You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: Packs/RubrikPolaris/Integrations/RubrikPolaris/RubrikPolaris.yml
+16-13
Original file line number
Diff line number
Diff line change
@@ -97,14 +97,16 @@ script:
97
97
description: The ID of the cluster.
98
98
type: String
99
99
- arguments:
100
-
- description: |
100
+
- description: |-
101
101
The name of the Rubrik object to check for sensitive hits. When used in combination with "Rubrik Radar Anomaly" incidents, this value will automatically be looked up using the incident context. Otherwise it is a required value.
102
102
103
103
Note: Users can get the list of the object names by executing the "rubrik-polaris-object-list" or "rubrik-polaris-object-search" command.
104
+
.
104
105
name: objectName
105
106
- defaultValue: 7
106
-
description: |
107
+
description: |-
107
108
The number of days in the past to look for sensitive hits. If no value is provided, then today's data will be returned and, if there is no data for today then the argument will default to 7 days.
109
+
.
108
110
name: searchTimePeriod
109
111
description: Find data classification hits on an object.
110
112
name: rubrik-sonar-sensitive-hits
@@ -703,10 +705,11 @@ script:
703
705
description: Whether the result has the next page or not.
704
706
type: Boolean
705
707
- arguments:
706
-
- description: |
708
+
- description: |-
707
709
Name of the scan. If not provided, it defaults to "<today's date> Classification".
710
+
.
708
711
name: scan_name
709
-
- description: "List of sonar policies to scan.\n\nNote: Users can get the list of analyzer groups by executing the \"rubrik-sonar-policy-analyzer-groups-list\" command. \n\nFormat Accepted: \n[\n {\n\"id\": \"543dd5e0-c72c-50e2-a3d9-1688343f472c\",\n\"name\": \"HIPAA\",\n\"groupType\": \"HIPAA\",\n\"analyzers\": [\n {\n\"id\": \"9da675b3-944b-5da3-a2da-ed149d300075\",\n\"name\": \"US/UK Passport\",\n\"analyzerType\": \"PASSPORT\"\n },\n {\n\"id\": \"18665533-c28c-5a40-b747-4b6508fecdfa\",\n\"name\": \"US NPI\",\n\"analyzerType\": \"US_HEALTHCARE_NPI\"\n }\n ]\n }\n]"
712
+
- description: "List of sonar policies to scan.\n\nNote: Users can get the list of analyzer groups by executing the \"rubrik-sonar-policy-analyzer-groups-list\" command. \n\nFormat Accepted: \n[\n {\n\"id\": \"543dd5e0-c72c-50e2-a3d9-1688343f472c\",\n\"name\": \"HIPAA\",\n\"groupType\": \"HIPAA\",\n\"analyzers\": [\n {\n\"id\": \"9da675b3-944b-5da3-a2da-ed149d300075\",\n\"name\": \"US/UK Passport\",\n\"analyzerType\": \"PASSPORT\"\n },\n {\n\"id\": \"18665533-c28c-5a40-b747-4b6508fecdfa\",\n\"name\": \"US NPI\",\n\"analyzerType\": \"US_HEALTHCARE_NPI\"\n }\n ]\n }\n]."
710
713
name: sonar_policy_analyzer_groups
711
714
required: true
712
715
- description: "List of VM object IDs to scan.\n\nNote: Users can get the list of VM object IDs by executing the \"rubrik-polaris-vm-objects-list\" command."
@@ -957,9 +960,9 @@ script:
957
960
- description: "The Snapshot ID of the file that needs to be downloaded.\n\nNote: Users can retrieve the list of the snapshot IDs by executing the \"rubrik-polaris-vm-object-snapshot-list\" command."
958
961
name: snapshot_id
959
962
required: true
960
-
- description: "The path of the folder to list the sub-files. If not provided the root directory files will be returned.\n\nFormat accepted : \"/<directory name>/<sub directory name or file name>\"\n\nExample: \"/C:\", \"/C:/Users\""
963
+
- description: "The path of the folder to list the sub-files. If not provided the root directory files will be returned.\n\nFormat accepted : \"/<directory name>/<sub directory name or file name>\"\n\nExample: \"/C:\", \"/C:/Users\"."
961
964
name: path
962
-
- description: "Provide a keyword to search in the file names.\n\nExample: \"admin\""
965
+
- description: "Provide a keyword to search in the file names.\n\nExample: \"admin\"."
963
966
name: search_prefix
964
967
- defaultValue: 50
965
968
description: Number of results to retrieve in the response. Maximum size allowed is 1000.
@@ -1448,10 +1451,10 @@ script:
1448
1451
"name": <string>
1449
1452
}
1450
1453
}
1451
-
]
1454
+
].
1452
1455
name: vnic_bindings
1453
1456
- description: |-
1454
-
Point in time to recover to, e.g.: "2023-03-04T05:06:07.890"
1457
+
Point in time to recover to, e.g.: "2023-03-04T05:06:07.890".
1455
1458
name: recovery_point
1456
1459
description: "Performs a live mount of a virtual machine snapshot.\n\nNote: To know about the live mount status, use the \"rubrik-gps-async-result\" command."
1457
1460
name: rubrik-gps-vm-livemount
@@ -1890,7 +1893,7 @@ script:
1890
1893
1891
1894
Note: To provide multiple IOCs use the argument "advance_ioc".
1892
1895
name: ioc_value
1893
-
- description: "Json encoded Indicators Of Compromise to scan. Json keys signify the type of IOC and the corresponding list of values are the values of the IOC's. If provided, will ignore the ioc_type and ioc_value arguments.\n\nPossible keys to indicate type of indicator: \nINDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE\n\nFormat Accepted:\n{\n\"<ioc_type1>\": [\"<ioc_value1>\", \"<ioc_value2>\"],\n\"<ioc_type2>\": \"<ioc_value2>\"\n}\n\nExample:\n{\n\"INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME\": [\"C:\\Users\\Malware_Executible.ps1\", \"\\bin\\Malware_Executible\"],\n\"INDICATOR_OF_COMPROMISE_TYPE_HASH\": [\"e5c1b9c44be582f895eaea3d3738c5b4\", \"f541b9844be897f895eaea3d3738cfb2\"],\n\"INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE\": \"rule match_everything {condition:true}\"\n}"
1896
+
- description: "Json encoded Indicators Of Compromise to scan. Json keys signify the type of IOC and the corresponding list of values are the values of the IOC's. If provided, will ignore the ioc_type and ioc_value arguments.\n\nPossible keys to indicate type of indicator: \nINDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME, INDICATOR_OF_COMPROMISE_TYPE_HASH, INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE\n\nFormat Accepted:\n{\n\"<ioc_type1>\": [\"<ioc_value1>\", \"<ioc_value2>\"],\n\"<ioc_type2>\": \"<ioc_value2>\"\n}\n\nExample:\n{\n\"INDICATOR_OF_COMPROMISE_TYPE_PATH_OR_FILENAME\": [\"C:\\Users\\Malware_Executible.ps1\", \"\\bin\\Malware_Executible\"],\n\"INDICATOR_OF_COMPROMISE_TYPE_HASH\": [\"e5c1b9c44be582f895eaea3d3738c5b4\", \"f541b9844be897f895eaea3d3738cfb2\"],\n\"INDICATOR_OF_COMPROMISE_TYPE_YARA_RULE\": \"rule match_everything {condition:true}\"\n}."
1894
1897
name: advance_ioc
1895
1898
- description: |-
1896
1899
Filter the snapshots from the provided date. Any snapshots taken before the provided date-time will be excluded.
@@ -1929,21 +1932,21 @@ script:
1929
1932
Paths to include in the scan. Supports comma separated values.
1930
1933
1931
1934
Format accepted:
1932
-
path_to_include_1, path_to_include_2
1935
+
path_to_include_1, path_to_include_2.
1933
1936
isArray: true
1934
1937
name: paths_to_include
1935
1938
- description: |-
1936
1939
Paths to exclude from the scan. Supports comma separated values.
1937
1940
1938
1941
Format accepted:
1939
-
path_to_exclude_1, path_to_exclude_2
1942
+
path_to_exclude_1, path_to_exclude_2.
1940
1943
isArray: true
1941
1944
name: paths_to_exclude
1942
1945
- description: |-
1943
1946
Paths to exempt from exclusion. Supports comma separated values.
Copy file name to clipboardExpand all lines: Packs/RubrikPolaris/pack_metadata.json
+1-1
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
"name": "Rubrik Polaris",
3
3
"description": "Rubrik Polaris revolutionizes the data management market, specifically backup/recovery, archival, and DR, by providing a global policy framework, workflow orchestration, and deep data intelligence as cloud-delivered applications. The content pack fetches Rubrik Radar Anomaly Event and provides playbooks to analyze, discover and recover -- to mention a few -- organizational data. The content pack is rich with commands to perform on-demand scans, backups, recoveries and many more features exposed by the Polaris API.",
0 commit comments