Rubrik: Updated data connector and added playbooks, analytic rules for DSPM & IR violation usecase by niralishah-crest · Pull Request #14788 · Azure/Azure-Sentinel

Nirali Shah (niralishah-crest) · 2026-07-29T12:55:41Z

Change(s):

Data connector (Azure Function App, RubrikWebhookEvents):
- Added collection of DSPM and Identity Resilience (IR) violation events into a new table, Rubrik_Violation_Data_CL, through a new RubrikViolationOrchestrator function.
- Added a RubrikClassificationActivity function that checks hit counts for classification-results events. An event is ingested only when Rubrik Security Cloud reports more than 0 policy hits. If the check fails, the event is not ingested.
- Switched ingestion from the HTTP Data Collector API to the Azure Monitor Log Ingestion API.
- Added the ViolationTableName, RubrikInstanceUrl, RubrikClientId and RubrikClientSecret parameters, plus a Deploy to Azure Gov option.
- Updated the connector definition (graph query, sample query, data type, connectivity criteria and webhook setup steps for RubrikViolationOrchestrator) and the function app package (RubrikDataConnector.zip).
Analytic rules (new):
- Create Incident for Classification events for non DSPM license users (Collection, T1213)
- Create Incident for Data Security Violation events for DSPM license users (Exfiltration, T1567)
- Create Incident for Identity Security Violation and Identity Alerts events for IR violations (InitialAccess, T1078)
Playbooks (new):
- RubrikDSPMViolationRemediation: incident-triggered playbook. For SecurityViolation events it validates the violation against the incident, sets it to IN_PROGRESS, exports the violation-files CSV and the remediation-actions log to blob storage with read-only SAS links, quarantines the file hits, notifies the owner in Teams, and sets REMEDIATED only when every quarantine succeeds. Classification events (no DSPM license) get a shorter flow.
- RubrikIRViolation: incident-triggered playbook. It gets the IR violation details from RSC, posts a SOC notification with the manual remediation steps to Teams, comments on the incident, and sets the violation to IN_PROGRESS.
- RubrikQuarantineFiles: HTTP-triggered child playbook. It quarantines OneDrive/SharePoint files through Microsoft Graph and Windows file-share (NTFS) files through Microsoft Defender for Endpoint, and returns a result for each file.
Solution packaging: added the new content to Solution_RubrikSecurityCloud.json, regenerated mainTemplate.json and createUiDefinition.json, added the 3.5.5 package, and updated ReleaseNotes.md and SolutionMetadata.json (lastPublishDate 2026-10-26).

Reason for Change(s):

Add support for the Rubrik DSPM (Data Security Posture Management) and Identity Resilience violation use cases: ingest violation and classification events into Microsoft Sentinel, raise incidents for them, and automate response (file quarantine, violation status updates, SOC/owner notifications).
Move the Function App connector from the shared workspace key to managed identity with DCR-based ingestion, and add Azure Government support.

Version Updated:

Yes, 3.5.5 solutionVersion

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Yes

… IR violation usecase

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Rubrik DSPM + IR “violation” coverage by introducing new playbooks and analytic rules, and updating the Rubrik webhook connector to ingest Violation events into a dedicated table.

Changes:

Added new playbooks: QuarantineFiles (Graph + MDE quarantine flow) and IR Violation Remediation, plus documentation updates.
Updated Rubrik webhook connector ARM + connector docs to use Azure Monitor Logs Ingestion (DCE/DCR) and add a Violation table/stream.
Added new analytic rules for classification, data security violations, and identity security violations; updated existing anomaly/threat rules to new column mappings.

Reviewed changes

Copilot reviewed 19 out of 23 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
Solutions/RubrikSecurityCloud/Playbooks/RubrikQuarantineFiles/azuredeploy.json	New child playbook to quarantine batches via Graph (OneDrive) or MDE (NTFS).
Solutions/RubrikSecurityCloud/Playbooks/RubrikQuarantineFiles/README.md	Deployment + prerequisites documentation for QuarantineFiles playbook.
Solutions/RubrikSecurityCloud/Playbooks/RubrikIRViolation/azuredeploy.json	New incident-triggered playbook to notify + update Rubrik IR violation status.
Solutions/RubrikSecurityCloud/Playbooks/RubrikIRViolation/README.md	Deployment + prerequisites documentation for IR playbook.
Solutions/RubrikSecurityCloud/Playbooks/RubrikDSPMViolationRemediation/README.md	New/updated DSPM remediation playbook documentation referencing QuarantineFiles.
Solutions/RubrikSecurityCloud/Package/createUiDefinition.json	Updates solution summary counts and adds analytic-rule sections.
Solutions/RubrikSecurityCloud/Data/Solution_RubrikSecurityCloud.json	Registers new playbooks + analytic rules in the solution manifest.
Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/azuredeploy_Connector_RubrikWebhookEvents_AzureFunction.json	Connector ARM update: DCE/DCR + custom tables + violation ingestion settings.
Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikWebhookEvents_FunctionApp.json	Connector UX updates for Violation table + Log Ingestion API approach.
Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikViolationOrchestrator/function.json	New durable orchestrator function for Violation events.
Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikViolationOrchestrator/init.py	Routes Violation events; gates classification ingestion via RSC hit-count.
Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikClassificationActivity/rubrik_dspm.py	Minimal RSC GraphQL client used by the classification gate.
Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikClassificationActivity/function.json	New durable activity function definition for classification gating.
Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikClassificationActivity/init.py	Activity implementation to resolve snapshot + count hits (fail-closed).
Solutions/RubrikSecurityCloud/Analytic Rules/RubrikThreatMonitoring.yaml	Updates query/customDetails to the new flattened columns.
Solutions/RubrikSecurityCloud/Analytic Rules/RubrikIdentitySecurityViolation.yaml	New analytic rule for IR-related identity violation/alert events.
Solutions/RubrikSecurityCloud/Analytic Rules/RubrikDataSecurityViolation.yaml	New analytic rule for DSPM “SecurityViolation” events.
Solutions/RubrikSecurityCloud/Analytic Rules/RubrikCriticalAnomaly.yaml	Updates query/customDetails to the new flattened columns.
Solutions/RubrikSecurityCloud/Analytic Rules/RubrikClassificationEvents.yaml	New analytic rule for classification events (non-DSPM licensing scenario).

+                        "AZURE_DATA_COLLECTION_ENDPOINT": "[reference(variables('dceId'), '2022-06-01').logsIngestion.endpoint]",
+                        "DCR_WEBHOOK_RULE_ID": "[reference(variables('webhookDcrId'), '2022-06-01').immutableId]",
+                        "DCR_EVENTS_RULE_ID": "[reference(variables('eventsDcrId'), '2022-06-01').immutableId]",
+                        "SCOPE": "https://monitor.azure.com//.default",


+                        "RubrikClientSecret": "[parameters('RubrikClientSecret')]",
                        "LogLevel": "[parameters('LogLevel')]",
-                        "WEBSITE_RUN_FROM_PACKAGE": "https://aka.ms/sentinel-RubrikWebhookEvents-functionapp"
+                        "WEBSITE_RUN_FROM_PACKAGE": "https://github.com/niralishah-crest/MSSentinelIntegrations/raw/refs/heads/main/RubrikDataConnector.zip"


+                        "AZURE_DATA_COLLECTION_ENDPOINT": "[reference(variables('dceId'), '2022-06-01').logsIngestion.endpoint]",
+                        "DCR_WEBHOOK_RULE_ID": "[reference(variables('webhookDcrId'), '2022-06-01').immutableId]",
+                        "DCR_EVENTS_RULE_ID": "[reference(variables('eventsDcrId'), '2022-06-01').immutableId]",
+                        "SCOPE": "https://monitor.azure.com//.default",


+                            "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('WorkspaceName'))]"
+                        }


        {
            "title": "Option 1 - Azure Resource Manager (ARM) Template",
-            "description": "Use this method for automated deployment of the Rubrik connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-RubrikWebhookEvents-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the below information : \n\t\tFunction Name \n\t\tWorkspace ID \n\t\tWorkspace Key \n\t\tAnomaliesTableName \n\t\tRansomwareAnalysisTableName \n\t\tThreatHuntsTableName \n\t\tEventsTableName \n\t\tLogLevel \n \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy."
+            "description": "Use this method for automated deployment of the Rubrik connector.\n\n1. Click the **Deploy to Azure** (Commercial) or **Deploy to Azure Gov** button below.\n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fniralishah-crest%2FMSSentinelIntegrations%2Frefs%2Fheads%2Fmain%2Fazuredeploy_Connector_RubrikWebhookEvents_AzureFunction.json)\n\t[![Deploy To Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-RubrikWebhookEvents-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**.\n3. Enter the below information:\n\t\tFunction Name\n\t\tWorkspace Name\n\t\tLocation\n\t\tAnomaliesTableName\n\t\tRansomwareAnalysisTableName\n\t\tThreatHuntsTableName\n\t\tEventsTableName\n\t\tViolationTableName\n\t\tRubrikInstanceUrl\n\t\tRubrikClientId\n\t\tRubrikClientSecret\n\t\tLogLevel\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**.\n5. Click **Purchase** to deploy."


+                                },
+                                "else": { "actions": {} }
+                              },
+                              "Get_MDE_Machine": {


+                                "type": "Http",
+                                "inputs": {
+                                  "method": "GET",
+                                  "uri": "@{variables('MDE_Base_URL')}/api/machines?$filter=computerDnsName eq '@{items('For_each_ntfs_file')?['physicalHost']}'",


+                                  "headers": { "Authorization": "Bearer @{variables('MDE_Access_Token')}" }
+                                }
+                              },
+                              "Check_Get_MDE_Machine": {


+                                  "and": [
+                                    { "equals": ["@variables('Ntfs_File_Handled')", false] },


+                                  "actions": {
+                                    "Set_MDE_Machine_Id": {
+                                      "runAfter": {},
+                                      "type": "SetVariable",
+                                      "inputs": { "name": "MDE_Machine_Id", "value": "@{first(coalesce(body('Get_MDE_Machine')?['value'], json('[]')))?['id']}" }
+                                    }
+                                  }


v-maheshbh (v-maheshbh) · 2026-10-30T07:01:48Z

Hi Nirali Shah (@niralishah-crest)

Kindly check the Copilot comments. If the feedback has been addressed, please mark the corresponding comments as resolved.

Kindly ensure the existing package remains unchanged.

please attach the relevant invocation logs data ingestion related to the changes introduced in this PR.

Thanks!

Nirali Shah (niralishah-crest) · 2026-10-30T10:40:27Z

v-maheshbh (@v-maheshbh) Can you please re-run the checks now? I've addressed the copilot comments.

Updated data connector and added playbooks, analytic rules for DSPM &…

3b01f6b

… IR violation usecase

v-atulyadav assigned v-maheshbh (v-maheshbh) Jul 29, 2026

v-atulyadav added the Solution Solution specialty review needed label Jul 29, 2026

v-atulyadav requested a review from Copilot July 29, 2026 13:32

Copilot AI reviewed Jul 29, 2026

View reviewed changes

Updated QuarantineFiles playbook and mainTemplate

687f15a

github-actions Bot added the ISV Solution 3P / ISV Partner-authored or Partner-integrated Sentinel solution label Oct 26, 2026

Merge branch 'master' into Rubrik-DSPM-IR-violation-update

3b855c6

Nirali Shah (niralishah-crest) marked this pull request as ready for review October 27, 2026 06:29

Nirali Shah (niralishah-crest) requested review from a team as code owners October 27, 2026 06:29

niralishah-crest added 2 commits October 27, 2026 14:28

Updated playbook templates and analytic rules as per feedback received

52f3073

Updated data connector templates

7e59a4a

Fixed validation errors

acdd0a8

Updated the data connector files

cc9d1f2

Navigation Menu

Repository navigation

Rubrik: Updated data connector and added playbooks, analytic rules for DSPM & IR violation usecase - #14788

Rubrik: Updated data connector and added playbooks, analytic rules for DSPM & IR violation usecase#14788
Nirali Shah (niralishah-crest) wants to merge 7 commits into
Azure:masterfrom
niralishah-crest:Rubrik-DSPM-IR-violation-update

Nirali Shah (niralishah-crest) commented Jul 29, 2026 •

edited by github-actions Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

v-maheshbh (v-maheshbh) commented Oct 30, 2026 •

edited

Loading

Uh oh!

Nirali Shah (niralishah-crest) commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		"workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('WorkspaceName'))]"
		}

		"and": [
		{ "equals": ["@variables('Ntfs_File_Handled')", false] },

Conversation

Nirali Shah (niralishah-crest) commented Jul 29, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

v-maheshbh (v-maheshbh) commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Nirali Shah (niralishah-crest) commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Nirali Shah (niralishah-crest) commented Jul 29, 2026 •

edited by github-actions Bot

Loading

v-maheshbh (v-maheshbh) commented Oct 30, 2026 •

edited

Loading