Rubrik: Updated data connector and added playbooks, analytic rules for DSPM & IR violation usecase

Solutions/RubrikSecurityCloud/Analytic Rules/RubrikClassificationEvents.yaml

@@ -0,0 +1,54 @@
+id: 9563dc15-ea0a-438a-9d50-7ab243378241
+name: Create Incident for Classification events for non DSPM license users
+version: 1.0.0
+kind: Scheduled
+description: |
+  'Creates an incident for Classification events (ClassficationResultsAvailable) for non DSPM license users.'
+severity: Medium
+status: Available
+requiredDataConnectors:
+  - connectorId: RubrikSecurityCloudAzureFunctions
+    dataTypes:
+      - RubrikViolationData
+queryFrequency: 5m
+queryPeriod: 5m
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Collection
+relevantTechniques:
+  - T1213
+query: |
+  Rubrik_Violation_Data_CL
+  | where class_s == "Classification" and custom_details_eventName_s in ("ClassficationResultsAvailable", "ClassificationResultsAvailable")
+  | extend NewSeverity = case(severity_s=="info", "Low",
+                              severity_s=="warning", "Medium",
+                              severity_s=="critical", "High",
+                              "Informational"),
+           ObjectId = iff(isnotempty(custom_details_objectId_s), custom_details_objectId_s, tostring(custom_details_objectId_g)),
+           SnapshotId = custom_details_snapshotId_s
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: P7D
+    matchingMethod: Selected
+    groupByCustomDetails:
+      - ObjectId
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+alertDetailsOverride:
+  alertDisplayNameFormat: '{{class_s}} event occurred for object {{custom_details_objectName_s}} with type {{custom_details_objectType_s}}'
+  alertDescriptionFormat: '{{summary_s}}'
+  alertSeverityColumnName: NewSeverity
+customDetails:
+  ObjectId: ObjectId
+  ObjectName: custom_details_objectName_s
+  ObjectType: custom_details_objectType_s
+  EventType: class_s
+  EventName: custom_details_eventName_s
+  Summary: summary_s
+  EventTimestamp: timestamp_t
+  Severity: severity_s
+  SnapshotId: custom_details_snapshotId_s

Solutions/RubrikSecurityCloud/Analytic Rules/RubrikDataSecurityViolation.yaml

@@ -0,0 +1,59 @@
+id: 5b70b78e-397c-474c-a556-f6c37fccbb18
+name: Create Incident for Data Security Violation events for DSPM license users
+version: 1.0.0
+kind: Scheduled
+description: |
+  'Creates an incident for Data Security Violation events for DSPM license users.'
+severity: Medium
+status: Available
+requiredDataConnectors:
+  - connectorId: RubrikSecurityCloudAzureFunctions
+    dataTypes:
+      - RubrikViolationData
+queryFrequency: 5m
+queryPeriod: 5m
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Exfiltration
+relevantTechniques:
+  - T1567
+query: |
+  Rubrik_Violation_Data_CL
+  | where class_s == "SecurityViolation" and custom_details_eventName_s in ("CriticalSeverityDataViolationDetected",
+  "CriticalSeverityDataViolationReOpen",
+  "HighSeverityDataViolationDetected",
+  "HighSeverityDataViolationReOpen",
+  "LowOrMediumSeverityDataViolationDetected",
+  "LowOrMediumSeverityDataViolationReOpen")
+  | extend NewSeverity = case(severity_s=="info", "Low",
+                              severity_s=="warning", "Medium",
+                              severity_s=="critical", "High",
+                              "Informational"),
+           ObjectId = iff(isnotempty(custom_details_objectId_s), custom_details_objectId_s, tostring(custom_details_objectId_g)),
+           ViolationId = iff(isnotempty(custom_details_seriesId_s), custom_details_seriesId_s, tostring(custom_details_seriesId_g))
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: P7D
+    matchingMethod: Selected
+    groupByCustomDetails:
+      - ViolationId
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+alertDetailsOverride:
+  alertDisplayNameFormat: '{{class_s}} event occurred for object {{custom_details_objectName_s}} with type {{custom_details_objectType_s}}'
+  alertDescriptionFormat: '{{summary_s}}'
+  alertSeverityColumnName: NewSeverity
+customDetails:
+  ObjectId: ObjectId
+  ObjectName: custom_details_objectName_s
+  ObjectType: custom_details_objectType_s
+  EventType: class_s
+  EventName: custom_details_eventName_s
+  ViolationId: ViolationId
+  Summary: summary_s
+  EventTimestamp: timestamp_t
+  Severity: severity_s

Solutions/RubrikSecurityCloud/Analytic Rules/RubrikIdentitySecurityViolation.yaml

@@ -0,0 +1,62 @@
+id: 77e7519f-be7e-41fc-8f02-76bb0a7d5496
+name: Create Incident for Identity Security Violation and Identity Alerts events for IR violations
+version: 1.0.0
+kind: Scheduled
+description: |
+  'Creates an incident for Identity Security Violation and Identity Alerts events for IR violations.'
+severity: Medium
+status: Available
+requiredDataConnectors:
+  - connectorId: RubrikSecurityCloudAzureFunctions
+    dataTypes:
+      - RubrikViolationData
+queryFrequency: 5m
+queryPeriod: 5m
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - InitialAccess
+relevantTechniques:
+  - T1078
+query: |
+  Rubrik_Violation_Data_CL
+  | where (class_s == "IdentityViolation" and custom_details_eventName_s in ("CriticalSeverityDataViolationDetected",
+  "CriticalSeverityDataViolationReOpen", "HighSeverityDataViolationDetected",
+  "HighSeverityDataViolationReOpen", "LowOrMediumSeverityDataViolationDetected",
+  "LowOrMediumSeverityDataViolationReOpen")) or
+  (class_s == "IdentityAlerts" and custom_details_eventName_s in ("CriticalSeverityIdentityAlertDetected",
+  "CriticalSeverityIdentityAlertReOpened", "HighSeverityIdentityAlertDetected",
+  "HighSeverityIdentityAlertReOpened", "LowOrMediumSeverityIdentityAlertDetected",
+  "LowOrMediumSeverityIdentityAlertReOpened"
+  ))
+  | extend NewSeverity = case(severity_s=="info", "Low",
+                              severity_s=="warning", "Medium",
+                              severity_s=="critical", "High",
+                              "Informational"),
+           ObjectId = iff(isnotempty(custom_details_objectId_s), custom_details_objectId_s, tostring(custom_details_objectId_g)),
+           ViolationId = iff(isnotempty(custom_details_seriesId_s), custom_details_seriesId_s, tostring(custom_details_seriesId_g))
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: P7D
+    matchingMethod: Selected
+    groupByCustomDetails:
+      - ViolationId
+eventGroupingSettings:
+  aggregationKind: AlertPerResult
+alertDetailsOverride:
+  alertDisplayNameFormat: '{{class_s}} event occurred for object {{custom_details_objectName_s}} with type {{custom_details_objectType_s}}'
+  alertDescriptionFormat: '{{summary_s}}'
+  alertSeverityColumnName: NewSeverity
+customDetails:
+  ObjectId: ObjectId
+  ObjectName: custom_details_objectName_s
+  ObjectType: custom_details_objectType_s
+  EventType: class_s
+  EventName: custom_details_eventName_s
+  ViolationId: ViolationId
+  Summary: summary_s
+  EventTimestamp: timestamp_t
+  Severity: severity_s

Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikActivity/__init__.py

@@ -1,45 +1,58 @@
-"""This __init__ file will be called by Orchastrator function to ingest data in Sentinel."""
+"""This __init__ file is called by the Orchestrator to ingest data into Sentinel."""
 import inspect
 import time
 from shared_code.logger import applogger
-from shared_code.consts import LOGS_STARTS_WITH
+from shared_code.consts import LOGS_STARTS_WITH, LOG_FORMAT
 from shared_code.rubrik_exception import RubrikException
 from .rubrik import Rubrik
 
+FUNCTION_NAME = "RubrikActivity"
+
 
 def main(name) -> str:
-    """Start Execution of Activity Function.
+    """Start execution of the Activity function.
 
     Args:
-        name (dict): data received via Rubrik Webhook.
+        name (dict): payload with keys data, log_type, stream_name, rule_id.
 
     Returns:
-        str: status message of activity function.
+        str: status message of the activity function.
     """
     __method_name = inspect.currentframe().f_code.co_name
-    try:
-        applogger.info(
-            "{}(method={}) Activity function called!".format(
-                LOGS_STARTS_WITH, __method_name
-            )
+    log_type = name.get("log_type")
+    applogger.info(
+        LOG_FORMAT.format(
+            LOGS_STARTS_WITH,
+            FUNCTION_NAME,
+            __method_name,
+            "Activity function started for log_type={}.".format(
+                log_type
+            ),
         )
+    )
+    try:
         start = time.time()
         rubrik_obj = Rubrik()
         rubrik_obj.post_data_to_sentinel(name)
-        end = time.time()
+        elapsed = int(time.time() - start)
         applogger.info(
-            "{}(method={}) time taken for data ingestion is {} sec".format(
-                LOGS_STARTS_WITH, __method_name, int(end - start)
-            )
-        )
-        applogger.info(
-            "{}(method={}) Activity function Completed!".format(
-                LOGS_STARTS_WITH, __method_name
+            LOG_FORMAT.format(
+                LOGS_STARTS_WITH,
+                FUNCTION_NAME,
+                __method_name,
+                "Data ingestion completed for {} in {} sec.".format(log_type, elapsed),
             )
         )
+        return "Data Posted successfully to {}".format(log_type)
     except RubrikException as err:
-        return err
+        applogger.error(
+            LOG_FORMAT.format(LOGS_STARTS_WITH, FUNCTION_NAME, __method_name, err)
+        )
+        return "Error while posting data to {}: {}".format(log_type, err)
     except Exception as err:
-        applogger.error("{}(method={}) {}".format(LOGS_STARTS_WITH, __method_name, err))
-        return err
-    return "Data Posted successfully to {}".format(name.get("log_type"))
+        applogger.error(
+            LOG_FORMAT.format(LOGS_STARTS_WITH, FUNCTION_NAME, __method_name, err)
+        )
+        return "Unexpected error while posting data to {}: {}".format(
+            log_type, err
+        )