Restore From Last Cohesity Snapshot
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
This playbook restores the latest good Data Hawk (Helios) snapshot.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | CohesitySecurity |
| Source | View on GitHub |
Additional Documentation
Summary
This playbook restores the latest good Data Hawk (Helios) snapshot. It’s recommended for running by Backup Admins only after they make sure that the existing data is compromised, and rollback to the previous snapshot, even at the expense of data loss, is really required. Please beware: It's operable only if you have installed the Function Apps and received some incidents that need an action on affected data.
Deployment instructions
- Deploy the playbook by clicking on the "Deploy to Azure" button. This will take you to deploying an ARM Template wizard.
- Fill in the required parameters: * Playbook Name: Enter the playbook name here.
Post-Deployment instructions
-
Make sure the user that runs the playbook has the role Microsoft Sentinel Playbook Operator assigned. To assign the role, * Under the Subscriptions tab from the Home page, choose your subscription name. * Choose the Access Control (IAM) option from the left pane. * Click on Add > Add Role Assignment and add Microsoft Sentinel Playbook Operator to the user.
-
Authorize all connections * Go to Logic Apps and choose your playbook * In the Development Tools sections select API Connections. In the left pane you'll see the list of connections that you'll need to authorize * Authorize the Azure blob storage connection by selecting it and clicking on General\Edit API Connection
- Enter your connection name, storage account and access key. You can find them by selecting your storage account here and then choosing Security+networking\Access keys).
-
Grant KeyVault permissions to your playbook * Go to Key vaults and choose your keyvault, which starts from cohesitypro and is followed by a sequence of letters and numbers, e.g. cohesityprofnxj32cucakwk. * On the right pane, select Access Policies and click +Create. * Choose Get permission in the Secret Permissions section and press Next. * Enter your playbook name and press Next. * Press Next and then Create to finish granting permissions.
-
(Recommendation) Limit access rights to this playbook to only Backup Admins because this playbook rolls back customer data that can result in a loss of important data if used without a good reason. * From the Microsoft Sentinel navigation menu, select Settings. * In the Settings blade, select the Settings tab and expand Playbook Permissions. * Select Configure Permissions to open the Manage Permissions panel. * Select the required resource group and click Apply. * Select Done.
Troubleshooting
- If your API key expired, then you need to replace it with a new one. * Create the Cohesity Helios API key: * Go to the Cohesity Helios login page. * Enter your credentials and select Log In. The Summary page is displayed. * Navigate to Settings > Access Management. The Users tab is displayed. * Select Add API Key. The API Key Details is displayed. * Enter a name for the API key. * Select Save. * Go to Key vaults and choose your keyvault, which starts from cohesitypro and is followed by a sequence of letters and numbers, e.g. cohesityprofnxj32cucakwk. * Assign the ApiKey secret to the API Key value from the previous step. Now your API key is securely saved in the Azure KeyVault.
- If you see the Forbidden error message in the Keyvault block when you run the playbook, you can always authorize it manually. * Choose your app in the Logic Apps * Authorize your KeyVault connection by selecting it and clicking on General\Edit API Connection * Press the Authorize button and select the appropriate account. Enter your key vault name if prompted. You can find your key vault name here.
[Content truncated...]
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊