Rubrik Security Cloud - Restore vSphere VM to Recent Snapshot

This workflow appears in the pivot menu and allows a user to restore a VMware vSphere VM to its most recent viable snapshot in Rubrik Security Cloud. Supported observable: ip

NOTE: This workflow will require manual clean-up within the VMware infrastructure. This workflow creates a VM snapshot that will allow undoing the changes made by this recovery. Leaving this snapshot in place long-term could affect Rubrik and/or VMware functionality.

Target: Rubrik Security Cloud

Steps:

• Fetch the workload summary for the IP address
  • If not found, end the workflow
• Fetch a list of recent snapshots for the VM
  • If not returned, end the workflow
• Extract the ID of the first viable snapshot (not expired, not corrupted)
  • If not found, end the workflow
• Request the snapshot be recovered
  • If recovery fails, end the workflow