Rubrik: Updated data connector and added playbooks, analytic rules for DSPM & IR violation usecase - #14788
Draft
niralishah-crest wants to merge 1 commit into
Draft
Conversation
… IR violation usecase
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds Rubrik DSPM + IR “violation” coverage by introducing new playbooks and analytic rules, and updating the Rubrik webhook connector to ingest Violation events into a dedicated table.
Changes:
- Added new playbooks: QuarantineFiles (Graph + MDE quarantine flow) and IR Violation Remediation, plus documentation updates.
- Updated Rubrik webhook connector ARM + connector docs to use Azure Monitor Logs Ingestion (DCE/DCR) and add a Violation table/stream.
- Added new analytic rules for classification, data security violations, and identity security violations; updated existing anomaly/threat rules to new column mappings.
Reviewed changes
Copilot reviewed 19 out of 23 changed files in this pull request and generated 17 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/RubrikSecurityCloud/Playbooks/RubrikQuarantineFiles/azuredeploy.json | New child playbook to quarantine batches via Graph (OneDrive) or MDE (NTFS). |
| Solutions/RubrikSecurityCloud/Playbooks/RubrikQuarantineFiles/README.md | Deployment + prerequisites documentation for QuarantineFiles playbook. |
| Solutions/RubrikSecurityCloud/Playbooks/RubrikIRViolation/azuredeploy.json | New incident-triggered playbook to notify + update Rubrik IR violation status. |
| Solutions/RubrikSecurityCloud/Playbooks/RubrikIRViolation/README.md | Deployment + prerequisites documentation for IR playbook. |
| Solutions/RubrikSecurityCloud/Playbooks/RubrikDSPMViolationRemediation/README.md | New/updated DSPM remediation playbook documentation referencing QuarantineFiles. |
| Solutions/RubrikSecurityCloud/Package/createUiDefinition.json | Updates solution summary counts and adds analytic-rule sections. |
| Solutions/RubrikSecurityCloud/Data/Solution_RubrikSecurityCloud.json | Registers new playbooks + analytic rules in the solution manifest. |
| Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/azuredeploy_Connector_RubrikWebhookEvents_AzureFunction.json | Connector ARM update: DCE/DCR + custom tables + violation ingestion settings. |
| Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikWebhookEvents_FunctionApp.json | Connector UX updates for Violation table + Log Ingestion API approach. |
| Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikViolationOrchestrator/function.json | New durable orchestrator function for Violation events. |
| Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikViolationOrchestrator/init.py | Routes Violation events; gates classification ingestion via RSC hit-count. |
| Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikClassificationActivity/rubrik_dspm.py | Minimal RSC GraphQL client used by the classification gate. |
| Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikClassificationActivity/function.json | New durable activity function definition for classification gating. |
| Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikClassificationActivity/init.py | Activity implementation to resolve snapshot + count hits (fail-closed). |
| Solutions/RubrikSecurityCloud/Analytic Rules/RubrikThreatMonitoring.yaml | Updates query/customDetails to the new flattened columns. |
| Solutions/RubrikSecurityCloud/Analytic Rules/RubrikIdentitySecurityViolation.yaml | New analytic rule for IR-related identity violation/alert events. |
| Solutions/RubrikSecurityCloud/Analytic Rules/RubrikDataSecurityViolation.yaml | New analytic rule for DSPM “SecurityViolation” events. |
| Solutions/RubrikSecurityCloud/Analytic Rules/RubrikCriticalAnomaly.yaml | Updates query/customDetails to the new flattened columns. |
| Solutions/RubrikSecurityCloud/Analytic Rules/RubrikClassificationEvents.yaml | New analytic rule for classification events (non-DSPM licensing scenario). |
| "AZURE_DATA_COLLECTION_ENDPOINT": "[reference(variables('dceId'), '2022-06-01').logsIngestion.endpoint]", | ||
| "DCR_WEBHOOK_RULE_ID": "[reference(variables('webhookDcrId'), '2022-06-01').immutableId]", | ||
| "DCR_EVENTS_RULE_ID": "[reference(variables('eventsDcrId'), '2022-06-01').immutableId]", | ||
| "SCOPE": "https://monitor.azure.com//.default", |
| "RubrikClientSecret": "[parameters('RubrikClientSecret')]", | ||
| "LogLevel": "[parameters('LogLevel')]", | ||
| "WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-RubrikWebhookEvents-functionapp" | ||
| "WEBSITE_RUN_FROM_PACKAGE": "https://github.com/niralishah-crest/MSSentinelIntegrations/raw/refs/heads/main/RubrikDataConnector.zip" |
| "AZURE_DATA_COLLECTION_ENDPOINT": "[reference(variables('dceId'), '2022-06-01').logsIngestion.endpoint]", | ||
| "DCR_WEBHOOK_RULE_ID": "[reference(variables('webhookDcrId'), '2022-06-01').immutableId]", | ||
| "DCR_EVENTS_RULE_ID": "[reference(variables('eventsDcrId'), '2022-06-01').immutableId]", | ||
| "SCOPE": "https://monitor.azure.com//.default", |
Comment on lines
+587
to
+588
| "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('WorkspaceName'))]" | ||
| } |
| { | ||
| "title": "Option 1 - Azure Resource Manager (ARM) Template", | ||
| "description": "Use this method for automated deployment of the Rubrik connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[](https://aka.ms/sentinel-RubrikWebhookEvents-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the below information : \n\t\tFunction Name \n\t\tWorkspace ID \n\t\tWorkspace Key \n\t\tAnomaliesTableName \n\t\tRansomwareAnalysisTableName \n\t\tThreatHuntsTableName \n\t\tEventsTableName \n\t\tLogLevel \n \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." | ||
| "description": "Use this method for automated deployment of the Rubrik connector.\n\n1. Click the **Deploy to Azure** (Commercial) or **Deploy to Azure Gov** button below.\n\n\t[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fniralishah-crest%2FMSSentinelIntegrations%2Frefs%2Fheads%2Fmain%2Fazuredeploy_Connector_RubrikWebhookEvents_AzureFunction.json)\n\t[](https://aka.ms/sentinel-RubrikWebhookEvents-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**.\n3. Enter the below information:\n\t\tFunction Name\n\t\tWorkspace Name\n\t\tLocation\n\t\tAnomaliesTableName\n\t\tRansomwareAnalysisTableName\n\t\tThreatHuntsTableName\n\t\tEventsTableName\n\t\tViolationTableName\n\t\tRubrikInstanceUrl\n\t\tRubrikClientId\n\t\tRubrikClientSecret\n\t\tLogLevel\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**.\n5. Click **Purchase** to deploy." |
| }, | ||
| "else": { "actions": {} } | ||
| }, | ||
| "Get_MDE_Machine": { |
| "type": "Http", | ||
| "inputs": { | ||
| "method": "GET", | ||
| "uri": "@{variables('MDE_Base_URL')}/api/machines?$filter=computerDnsName eq '@{items('For_each_ntfs_file')?['physicalHost']}'", |
| "headers": { "Authorization": "Bearer @{variables('MDE_Access_Token')}" } | ||
| } | ||
| }, | ||
| "Check_Get_MDE_Machine": { |
Comment on lines
+931
to
+932
| "and": [ | ||
| { "equals": ["@variables('Ntfs_File_Handled')", false] }, |
Comment on lines
+961
to
+967
| "actions": { | ||
| "Set_MDE_Machine_Id": { | ||
| "runAfter": {}, | ||
| "type": "SetVariable", | ||
| "inputs": { "name": "MDE_Machine_Id", "value": "@{first(coalesce(body('Get_MDE_Machine')?['value'], json('[]')))?['id']}" } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present: