Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-rubrik

Rubrik

You can integrate Rubrik with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Rubrik product overview

Rubrik's backup and recovery cybersecurity tool is a cloud-based solution that secures and automates data protection across hybrid and multi-cloud environments. It integrates with various security frameworks, providing a centralized platform for backup, data recovery, ransomware detection, and compliance, ensuring resilient data management and fast data recovery in the event of attacks.

What we ingest

Sophos XDR collects Rubrik data over HTTPS using Rubrik's REST and GraphQL APIs. The integration authenticates using a Rubrik service account (client ID and secret, plus the Rubrik cluster base URL) to obtain a bearer token, then polls Rubrik's activity series for new events within a recurring time window. The following data is collected:

  • Activity series events: Rubrik activity and event records covering backup, recovery, and data-protection operations, each carrying a severity, timestamps, the affected object and its type (for example, VMware and Hyper-V virtual machines), the Rubrik cluster, an activity status, and a descriptive message.

Event and data types

All Rubrik activity-series events are normalized uniformly to third-party security alert telemetry. They include:

  • Backup, recovery, and data-protection activity: Status and outcomes of Rubrik activity events, such as snapshot, backup, indexing, and recovery jobs for protected workloads, including the affected object, cluster, activity status, and descriptive message.
  • Anomaly and ransomware detections: Events that flag unusual data change or encryption patterns indicative of ransomware.
  • Threat-hunting matches: Detections where Rubrik matches threat indicators, such as YARA rule matches, within protected data.
  • Data and user discovery: Sensitive data and user discovery findings that Rubrik surfaces.
  • Service and availability alerts: Rubrik cluster and service health and availability notifications.

Data provided by this integration

Data provided by Rubrik gets normalized to the following schemas:

  • thirdpartyalert

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation