Rubrik

---
name: rubrik
description: "Expert agent for Rubrik Security Cloud and CDM. Covers immutable filesystem, anomaly detection, threat hunting with YARA/IOCs, data classification, orchestrated recovery, Polaris GPS policy management, and ransomware resilience. WHEN: \"Rubrik\", \"CDM\", \"Rubrik Cloud Data Management\", \"Polaris\", \"Rubrik Security Cloud\", \"Live Mount\", \"threat hunting\", \"anomaly detection\", \"Rubrik cluster\", \"data classification\"."
license: MIT
---

# Rubrik Security Cloud

This skill covers Rubrik Security Cloud and Rubrik Cloud Data Management (CDM). It has deep expertise in Rubrik's architecture, security-first data protection design, and advanced ransomware detection and recovery capabilities.

## How to Approach Tasks

When you receive a request:

1. **Classify the request type:**
   - **Architecture / infrastructure** -- Load `references/architecture.md`
   - **Security / ransomware** -- Apply threat hunting, anomaly detection, and recovery knowledge
   - **Policy management** -- Apply Polaris GPS and SLA domain expertise
   - **Recovery** -- Apply Live Mount, orchestrated recovery knowledge
   - **Data classification / compliance** -- Apply data classification and sensitive data discovery

2. **Identify deployment model** -- On-premises CDM cluster, Rubrik Cloud Cluster (on cloud infrastructure), or fully SaaS-managed Security Cloud.

3. **Load context** -- Read `references/architecture.md` for deep architectural knowledge.

4. **Provide specific guidance** -- Rubrik has opinionated workflows; explain the specific UI path or API call.

## Core Differentiators

Rubrik's design philosophy: "Zero Trust Data Security." Key differentiators from traditional backup:

1. **Immutability by design**: No POSIX-compliant interface to backup data. Data cannot be modified or deleted via any standard protocol (no NFS/SMB export of backup data, no SSH file access). Immutability is architectural, not a configurable option.

2. **Security Cloud (SaaS management plane)**: Management is handled by Rubrik-hosted cloud service; on-premises cluster handles data. Attackers cannot pivot from your network to destroy the management plane.

3. **Anomaly detection built-in**: ML-based analysis of backup data continuously detects entropy changes, file deletion spikes, and modification anomalies that indicate ransomware activity.

4. **Threat hunting**: Active scanning of backup data against IOC lists and YARA rules to find malware across all restore points.

## SLA Domains (Policy Engine)

Rubrik uses SLA domains (Service Level Agreement domains) as the policy engine for data protection. This is fundamentally different from job-based backup tools.

### SLA Domain Concept

An SLA domain defines:
- **Retention**: How long to keep snapshots (hourly, daily, weekly, monthly, yearly)
- **Replication**: Whether and where to replicate (remote cluster, cloud)
- **Archival**: Cloud tier for long-term retention
- **Local retention**: How many days to keep data on the Rubrik cluster

Objects (VMs, databases, filesets, SaaS) are assigned to SLA domains. Rubrik continuously enforces the policy.

### SLA Domain Configuration

**Example Bronze SLA domain:**
- Hourly snapshots: retain for 24 hours
- Daily snapshots: retain for 7 days
- Weekly snapshots: retain for 4 weeks
- Monthly snapshots: retain for 6 months
- Replication: None
- Archival: None

**Example Gold SLA domain (ransomware-resilient):**
- Hourly snapshots: retain for 48 hours
- Daily snapshots: retain for 30 days (covers ransomware dwell)
- Weekly snapshots: retain for 52 weeks
- Monthly snapshots: retain for 12 months
- Replication: Remote Rubrik cluster (geographic redundancy)
- Archival: S3 with immutability (long-term)

**Applying SLA domain:**
- VMs: `Protect > VMware vSphere > [VM or cluster] > Manage Protection > [SLA domain]`
- Or assign at vSphere tag level: tag VMs → assign SLA domain to tag → auto-protect

### SLA Domain Non-Compliance

Rubrik automatically reports SLA compliance. If a VM is not meeting its SLA (backup failed, replication behind, etc.), it appears in the compliance dashboard.

Critical: SLA domains cannot be manually bypassed to delete data. This is enforced at the filesystem level.

## Immutable Architecture Detail

### Atlas Distributed Filesystem

Rubrik stores all backup data on Atlas, Rubrik's proprietary distributed filesystem:

- **No external access**: Atlas does not expose NFS/SMB/S3 interfaces for backup data
- **Append-only write path**: Data is written once, never modified in place
- **Deletion only at policy expiry**: Only the Rubrik service can trigger deletion, only when retention period has expired
- **Encryption**: AES-256 encryption at rest; all keys managed by Rubrik key management or customer-managed via external KMS

**What this means for ransomware:**
- Even if an attacker gains root/admin access to the Rubrik cluster OS, they cannot modify or delete backup data
- Atlas does not trust OS-level credentials for data deletion
- The only path to delete data is through the Rubrik management API with valid authentication + policy-sanctioned expiry

## Anomaly Detection

Rubrik continuously analyzes snapshots to detect ransomware activity before it becomes apparent to the backup administrator.

### How Anomaly Detection Works

1. For each new snapshot, Rubrik computes metrics vs. the previous snapshot:
   - **File count delta**: Increase in file count (ransomware creates encrypted copies)
   - **Deletion rate**: Spike in deleted files (ransomware deletes originals after encrypting)
   - **Entropy change**: Files have higher entropy (encrypted files have near-maximum entropy)
   - **Extension change**: File extensions changed en masse (ransomware adds .encrypted, .locked, etc.)

2. ML model (trained on ransomware behavior patterns) scores each snapshot for anomaly severity

3. If anomaly score exceeds threshold: Alert sent to Rubrik Security Cloud portal, configured notification channels (email, Slack, SIEM webhook, PagerDuty)

### Anomaly Alert Triage

When anomaly detected:
1. Navigate to `Security > Anomalies` in Rubrik Security Cloud
2. Review the anomaly details: which VM/fileset, which snapshot, metrics (entropy delta, file count change, deletion spike)
3. Compare anomalous snapshot to prior clean snapshot
4. Use "Mark as Suspicious" or "Mark as Clean" to train the model
5. If confirmed ransomware: begin recovery workflow from identified clean restore point

**Key question**: What was the anomaly detection date vs. when ransomware actually began encrypting? Rubrik will show you the first snapshot where the anomaly pattern appeared.

### Configuration

`Security > Settings > Anomaly Detection`
- Alert threshold: Low / Medium / High sensitivity
- Lower sensitivity = more alerts, more false positives
- Recommended: Start at Medium; tune based on false positive rate in your environment

## Threat Hunting

Threat hunting lets you scan backup data for known Indicators of Compromise (IOCs) and YARA rules. This is the "scan before restore" capability, equivalent to Veeam Secure Restore but more advanced.

### IOC-Based Scanning

Supports IOC types:
- File hashes (MD5, SHA-1, SHA-256)
- IP addresses (found in log files, registry, configs)
- Domain names (DNS queries, cached lookups)
- File paths (known malware drop locations)

**Process:**
1. `Security > Threat Hunting > New Scan`
2. Select IOC source: manual input, STIX/TAXII feed, uploaded IOC file
3. Select scope: specific VMs, SLA domain, or all objects
4. Select timeframe: scan snapshots from [date range]
5. Start scan; Rubrik runs scan across selected snapshots

**Integration with threat intelligence:**
- Import STIX 2.1 bundles directly
- Connect to TAXII 2.1 feeds for continuous IOC updates
- Integrate with SIEM for automated hunt-on-alert workflows

### YARA Rule Scanning

YARA rules allow pattern-based detection that goes beyond simple hash matching.

`Security > Threat Hunting > YARA Rules > Upload Rule Set`

- Upload `.yar` or `.yara` files
- Rubrik applies rules to file content within backup snapshots
- Detects: malware families by code patterns, embedded scripts, obfuscated payloads

**YARA rule sources:**
- YARA-Forge (community-maintained rules)
- Mandiant, CrowdStrike, vendor-specific rule sets
- Custom rules from IR team

### Threat Hunt Results

Results show:
- Which snapshots contain matches (malicious indicators)
- Earliest clean snapshot (before any IOC matches)
- Affected file paths and IOC details

This answers the critical ransomware recovery question: "What is my last clean restore point?"

## Data Classification

Rubrik can scan backup data to identify sensitive data (PII, PHI, PCI, custom patterns).

### Classification Policies

Built-in classifiers:
- **PII**: Social Security Numbers, passport numbers, driver's license numbers
- **PHI**: Medical record numbers, diagnoses, health plan identifiers (HIPAA)
- **PCI**: Credit card numbers, bank account numbers
- **Custom**: User-defined regex patterns for organization-specific sensitive data

`Data Management > Classification > Policies > New Policy`

### Use Cases for Backup Security

- **Ransomware impact assessment**: If a specific backup contains classified data, ransom impact is higher (potential breach notification obligation)
- **Compliance audit**: Prove that backup data containing PII/PHI is encrypted and protected per policy
- **Data minimization**: Identify backups containing sensitive data longer than retention requirements

## Live Mount and Recovery

### Live Mount

Live Mount instantly mounts a backup snapshot directly from the Rubrik cluster. The VM or database starts from backup data without a restore operation.

**Supported workloads:**
- VMware VMs
- Hyper-V VMs
- SQL Server databases
- Oracle databases
- Physical servers (limited)

**Use cases:**
1. **Rapid recovery**: Mount and use while deciding whether to restore or failover
2. **Verification**: Confirm data is valid before committing to full restore
3. **Forensics**: Access backup data in isolated environment without affecting production
4. **Development/test**: Instant access to production-replica data

**Performance note:** Live Mount performance is limited by Rubrik cluster I/O. For high-throughput workloads, export (restore) to production storage after initial verification.

### Instant Recovery vs. Live Mount

| Feature | Live Mount | Export (Instant Recovery) |
|---|---|---|
| Time to access | Seconds | Seconds |
| Data location | Rubrik cluster | Production storage (migrates in background) |
| Long-term performance | Rubrik cluster I/O | Production storage performance |
| Use case | Validation, short-term | Full production recovery |

### Orchestrated Recovery

For ransomware recovery involving many VMs:

`Recovery > New Recovery Plan`

Define:
- Recovery order and dependencies
- Network settings (isolated or production)
- Pre/post-scripts (patch before connecting, AD rejoin, etc.)
- RTO target

Execute in:
- **Test mode**: Isolated environment, no production impact
- **Live mode**: Actual recovery to production

Rubrik automatically executes the plan and reports on each step.

## Security Cloud Portal

The Rubrik Security Cloud (SaaS) is the management plane for all Rubrik infrastructure.

### Key Security Features

**Multi-factor authentication:**
- Required for all Security Cloud access
- Supports SAML 2.0 SSO (Azure AD, Okta, PingFederate, etc.)
- Hardware security key (FIDO2/WebAuthn) support

**Role-Based Access Control (RBAC):**
- Roles: Admin, End User, Compliance Officer, Security Analyst
- Custom roles with granular permissions
- Object-level permissions (specific VMs, SLA domains)

**Audit logging:**
- All actions logged with user identity, timestamp, IP address
- Immutable audit log (cannot be modified or deleted, even by admin)
- SIEM integration: forward logs to Splunk, Sentinel, QRadar

**Two-person integrity:**
- Multi-admin approval for destructive operations
- Configured per operation type

### Security Cloud Modules

| Module | Capability |
|---|---|
| Data Threat Analytics | Anomaly detection, ransomware alerting |
| Threat Intelligence | IOC/YARA scanning, threat hunting |
| Data Classification | Sensitive data discovery in backups |
| Cyber Recovery | Orchestrated recovery planning and execution |
| Compliance | SLA compliance reporting, audit trails |

## API Reference

Rubrik uses a RESTful API and GraphQL (Security Cloud).

### REST API (CDM)

Base URL: `https://[rubrik-cluster]/api/v1`

Key endpoints:
- `GET /vmware/vm` -- List protected VMs
- `GET /vmware/vm/{id}/snapshot` -- List snapshots for VM
- `POST /vmware/vm/{id}/snapshot/{snapshot_id}/mount` -- Live Mount
- `POST /vmware/vm/{id}/snapshot/{snapshot_id}/export` -- Export (instant recovery)
- `GET /report/data_protection/summary` -- SLA compliance summary

### PowerShell SDK (Rubrik Security Cloud PowerShell)

```powershell
# Connect to Rubrik Security Cloud
Connect-RSC -ServiceAccountFile ".\service-account.json"

# Get VMs not meeting SLA
Get-RscVmwareVm | Where-Object { $_.SlaAssignment -eq "Unprotected" }

# Find anomalies
Get-RscAnomaly | Where-Object { $_.Severity -eq "Critical" } | Select-Object ObjectName, SnapshotDate, AnomalyScore

# Start threat hunt
New-RscThreatHunt -ObjectIds @($vmId1, $vmId2) -IocHashList @("sha256hash1", "sha256hash2")
```

## Reference Files

- `references/architecture.md` -- Rubrik cluster internals, CDM architecture, Atlas filesystem, Security Cloud SaaS architecture, Polaris GPS global policy management, immutable filesystem mechanics, anomaly detection ML pipeline, data classification engine, and cloud archival.