Rubrik: Updated data connector and added playbooks, analytic rules for DSPM & IR violation usecase

Solutions/RubrikSecurityCloud/Analytic Rules/RubrikClassificationEvents.yaml

@@ -0,0 +1,52 @@
+id: 9563dc15-ea0a-438a-9d50-7ab243378241
+name: Create Incident for Classification evnets for non DSPM license users
+version: 1.0.0
+kind: Scheduled
+description: |
+  'Creates an incident for Classification events (ClassficationResultsAvailable) for non DSPM license users.'
+severity: Medium
+status: Available
+requiredDataConnectors:
+  - connectorId: RubrikSecurityCloudAzureFunctions
+    dataTypes:
+      - RubrikViolationData
+queryFrequency: 5m
+queryPeriod: 5m
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Collection
+relevantTechniques:
+  - T1213
+query: |
+  Rubrik_Violation_Data_CL
+  | where Class == "Classification" and EventName == "ClassficationResultsAvailable"
+  | extend NewSeverity = case(Severity=="info", "Low",
+                              Severity=="warning", "Medium",
+                              Severity=="critical", "High",
+                              "Informational")
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: P7D
+    matchingMethod: Selected
+    groupByCustomDetails:
+      - ObjectId
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+alertDetailsOverride:
+  alertDisplayNameFormat: '{{Class}} event occurred for object {{ObjectName}} with type {{ObjectType}}'
+  alertDescriptionFormat: '{{Summary}}'
+  alertSeverityColumnName: NewSeverity
+customDetails:
+  ObjectId: ObjectId
+  ObjectName: ObjectName
+  ObjectType: ObjectType
+  EventType: Class
+  EventName: EventName
+  Summary: Summary
+  EventTimestamp: EventTimestamp
+  Severity: Severity
+  SnapshotId: SnapshotId

Solutions/RubrikSecurityCloud/Analytic Rules/RubrikCriticalAnomaly.yaml

@@ -1,6 +1,6 @@
 id: 54c70d21-696f-4f03-9238-9d7118d079fe
 name: Rubrik Critical Anomaly
-version: 1.0.0
+version: 1.1.0
 kind: Scheduled
 description: |
   'Rubrik Critical Anomaly rule matches Severity and if Critical severity found then generate the incident for each object.'
@@ -20,14 +20,14 @@ relevantTechniques:
   - T1546
 query: |
        Rubrik_Anomaly_Data_CL
-       | where severity_s == "critical"
+       | where Severity == "critical"
 eventGroupingSettings:
   aggregationKind: AlertPerResult
 customDetails:
-  ClusterIdentifier: custom_details_clusterId_g
-  ObjectId: custom_details_objectId_g
-  ObjectName: custom_details_objectName_s
-  ObjectType: custom_details_objectType_s
-  ClusterName: custom_details_clusterName_s
+  ClusterIdentifier: ClusterId
+  ObjectId: ObjectId
+  ObjectName: ObjectName
+  ObjectType: ObjectType
+  ClusterName: ClusterName
 incidentConfiguration:
   createIncident: true

Solutions/RubrikSecurityCloud/Analytic Rules/RubrikDataSecurityViolation.yaml

@@ -0,0 +1,57 @@
+id: 5b70b78e-397c-474c-a556-f6c37fccbb18
+name: Create Incident for Data Security Violation events for DSPM license users
+version: 1.0.0
+kind: Scheduled
+description: |
+  'Creates an incident for Data Security Violation events for DSPM license users.'
+severity: Medium
+status: Available
+requiredDataConnectors:
+  - connectorId: RubrikSecurityCloudAzureFunctions
+    dataTypes:
+      - RubrikViolationData
+queryFrequency: 5m
+queryPeriod: 5m
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Exfiltration
+relevantTechniques:
+  - T1567
+query: |
+  Rubrik_Violation_Data_CL
+  | where Class == "SecurityViolation" and EventName in ("CriticalSeverityDataViolationDetected",
+  "CriticalSeverityDataViolationReOpen",
+  "HighSeverityDataViolationDetected",
+  "HighSeverityDataViolationReOpen",
+  "LowOrMediumSeverityDataViolationDetected",
+  "LowOrMediumSeverityDataViolationReOpen")
+  | extend NewSeverity = case(Severity=="info", "Low",
+                              Severity=="warning", "Medium",
+                              Severity=="critical", "High",
+                              "Informational")
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: P7D
+    matchingMethod: Selected
+    groupByCustomDetails:
+      - ViolationId
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+alertDetailsOverride:
+  alertDisplayNameFormat: '{{Class}} event occurred for object {{ObjectName}} with type {{ObjectType}}'
+  alertDescriptionFormat: '{{Summary}}'
+  alertSeverityColumnName: NewSeverity
+customDetails:
+  ObjectId: ObjectId
+  ObjectName: ObjectName
+  ObjectType: ObjectType
+  EventType: Class
+  EventName: EventName
+  ViolationId: SeriesId
+  Summary: Summary
+  EventTimestamp: EventTimestamp
+  Severity: Severity

Solutions/RubrikSecurityCloud/Analytic Rules/RubrikIdentitySecurityViolation.yaml

@@ -0,0 +1,60 @@
+id: 77e7519f-be7e-41fc-8f02-76bb0a7d5496
+name: Create Incident for Identity Security Violation and Identity Alerts events for IR violations
+version: 1.0.0
+kind: Scheduled
+description: |
+  'Creates an incident for Identity Security Violation and Identity Alerts events for IR violations.'
+severity: Medium
+status: Available
+requiredDataConnectors:
+  - connectorId: RubrikSecurityCloudAzureFunctions
+    dataTypes:
+      - RubrikViolationData
+queryFrequency: 5m
+queryPeriod: 5m
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - CredentialAccess
+relevantTechniques:
+  - T1078
+query: |
+  Rubrik_Violation_Data_CL
+  | where (Class == "IdentityViolation" and EventName in ("CriticalSeverityDataViolationDetected",
+  "CriticalSeverityDataViolationReOpen", "HighSeverityDataViolationDetected",
+  "HighSeverityDataViolationReOpen", "LowOrMediumSeverityDataViolationDetected",
+  "LowOrMediumSeverityDataViolationReOpen")) or
+  (Class == "IdentityAlerts" and EventName in ("CriticalSeverityIdentityAlertDetected",
+  "CriticalSeverityIdentityAlertReOpened", "HighSeverityIdentityAlertDetected",
+  "HighSeverityIdentityAlertReOpened", "LowOrMediumSeverityIdentityAlertDetected",
+  "LowOrMediumSeverityIdentityAlertReOpened"
+  ))
+  | extend NewSeverity = case(Severity=="info", "Low",
+                              Severity=="warning", "Medium",
+                              Severity=="critical", "High",
+                              "Informational")
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: P7D
+    matchingMethod: Selected
+    groupByCustomDetails:
+      - ViolationId
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+alertDetailsOverride:
+  alertDisplayNameFormat: '{{Class}} event occurred for object {{ObjectName}} with type {{ObjectType}}'
+  alertDescriptionFormat: '{{Summary}}'
+  alertSeverityColumnName: NewSeverity
+customDetails:
+  ObjectId: ObjectId
+  ObjectName: ObjectName
+  ObjectType: ObjectType
+  EventType: Class
+  EventName: EventName
+  ViolationId: SeriesId
+  Summary: Summary
+  EventTimestamp: EventTimestamp
+  Severity: Severity

Solutions/RubrikSecurityCloud/Analytic Rules/RubrikThreatMonitoring.yaml

@@ -1,6 +1,6 @@
 id: 0083cbc4-776e-42ca-8694-6950fd605df9
 name: Rubrik Threat Monitoring
-version: 1.0.0
+version: 1.1.0
 kind: Scheduled
 description: |
   'Rubrik Threat Monitoring matches Event Name and if match found then generate the incident for each object.'
@@ -20,11 +20,11 @@ relevantTechniques:
   - T1546
 query: |
        Rubrik_Events_Data_CL
-       | where custom_details_eventName_s endswith "AnalysisMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringHashCatalogAnalysisFailed" or custom_details_eventName_s contains "ThreatMonitoringHashMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringYaraMatchesFound"
-       | extend hashMatchCount = toint(extract("Found ([0-9]+) hash matches",1, summary_s)),    yaraMatchCount = toint(extract("Found ([0-9]+) YARA rule matches", 1, summary_s)),    fileHashMatchCount = toint(extract("Found file hash matches for ([0-9]+) files", 1, summary_s))
-       | extend count_ = coalesce(hashMatchCount,yaraMatchCount, fileHashMatchCount), eventname = substring(custom_details_eventName_s,16, strlen(custom_details_eventName_s) - 28)
+       | where EventName endswith "AnalysisMatchesFound" or EventName contains "ThreatMonitoringHashCatalogAnalysisFailed" or EventName contains "ThreatMonitoringHashMatchesFound" or EventName contains "ThreatMonitoringYaraMatchesFound"
+       | extend hashMatchCount = toint(extract("Found ([0-9]+) hash matches",1, Summary)),    yaraMatchCount = toint(extract("Found ([0-9]+) YARA rule matches", 1, Summary)),    fileHashMatchCount = toint(extract("Found file hash matches for ([0-9]+) files", 1, Summary))
+       | extend count_ = coalesce(hashMatchCount,yaraMatchCount, fileHashMatchCount), eventname = substring(EventName,16, strlen(EventName) - 28)
        | where count_ > 0
-       | summarize arg_max(TimeGenerated,*) by eventname, custom_details_objectId_g, count_
+       | summarize arg_max(TimeGenerated,*) by eventname, ObjectId, count_
 incidentConfiguration:
       createIncident: true
       groupingConfiguration:
@@ -38,12 +38,12 @@ incidentConfiguration:
 eventGroupingSettings:
   aggregationKind: AlertPerResult
 alertDetailsOverride:
-  alertDisplayNameFormat: ThreatMonitoring Found {{count_}} {{eventname}} Matches for {{custom_details_objectName_s}}
+  alertDisplayNameFormat: ThreatMonitoring Found {{count_}} {{eventname}} Matches for {{ObjectName}}
 customDetails:
-  EventName: custom_details_eventName_s
-  Summary: summary_s
-  ClusterIdentifier: custom_details_clusterId_g
-  ObjectId: custom_details_objectId_g
-  ObjectName: custom_details_objectName_s
-  ObjectType: custom_details_objectType_s
-  Url: custom_details_url_s
+  EventName: EventName
+  Summary: Summary
+  ClusterIdentifier: ClusterId
+  ObjectId: ObjectId
+  ObjectName: ObjectName
+  ObjectType: ObjectType
+  Url: Url

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikClassificationActivity/__init__.py

@@ -0,0 +1,79 @@
+"""Activity function: RSC classification hit-count gate.
+
+Input:  {"objectId": str, "eventTimestamp": str}
+Output: {"snapshotId": str|None, "hitCount": int, "error": str|None}
+
+Never raises to the orchestrator — on any failure returns hitCount 0 with an error
+string (fail-closed: the orchestrator will then skip ingestion).
+"""
+import inspect
+from shared_code.logger import applogger
+from shared_code.consts import LOGS_STARTS_WITH, LOG_FORMAT
+from shared_code.rubrik_exception import RubrikException
+from .rubrik_dspm import RubrikDSPM
+
+FUNCTION_NAME = "RubrikClassificationActivity"
+
+
+def main(name) -> dict:
+    """Resolve snapshot and count policy hits for a classification event.
+
+    Args:
+        name (dict): {"objectId": str, "eventTimestamp": str}.
+
+    Returns:
+        dict: {"snapshotId": str|None, "hitCount": int, "error": str|None}.
+    """
+    __method_name = inspect.currentframe().f_code.co_name
+    object_id = name.get("objectId")
+    event_timestamp = name.get("eventTimestamp")
+    applogger.info(
+        LOG_FORMAT.format(
+            LOGS_STARTS_WITH,
+            FUNCTION_NAME,
+            __method_name,
+            "Classification gate invoked for object_id={}, event_timestamp={}.".format(
+                object_id, event_timestamp
+            ),
+        )
+    )
+    try:
+        if not object_id or not event_timestamp:
+            applogger.warning(
+                LOG_FORMAT.format(
+                    LOGS_STARTS_WITH,
+                    FUNCTION_NAME,
+                    __method_name,
+                    "Missing required parameter: objectId={}, eventTimestamp={}.".format(
+                        object_id, event_timestamp
+                    ),
+                )
+            )
+            return {
+                "snapshotId": None,
+                "hitCount": 0,
+                "error": "missing objectId or eventTimestamp",
+            }
+        client = RubrikDSPM()
+        result = client.get_hit_count(object_id, event_timestamp)
+        applogger.info(
+            LOG_FORMAT.format(
+                LOGS_STARTS_WITH,
+                FUNCTION_NAME,
+                __method_name,
+                "Classification gate result for object {}: hitCount={}, snapshotId={}, error={}".format(
+                    object_id, result.get("hitCount"), result.get("snapshotId"), result.get("error")
+                ),
+            )
+        )
+        return result
+    except RubrikException as err:
+        applogger.error(
+            LOG_FORMAT.format(LOGS_STARTS_WITH, FUNCTION_NAME, __method_name, err)
+        )
+        return {"snapshotId": None, "hitCount": 0, "error": str(err)}
+    except Exception as err:
+        applogger.error(
+            LOG_FORMAT.format(LOGS_STARTS_WITH, FUNCTION_NAME, __method_name, err)
+        )
+        return {"snapshotId": None, "hitCount": 0, "error": str(err)}

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikClassificationActivity/function.json

@@ -0,0 +1,10 @@
+{
+  "scriptFile": "__init__.py",
+  "bindings": [
+    {
+      "name": "name",
+      "type": "activityTrigger",
+      "direction": "in"
+    }
+  ]
+}