NetApp Ransomware Resilience Block User Playbook

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook blocks a user by calling the NetApp Ransomware Resilience block-user API endpoint after obtaining an authentication token from the NetApp Auth playbook.

Attribute	Value
Type	Playbook
Solution	NetApp Ransomware Resilience
Source	View on GitHub

Logic App Connectors

This playbook uses 1 Logic App connector / built-in action:

Connector / Action	Type	Connections	Actions
`http`	Built-in	0	2

Action parameters (URLs, paths, function IDs)

`http` (Built-in)

Action	Method	Endpoint	Other
Call_Auth_Playbook	POST	`[listCallbackUrl(variables('AuthPlaybookTriggerResourceId'), '2019-05-01').value]`	—
Submit_Block_User	POST	`@{concat(parameters('netAppApiBaseUrl'), '/v1/services/rps/v1/account/', variables('AccountId'), '/users/block-user')}`	—

Additional Documentation

📄 Source: NetApp-RansomwareResilience_Block_User_Playbook/readme.md

NetApp Ransomware Resilience - Block User

Overview

This playbook helps security teams block user access as part of incident response in NetApp Ransomware Resilience.

Purpose

Use this playbook when you need a controlled way to block a user based on investigation findings, suspicious behavior, or containment actions.

Deployment Order

This playbook should be deployed after:

Auth Playbook (required)

Input Parameters

user_id: User ID to block (required)
user_ips: Client IPs to block (required for NFS; optional for CIFS)
duration: Block duration - permanent or hours (1, 2, 4, 8, 12, 24) (optional)

Prerequisites

Auth Playbook must be deployed and functioning correctly.
Valid NetApp Ransomware Resilience configuration must be completed.
The playbook caller must provide user_id, and optionally user_ips/duration based on the protection scenario.

Deployment instructions

Click the Deploy to Azure button. This opens the ARM template deployment wizard.
Provide the required parameters:
- PlaybookName: Name of this playbook resource.
- NetAppRansomwareResilienceAuthPlaybookName: Name of the deployed NetApp Auth playbook.

Post-Deployment

1. Validate dependency configuration

Confirm the Auth playbook is deployed in the same environment.
Ensure the NetAppRansomwareResilienceAuthPlaybookName parameter matches the deployed Auth playbook name.

2. Functional validation

Run the Block User playbook with a valid payload.
Verify the expected block action is applied for the target user.
Validate behavior with and without optional inputs (user_ips, duration).

3. Microsoft Sentinel usage

Add this playbook to an automation rule or run it manually from an incident.
Pass required entities/details as playbook input (user_id, and optional user_ips/duration).