NetApp Ransomware Resilience Volume Online Playbook

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook takes a NetApp volume online by calling the NetApp Ransomware Resilience take-volume-online API endpoint after obtaining an authentication token from the NetApp Auth playbook.

Attribute	Value
Type	Playbook
Solution	NetApp Ransomware Resilience
Source	View on GitHub

Logic App Connectors

This playbook uses 1 Logic App connector / built-in action:

Connector / Action	Type	Connections	Actions
`http`	Built-in	0	2

Action parameters (URLs, paths, function IDs)

`http` (Built-in)

Action	Method	Endpoint	Other
Call_Auth_Playbook	POST	`[listCallbackUrl(variables('AuthPlaybookTriggerResourceId'), '2019-05-01').value]`	—
Submit_Volume_Online	POST	`@{concat(parameters('netAppApiBaseUrl'), '/v1/services/rps/v1/account/', variables('AccountId'), '/storage/take-volume-online')}`	—

Additional Documentation

📄 Source: NetApp-RansomwareResilience_Volume_Online_Playbook/readme.md

NetApp Ransomware Resilience - Volume Online

Overview

This playbook helps security teams bring a volume back online in NetApp Ransomware Resilience as part of recovery operations.

Purpose

Use this playbook when a volume that was taken offline for containment or investigation should be restored to service in a controlled way.

Deployment Order

This playbook should be deployed after:

Auth Playbook (required)

Input Parameters

volume_id: ID of Volume (required)
agent_id: Console Agent ID (required)
system_id: System ID (required)

Prerequisites

Auth Playbook must be deployed and functioning correctly.
Valid NetApp Ransomware Resilience configuration must be completed.
The playbook caller must provide volume_id, agent_id, and system_id.

Deployment instructions

Click the Deploy to Azure button. This opens the ARM template deployment wizard.
Provide the required parameters:
- PlaybookName: Name of this playbook resource.
- NetAppRansomwareResilienceAuthPlaybookName: Name of the deployed Auth playbook.

Post-Deployment

1. Validate dependency configuration

Confirm the Auth playbook is deployed in the same environment.
Ensure the NetAppRansomwareResilienceAuthPlaybookName parameter matches the deployed Auth playbook name.

2. Functional validation

Run the Volume Online playbook with a valid payload.
Verify the expected action is applied for the target volume.

3. Microsoft Sentinel usage

Add this playbook to an automation rule or run it manually from an incident.
Pass required entities/details as playbook input (volume_id, agent_id, system_id).