Cohesity - Take Protection Group Snapshot for Affected VMs

This workflow is triggered by an automation rule when an incident is created in Cisco XDR. When triggered, the workflow will identify assets in the incident and attempt to take a snapshot of each asset using Cohesity DataProtect.

Targets: Platform APIs, Cohesity DataProtect

Steps:

• For each incident target:
  • Make sure the target is a host and fetch its details from XDR assets
  • Validate and convert the serial number (to a VMware UUID)
  • Search for matching protection objects in Cohesity
  • For each Cohesity object:
    • For each cluster the object belongs to:
      • Parse the protection jobs and see if they are viable for taking a snapshot (if they are, take a snapshot and continue to the next protection object)