Rubrik Security Cloud - Take Snapshots for Affected VMs

This incident response workflow allows you to take snapshots for VMware vSphere virtual machines in Rubrik Security Cloud from a playbook or using an automation rule. When using this workflow in a playbook, the user selects which VMs to take snapshots for. When using this workflow with an incident automation rule, snapshots will be taken for all assets involved in the incident. Supported observables: ip

Target: Rubrik Security Cloud

Steps:

• Detect the start type and extract the observables
• Check if any supported observables were found (if not, end the workflow)
• Calculate when to start looking for snapshots
• For each observable:
  • Search for the host in Rubrik (if not found, update the results and skip it)
  • Get the host's details (if this fails, update the results and skip it)
  • Request an on demand snapshot and check if it was successful (and update the workflow results)