All integrationsSecurity

Rubrik

Watch and act on Rubrik Security Cloud backups from workflows: find protected objects and their SLA compliance, list and take snapshots, assign SLA Domains, read events, investigate and resolve ransomware anomalies, and run threat hunts for file hashes.

actions
22
triggers
7

Triggers

Start a workflow when something happens in Rubrik.

  • New eventRuns for each new event in Rubrik Security Cloud, such as a backup, recovery or archive, of the kinds, statuses and severities chosen. Events from before the workflow is turned on don't start it. How often it checks follows your workspace plan.
  • Backup failedRuns each time a Rubrik backup fails, with the object and RSC's reason, such as to open a ticket or alert the on-call channel. Failures before the workflow is turned on don't start it. How often it checks follows your workspace plan.
  • Anomaly detectedRuns each time Rubrik's Anomaly Detection reports an anomaly in a backup, a sign of ransomware, with the object it is on. Hand its id and object_id to 'Get anomaly'. Anomalies before the workflow is turned on don't start it. How often it checks follows your workspace plan.
  • Threat hunt finishedRuns each time a Rubrik threat hunt finishes (succeeded, partly, failed or stopped), with what it found. Hunts finished before the workflow is turned on don't start it. How often it checks follows your workspace plan.
  • New snapshotRuns for each new snapshot in Rubrik. Ones already there when the workflow is turned on don't start it. How often it checks follows your workspace plan.
  • Object out of complianceRuns when an object falls out of compliance with its SLA Domain in Rubrik, such as after missed backups, once each time it does. Objects already out of compliance when the workflow is turned on don't start it. How often it checks follows your workspace plan.
  • Cluster disconnectedRuns when a Rubrik cluster disconnects from Rubrik Security Cloud, once each time it does. Clusters already disconnected when the workflow is turned on don't start it. How often it checks follows your workspace plan.

Actions

Steps a workflow can run in Rubrik.

  • Get versionRead Rubrik Security Cloud's version, which also checks the connection works.
  • List clustersList the Rubrik clusters in the account with their status, version, free space and how long it will last.
  • Get clusterRead a Rubrik cluster: its status, health, version, storage and when it last connected.
  • List SLA DomainsList SLA Domains, the backup policies, with how often they take snapshots, how long they keep them and how many objects they protect.
  • Search objectsFind protected objects of any kind (VMs, databases, filesets, cloud resources, mailboxes) by name, with their SLA Domain and cluster.
  • List objectsList the objects of one or more kinds, such as every SQL Server database or Linux fileset, with their SLA Domain and cluster.
  • Get objectRead a protected object: its kind, where it is, its SLA Domain and how many snapshots it has.
  • List vSphere VMsList VMware vSphere virtual machines with their SLA Domain, snapshot count and cluster.
  • Get vSphere VMRead a vSphere virtual machine: its SLA Domain, guest OS, snapshot count and its newest and oldest snapshot.
  • List objects by complianceList objects with their SLA compliance, protection, last snapshot and missed snapshots, such as to report every object out of compliance.
  • List snapshotsList an object's snapshots, newest first, by kind and date, such as to check a server was backed up last night.
  • Get snapshotRead a snapshot: when it was taken and expires, its SLA Domain and whether it is flagged as an anomaly or quarantined.
  • Take on-demand snapshotBack up one or more objects now, outside their schedule. Gives a task for each, to follow with 'Get task status'.
  • Get task statusRead how a task such as an on-demand snapshot is going: running, succeeded or failed, and how far along.
  • Assign SLA DomainProtect objects with an SLA Domain, stop protecting them, or have them inherit their parent's SLA Domain again.
  • List eventsList events (backups, recoveries, anomalies, threat hunts and more), most recently changed first, by kind, status, severity, object and date.
  • Get eventRead an event with each of its messages, as RSC's Events page shows them, such as to post why a backup failed.
  • Get anomalyRead what Anomaly Detection found in a snapshot: how likely an attack is, suspicious, encrypted and deleted files, and ransomware strains.
  • Resolve anomalyMark an anomaly resolved after investigating it, or report it as a false positive with the reason.
  • List threat huntsList threat hunts with their status and what they found, by status, whether they found matches, cluster and when they started.
  • Get threat huntRead a threat hunt: its status, how many objects and snapshots it scanned and how many had matches.
  • Start threat huntStart a Turbo Threat Hunt that looks through backups for files with the given hashes, such as indicators from a security alert.

Automate Rubrik with Lodol.

Connect Rubrik, then hand Lodol the job in Slack, Claude or ChatGPT.

Free plan, no credit card