Skip to content

Add Rubrik Security Cloud Protection Status CCP Data Connector#13508

Open
marcusfaust wants to merge 23 commits intoAzure:masterfrom
marcusfaust:rubrik-security-cloud-ccp-connector
Open

Add Rubrik Security Cloud Protection Status CCP Data Connector#13508
marcusfaust wants to merge 23 commits intoAzure:masterfrom
marcusfaust:rubrik-security-cloud-ccp-connector

Conversation

@marcusfaust
Copy link

@marcusfaust marcusfaust commented Jan 27, 2026

Change(s):

  • Added new Codeless Connector Platform (CCP) data connector for Rubrik Security Cloud
  • Ingests comprehensive backup and protection status data for Azure VMs into Microsoft Sentinel
  • Added 5 files under Solutions/RubrikSecurityCloud/Data Connectors/RubrikSecurityCloud_CCP/:
    • connectorDefinition.json - UI definition
    • DCR.json - Data Collection Rule and Endpoint
    • PollerConfig.json - REST API Poller configuration
    • table - RubrikProtectionStatus.json - Custom table schema (49 columns)
    • README.md - Comprehensive documentation with sample queries

Reason for Change(s):

  • Enables security teams to correlate security alerts with backup/protection status
  • Provides ransomware recovery readiness visibility
  • Complements the existing RubrikWebhookEvents connector in the same solution
  • Built on the Codeless Connector Platform (CCP) framework for easy deployment

Version Updated:

  • N/A - This is a new data connector, not a detection/analytic rule template

Testing Completed:

  • Yes
  • Deployed and tested in Azure Sentinel workspace
  • Data ingestion verified with 100+ records from Rubrik Security Cloud
  • UI tested in Azure Portal - all configuration fields working correctly
  • All 49 data fields validated in custom table RubrikProtectionStatus_CL
  • Sample KQL queries tested with live data
  • OAuth2 authentication flow verified
  • 60-minute polling interval tested

Checked that the validations are passing and have addressed any issues that are present:

  • Yes
  • All JSON files validated
  • No KQL validation required (data connector only, no detection rules)
  • README.md follows documentation standards

Summary

This PR adds a new Codeless Connector Platform (CCP) data connector for Rubrik Security Cloud that ingests comprehensive backup and protection status data for Azure VMs into Microsoft Sentinel.

Connector Details

  • Name: Rubrik Security Cloud Protection Status
  • Type: Codeless Connector Platform (CCP)
  • API: Rubrik Security Cloud GraphQL API
  • Authentication: OAuth2 (client credentials)
  • Polling Frequency: 60 minutes
  • Data Table: RubrikProtectionStatus_CL

Data Collected

The connector ingests 49 backup attributes per Azure VM including:

  • Multi-tier compliance status (backup, archival, replication)
  • Snapshot counts and distribution
  • Storage metrics (logical, physical, data reduction)
  • SLA domain assignments
  • Cluster and organization information

Use Cases

  • Security alert correlation - Enrich security incidents with backup status to assess recovery options
  • Ransomware recovery readiness - Quickly identify which compromised VMs have recent backups
  • Compliance monitoring - Track backup compliance across Azure VMs
  • Storage efficiency analysis - Monitor data reduction and storage metrics

The README includes sample KQL queries demonstrating how to correlate security alerts with backup data.

Related

This connector complements the existing RubrikWebhookEvents connector in the same solution.

@marcusfaust marcusfaust requested review from a team as code owners January 27, 2026 17:00
@v-shukore v-shukore added the New Solution For new Solutions which are new to Microsoft Sentinel label Jan 28, 2026
@marcusfaust
Copy link
Author

marcusfaust commented Jan 28, 2026

@microsoft-github-policy-service agree company="Rubrik"

@v-maheshbh
Copy link
Contributor

v-maheshbh commented Jan 29, 2026

Hi @marcusfaust

Kindly refer to the below-mentioned solution for the correct folder structure and update the necessary changes.

https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF

Thanks!

@v-maheshbh
Copy link
Contributor

v-maheshbh commented Feb 9, 2026

Hi @marcusfaust

Kindly review the above comments.

Thanks!

@marcusfaust
Copy link
Author

marcusfaust commented Feb 23, 2026

@v-maheshbh - Thank you for the review so far. We went ahead and updated the Solution Medatadata file as well as the release notes and have updated the PR.

@v-maheshbh
Copy link
Contributor

v-maheshbh commented Feb 27, 2026

Hi @marcusfaust

For the CCF connector, please ensure that all file names follow the required naming convention:

SolutionName_PollerConfig
SolutionName_DCR
SolutionName_ConnectorDefinition
SolutionName_Table (optional)

Additionally, the solution must contain the package folder with the zip file included and add release notes with version , date and description.

Kindly repackage the solution using the V3 tool: https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

and Kindly attach the testing screenshot of the ccf connector in a Connected state.

Thanks!

marcusfaust added 17 commits March 3, 2026 14:43
@marcusfaust
Rename DCR.json to RubrikSecurityCloud_DCR.json per naming convention
8fa6132
@marcusfaust
Remove DCR.json (renamed to RubrikSecurityCloud_DCR.json)
4e0fe90
@marcusfaust
Rename PollerConfig.json to RubrikSecurityCloud_PollerConfig.json per…
ed4691c 
… naming convention
@marcusfaust
Remove PollerConfig.json (renamed to RubrikSecurityCloud_PollerConfig…
0e65306 
….json)
@marcusfaust
Rename connectorDefinition.json to RubrikSecurityCloud_ConnectorDefin…
f491318 
…ition.json per naming convention
@marcusfaust
Remove connectorDefinition.json (renamed to RubrikSecurityCloud_Conne…
0edac7b 
…ctorDefinition.json)
@marcusfaust
Rename table - RubrikProtectionStatus.json to RubrikSecurityCloud_Tab…
a4b8f9a 
…le.json per naming convention
@marcusfaust
Remove table - RubrikProtectionStatus.json (renamed to RubrikSecurity…
bb2b13f 
…Cloud_Table.json)
@marcusfaust
Update mainTemplate.json for v3.5.2 with CCP connector
2ce2f86
@marcusfaust
Update createUiDefinition.json for v3.5.2 with CCP connector
df94bd4
@marcusfaust
Update testParameters.json for v3.5.2
045d59e
@marcusfaust
Add 3.5.2.zip package with CCP connector
3afc4e3
@marcusfaust
Fix PollerConfig: correct type and connectorDefinitionName
9f5f192
@marcusfaust
Fix DCR: extract single DCR object from array
e57377b
@marcusfaust
Fix Table: use plain name string for tool compatibility
e1f024d
@marcusfaust
Update data file: add CCP connector, bump version to 3.6.0
a17f431
@marcusfaust
Add Rubrik Security Cloud CCF data connector (v3.6.0)
6bb8ab5 
- Add RubrikSecurityCloud_CCF connector with DCE, DCR, PollerConfig, Table schema
- Fix ARM template: DCE resource, [[parameter escaping, dcrConfig pattern
- Update connector title, logo, publisher branding
- Rename from CCP to CCF (Codeless Connector Framework)
- Add 3.5.2.zip solution package
@marcusfaust
Copy link
Author

marcusfaust commented Mar 5, 2026

Thank you @v-maheshbh - Please review the updates. We went ahead and renamed the resource files in accordance with your specifications. We also had to make some updates to fix deployment in our test environment. We also used the utility that you mentioned in order to package it up and include the package into the PR.

Also here is a recent screenshot of the deployed data connector in our test environment:

image

Please let us know if we have to adjust or fix anything and happy to oblige. Thank you again!

@marcusfaust
Fix ARM TTK test failures: unreferenced params and empty variables
743c792 
- Add _resourceGroupName and _subscription variables to reference
  the declared parameters, fixing "Parameters Must Be Referenced"
- Remove empty "variables":{} from queryParametersTemplate in
  PollerConfig, fixing "Template Should Not Contain Blanks"
- Repackage 3.5.2.zip with V3 tool
@v-maheshbh
Copy link
Contributor

v-maheshbh commented Mar 17, 2026 •
edited
Loading

Hi @marcusfaust

The connector logo must be provided in .svg format. Please update the logo reference in the connectorDefinition file accordingly and Modify the BasePath to the following structure:
C:\GitHub\Azure-Sentinel\solutions\Solution Name

After completing the required changes, we will repackage the solution and try to resolve the ARM TTK validation issues.
Thanks!

@marcusfaust
Copy link
Author

marcusfaust commented Mar 17, 2026

Hi @v-maheshbh — Thank you for the feedback. Here are the updates:

BasePath — Fixed. Updated from my local development path to the standard C:\GitHub\Azure-Sentinel\Solutions\RubrikSecurityCloud format.

Logo — The connector logo in RubrikSecurityCloud_ConnectorDefinition.json is already in SVG format — it's provided as an inline base64-encoded SVG (data:image/svg+xml;base64,...). Additionally, the solution-level logo in Solution_RubrikSecurityCloud.json references the existing Logos/rubrikLogo.svg file in the repository. Could you clarify if you'd like us to change the format of either of these references, or if the current SVG setup is acceptable?

Ready for repackaging whenever you are. Please let us know if anything else needs adjustment. Thank you!

@v-maheshbh
Copy link
Contributor

v-maheshbh commented Mar 18, 2026

Hi @v-maheshbh — Thank you for the feedback. Here are the updates:

BasePath — Fixed. Updated from my local development path to the standard C:\GitHub\Azure-Sentinel\Solutions\RubrikSecurityCloud format.

Logo — The connector logo in RubrikSecurityCloud_ConnectorDefinition.json is already in SVG format — it's provided as an inline base64-encoded SVG (data:image/svg+xml;base64,...). Additionally, the solution-level logo in Solution_RubrikSecurityCloud.json references the existing Logos/rubrikLogo.svg file in the repository. Could you clarify if you'd like us to change the format of either of these references, or if the current SVG setup is acceptable?

Ready for repackaging whenever you are. Please let us know if anything else needs adjustment. Thank you!

kindly refer below solution for logo:
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Data%20Connectors/AWS_WAF_CCP/AwsS3_WAF_DataConnectorDefinition.json

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@v-maheshbh v-maheshbh

Labels

New Solution For new Solutions which are new to Microsoft Sentinel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@marcusfaust @v-maheshbh @v-shukore