NetApp Ransomware Resilience Unblock User Playbook

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook unblocks a user by calling the NetApp Ransomware Resilience unblock-user API endpoint after obtaining an authentication token from the NetApp Auth playbook.

Attribute	Value
Type	Playbook
Solution	NetApp Ransomware Resilience
Source	View on GitHub

Logic App Connectors

This playbook uses 1 Logic App connector / built-in action:

Connector / Action	Type	Connections	Actions
`http`	Built-in	0	2

Action parameters (URLs, paths, function IDs)

`http` (Built-in)

Action	Method	Endpoint	Other
Call_Auth_Playbook	POST	`[listCallbackUrl(variables('AuthPlaybookTriggerResourceId'), '2019-05-01').value]`	—
Submit_Unblock_User	POST	`@{concat(parameters('netAppApiBaseUrl'), '/v1/services/rps/v1/account/', variables('AccountId'), '/users/unblock-user')}`	—

Additional Documentation

📄 Source: NetApp-RansomwareResilience_Unblock_User_Playbook/readme.md

NetApp Ransomware Resilience - Unblock User

Overview

This playbook helps security teams restore user access in NetApp Ransomware Resilience after review and approval.

Purpose

Use this playbook when a previously blocked user should be safely returned to normal access as part of incident recovery.

Deployment Order

This playbook should be deployed after:

Auth Playbook (required)

Input Parameters

user_id: User ID to unblock (required)
user_ips: Client IPs to unblock (required for NFS; optional for CIFS)

Prerequisites

Auth Playbook must be deployed and functioning correctly.
Valid NetApp Ransomware Resilience configuration must be completed.
The playbook caller must provide user_id, and optionally user_ips based on the protection scenario.

Deployment instructions

Click the Deploy to Azure button. This opens the ARM template deployment wizard.
Provide the required parameters:
- PlaybookName: Name of this playbook resource.
- NetAppRansomwareResilienceAuthPlaybookName: Name of the deployed NetApp Auth playbook.

Post-Deployment

1. Validate dependency configuration

Confirm the Auth playbook is deployed in the same environment.
Ensure the NetAppRansomwareResilienceAuthPlaybookName parameter matches the deployed Auth playbook name.

2. Functional validation

Run the Unblock User playbook with a valid payload.
Verify the expected unblock action is applied for the target user.
Validate behavior with and without optional input (user_ips).

3. Microsoft Sentinel usage

Add this playbook to an automation rule or run it manually from an incident.
Pass required entities/details as playbook input (user_id, and optional user_ips).