Rubrik Data Object Discovery

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook queries Rubrik Security Cloud to enrich the incoming event with additional information from Rubrik about the object and it's snapshots that the event refers to.

Attribute Value
Type Playbook
Solution RubrikSecurityCloud
Source View on GitHub

Logic App Connectors

This playbook uses 4 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
keyvault Managed 1 0
keyvault_1 Managed 0 2
RubrikCustomConnector Custom 1 1
http Built-in 0 3
Action parameters (URLs, paths, function IDs)

keyvault_1 (Managed)

Action Method Endpoint Other
ClientId get /secrets/@{encodeURIComponent('Rubrik-AS-Int-ClientId')}/value —
ClientSecret get /secrets/@{encodeURIComponent('Rubrik-AS-Int-ClientSecret')}/value —

RubrikCustomConnector (Custom)

Action Method Endpoint Other
Authentication_2 post /api/client_token —

http (Built-in)

Action Method Endpoint Other
List_the_snapshots_for_all_objects_2 POST @{triggerBody()?['BaseUrl']}/api/graphql —
Search_the_global_objects POST @{triggerBody()?['BaseUrl']}/api/graphql —
List_the_snapshots_for_all_objects POST @{triggerBody()?['BaseUrl']}/api/graphql —

Additional Documentation

📄 Source: RubrikDataObjectDiscovery/readme.md

Summary

This playbook queries Rubrik Security Cloud to enrich the incoming event with additional information from Rubrik about the object and it’s snapshots that the event refers to.

Prerequisites

  1. The Rubrik Security Cloud data connector should be configured to send appropriate events to Microsoft Sentinel.
  2. The Rubrik Security Cloud solution should be configured to connect to Rubrik Security Cloud API end points using a Service Account, the service account should be assigned a role that includes the relevant privileges necessary to perform the desired operations (see Roles and Permissions in the Rubrik Security Cloud user guide).
  3. Store Service account credentials in Key Vault and obtain keyvault name and tenantId a. Create a Key Vault with unique name b. Go to KeyVault -> secrets -> Generate/import and create 'Rubrik-AS-Int-ClientId' & 'Rubrik-AS-Int-ClientSecret' for storing client_id and client_secret respectively

Deployment instructions

  1. To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
  2. Fill in the required paramteres:
    • Playbook Name: Enter the playbook name here
    • Rubrik Connector name: Name of the Rubrik Custom Connector deployed previously
    • keyvaultname: Name of keyvault where secrets are stored.
    • tenantId: TenantId where keyvault is located.

Deploy to Azure Deploy to Azure

Post-Deployment instructions

a. Authorize connections

Once deployment is complete, authorize each connection like keyvault.

  1. Click the connection resource
  2. Click edit API connection
  3. Click Authorize
  4. Sign in
  5. Click Save
  6. Repeat steps for other connections

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to RubrikSecurityCloud