. This could ensure smoother execution, making task '34' the first in order.
2. In Task '34', could you kindly explain why 'trim' was used?
3. Tasks '37' and '32' seem similar; merging them into one task where you only put the relevant keys in the delete context command could simplify the playbook.
4. Could you please explain where the 'anomaly_snapshot_id' key used in task '38' and 'suspicious_file_paths' in task '39' are created?

Rubrik Poll Async Result - Rubrik Polaris

1. It would be very helpful to see the modification made in action. Could you please provide a short recording or prepare it for our upcoming demo?

Mapper

Rubrik Polaris Radar - Mapping

1. I noticed the 'ObjectID' field was changed to 'fid'. Could you kindly explain the reason behind this change?

Thank you for considering these suggestions. Let me know if you need further clarification or if there are additional details you'd like to include.
Best regards, Ben

Hello Ben, Thanks for the review!

Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

1. Before 'task 34' 2 tasks are generic, it's just deleting keys irrespective of the inputs.
2. Just in case if someone is providing whitespace then it would be handled by trim
3. In the Task 37, we are setting the comma separated custom keys in the context for which we have to run the Delete Context tasks. Task 32, we are spliting those keys, so that, Delete Context task will run for all those keys. Which we think more straight forward instead of writing a automation to combine this. OR you can suggest a better way to handle this.
4. We are setting the 'anomaly_snapshot_id' key from the task 29. It may be possible that, user provided values don't have any outputs. So, to handle that, we are checking that, do we have received this key from the context or not. For the task '39' as well, we are checking that, we have received any suspicious file paths or not. If not, then we doesn't have run the susbsequent tasks which requires set of file paths.

Rubrik Poll Async Result - Rubrik Polaris

Yes sure, we can display those changes in the upcoming demo. For brief, we have added one argument related to the IP address which we require for current use case. Previously, that playbook input was not available which can be use by the underlining command in this playbook. To not break the other playbooks, we have just made one branch for IP address if it is available from the playbook input.

Rubrik Polaris Radar - Mapping

Previously it was incorrectly mapped and Rubrik team suggest to map with fid.

Please let me know if you've any other points to discuss before jumping on to a quick demo.

3 - Can be split using the split transformer which will cause the command to iterate over each element. Want to give it a try? it will make the flow smoother.

[crestdatasystems]

Hi @crestdatasystems,

Playbooks

Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

1. Please consider checking if the mandatory input is provided before executing anything else. This could ensure smoother execution, making task '34' the first in order.
2. In Task '34', could you kindly explain why 'trim' was used?
3. Tasks '37' and '32' seem similar; merging them into one task where you only put the relevant keys in the delete context command could simplify the playbook.
4. Could you please explain where the 'anomaly_snapshot_id' key used in task '38' and 'suspicious_file_paths' in task '39' are created?

Rubrik Poll Async Result - Rubrik Polaris

1. It would be very helpful to see the modification made in action. Could you please provide a short recording or prepare it for our upcoming demo?

Mapper

Rubrik Polaris Radar - Mapping

1. I noticed the 'ObjectID' field was changed to 'fid'. Could you kindly explain the reason behind this change?

Thank you for considering these suggestions. Let me know if you need further clarification or if there are additional details you'd like to include.
Best regards, Ben

Hello Ben, Thanks for the review!

Rubrik Retrieve Anomaly Result - Rubrik Security Cloud

1. Before 'task 34' 2 tasks are generic, it's just deleting keys irrespective of the inputs.
2. Just in case if someone is providing whitespace then it would be handled by trim
3. In the Task 37, we are setting the comma separated custom keys in the context for which we have to run the Delete Context tasks. Task 32, we are spliting those keys, so that, Delete Context task will run for all those keys. Which we think more straight forward instead of writing a automation to combine this. OR you can suggest a better way to handle this.
4. We are setting the 'anomaly_snapshot_id' key from the task 29. It may be possible that, user provided values don't have any outputs. So, to handle that, we are checking that, do we have received this key from the context or not. For the task '39' as well, we are checking that, we have received any suspicious file paths or not. If not, then we doesn't have run the susbsequent tasks which requires set of file paths.

Rubrik Poll Async Result - Rubrik Polaris

Yes sure, we can display those changes in the upcoming demo. For brief, we have added one argument related to the IP address which we require for current use case. Previously, that playbook input was not available which can be use by the underlining command in this playbook. To not break the other playbooks, we have just made one branch for IP address if it is available from the playbook input.

Rubrik Polaris Radar - Mapping

Previously it was incorrectly mapped and Rubrik team suggest to map with fid.
Please let me know if you've any other points to discuss before jumping on to a quick demo.

3 - Can be split using the split transformer which will cause the command to iterate over each element. Want to give it a try? it will make the flow smoother.

The Delete Context Task requires the mandatory parameter 'key to delete' from the context. So, we are setting the comma separated keys in the task '37'. And after that, we can use 'Split' transformer to get the list of keys stored in the context. That's why we've splited these tasks, If you have solution for this, please provide us the SnapShots or the YML for this one.

[content-bot]

For the Reviewer: Trigger build request has been accepted for this contribution PR.

[content-bot]

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/927857

[content-bot]

For the Reviewer: Trigger build request has been accepted for this contribution PR.

[content-bot]

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/928409

[content-bot]

For the Reviewer: Trigger build request has been accepted for this contribution PR.

[content-bot]

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/929936

[content-bot]

For the Reviewer: Trigger build request has been accepted for this contribution PR.

[content-bot]

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/934579

[github-actions]

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.