Name: Rubrik Workshop: Protecting Mission-critical Azure Cloud Applications with Rubrik
Uploaded: 2025-11-04T20:00:54.008Z
Duration: 51 min 16 s
Description: Rubrik Workshop: Protecting Mission-critical Azure Cloud Applications with Rubrik

Transcript for "Rubrik Workshop: Protecting Mission-critical Azure Cloud Applications with Rubrik": Hey, friends. Thanks for joining us today. Appreciate you being here for this Rubrik workshop, protecting mission critical Azure cloud applications with Rubrik. And the first question I have is how do you pronounce that? Do you say Azure or do you say Azure? I've heard both. I think they both are okay, but curious what you think. Let us know in the q and a box here to the right if you've never been on Goldcast before. We have a a couple ways to interact with us. I'll be posting some stuff in the chat as we're going along. But we'd love your questions so that you can get the most out of this. We can engage with you the most while you're here. Just be able to spend your time the most valuably by getting whatever questions you might have answered as we're going through the material, as we're going through the lab, whatever we can do here to help you. Again, the q and a box there to the right, there's also a docs tab kinda right next to q and a that has some of our important links, that we'll share with you as we as we're going through the material. Yeah. That's really all there is to it here with Goldcast on your side. So, again, let us know what questions you have, and we appreciate you spending some time with us. And I will bring up our presenter now. Mike, how do you pronounce it? It's Azure. Well, now that I'm thinking about it, I'm gonna pronounce it weird, but I I'm pretty sure it's Azure. That's that's what I say anyways. Alright. Case closed. Alright. Thanks, Mike. Yeah. No problem. No problem. Hey, everybody. Welcome. My name is Mike Preston. Work in technical marketing at Rubrik here and super thankful that we're all here. I hope you guys get the most out of this little workshop. You know, we've kinda rejigged the labs a little bit, at the end, so I I hope we've made them a little bit more engaging. We actually have a a real world real world application that, that we built and we we use to protect Rubrik in behind the scenes, or to protect with Rubrik in behind the scenes. So so, hopefully, this helps, you know, sort of illustrate, you know, our value and different things and how we can fit, into your organization. First up, I do wanna say I think we have, get my my clicky here working. We try to keep these as, interactive as possible. So if you have any questions, feel free to throw them out there. I'll if, you know, if they're relevant to the to the time, I'll stop and we'll answer them. You know, these these always work a bit better when we when we have a little bit of back and forth. And, you know, you're you're here for, you know, thirty, forty five minutes to an hour or whatever whatever we end up spending. You might as well get the most out of it. So feel free to ask away, you know, whatever whatever is on your mind. Even if it's not related to Azure. I don't care. It could be related to AWS. It could be related to, I don't know, VMware, Kubernetes, AI. What whatever you wanna talk about, I'll try and answer. And if I don't have the answer, I'll do my best to get you the answer. So with that, let's sort of dive in. Actually, before we get going, I do wanna talk a bit about the format. I'm gonna quickly go through some slides to kinda level set us, talk a little bit about, who Rubrik is, why we built this product that we did, why we built it and architected it and what problems we solve. And then we'll dive into sort of the technical portion. I'll talk a little bit about how all of this works. So how we actually back up, things like Azure VMs. You know, what what are what's the process that that we take and, you know, what happens after the fact. I'm gonna talk a lot about our preemptive recovery engine and a lot about cyber recovery and a lot about, things like anomaly detection and sensitive data classification, and and we'll actually go through how how a lot of this stuff works technically. And then at the end of that, we'll unleash you with the lab, and, you can walk through and and actually get some hands on experience with the product yourself. So to start off, to kinda level set us, and this is probably nothing, you know, crazy. Everybody knows that, you know, data's growing. Right? We've been saying this for, like, twenty years, and it still holds holds true as it is, like, doubling all the time. It's absolute insanity. But the fact is, like, threats are also growing. And, again, this is this is something that we're probably all well aware of. Right? And these stats come from what we call Rubrik Zero Labs. So this is sort of a an arm within Rubrik, an organization that that actually goes out and surveys, you know, a lot of the the the Fortune 500 CIOs, CSOs, things like that, and gets information from them to, to sort of glean some insights and see where things are going. And, again, like, this isn't, you know, revolutionary in any way, but it's certainly interesting. Like, when we look at 94% of cloud tenants, that's nearly every single one of the respondents said their cloud was targeted nearly every month with some sort of cyber event or cyber threat. And over half of them, 62% were actually compromised. So, it's definitely something we need to pay attention to, in terms of cloud security and cyber resilience and being able to bounce back, from sort of all these threats that are out there. So I just kinda wanted to level set us there, kind of on a a few stats on on what sort of the state of of data security is. And and the fact is, you know, what we can glean from that is we're under siege. Right? We're trying to manage environments like this, and and this is gonna look pretty common to a lot of folks. Right? We have data all over the place, whether it's in cloud, in Azure, AWS, GCP, Oracle Cloud. Right? Whether it's, you know, delivered through past systems like RDS or Azure SQL or SaaS applications like m three sixty five and and OneDrive, or on prem. Right? Big file systems or or unstructured data sitting in our data center. We basically have our data spread out all over the place. And then there's a lot of different people within the organization responsible for these types of data depending on where it lives. Right? Whether it's security teams or cloud ops or or SaaS application admins. There's basically just a lot of people responsible to ensure that this data is protected. Now when we look at this, like, as an IT professional, we see complexity. Right? But it's normal complexity. It's stuff we're we're used to. The problem is when an attacker or a bad actor sees this, what they see is individual entry points and the ability to sort of elevate permissions, move laterally, expand their footprint, and gain access to more and more data, as much data as they can so they can increase their chances of whatever campaign they're running actually being successful. So, you know, it's not always cyber as well. Like, I do wanna give this example as well. You know, this was just a misconfiguration, and you probably heard of this. This was not not too too long ago about a a big pension fund, that that sort of had a misconfiguration. I think it was a blank parameter that they uploaded to something, and and the end result was their entire cloud account ended up getting wiped away. So this is, you know, not even a a cyber issue in this case. This is just an insider sort of misconfiguration. And we can see that it took them eight days until they actually got sort of their minimum viable company or their mission critical revenue generating machine back up and running. And then it was two weeks, so they had sort of confirmation of the rest of their their business going. So you can just imagine what it's like if your organization is down for two weeks. Right? That's fourteen days of of revenue loss, fourteen days downtime, fourteen days of, you know, brand reputation being tarnished. It's it's not a good thing. Right? And then again, when we're moving back to cyber, you know, CodeFinger is another another big one, as of late. Right? And this was a bit different. This is still a bad actor, still a cyber threat, but they're just using the cloud's own tools against the cloud. Right? They were re encrypting, using AWS features, re encrypting s three buckets with their keys, and then disposing of the keys. So they're kinda just using cloud tools against them in this case. And when you look at logs and things for CodeFinger, it was really just s three put requests. So just normal everyday activity that you're gonna see in things like CloudTrail. But at the end of the day, all your data's basically encrypted and, you know, the bad actors are the only ones with the keys. So unless you actually have air gapped immutable backups that were kinda separated and outside of this account, you're kinda left at the mercy of the bad actors. So those are just two sort of recent examples that that we've heard of. So my question, you know, when I talk to people is, if something like this happened to your organization, how long do you think your your business or your company will actually beat down? And and the answer I usually get is, it's okay. I have, you know, cloud snapshots. Right? I back up using maybe Azure Backup or AWS's native backup, or I script the snapshot creation myself. And that's that's good. That's a great first step. But when we start to look at at things like cyber recovery or recovering from these cyber threats, there's a number of different ways in which cloud snapshots basically and cloud native tools just don't stack up. They're not up to that job. Number one's gonna be zero day attacks. So this is, say, an exploit sitting on an application, and, you know, nobody really knows about it, and that's the way the bad actor initially gets in. Right? So as a backup solution, those cloud those, you know, native tools are just gonna back up those zero day exploits along with all the other data. In fact, Rubrik just backs up that zero day as well along with all the other data because that's our job. Right? Our job is to give you exact point in time copies, you know, at a certain, point in time, things that you can restore so you can bring it back to exactly the way it was. So the problem is though, when we go to restore, we're actually restoring those zero days, which kinda leads me to the next sort of, you know, downfall is the ability there's no ability to find and quarantine that malware or to even understand where those zero days actually exist. Right? Cloud snapshot snapshots themselves are just that. They're just, copies of your your data. So without the ability to actually dive into that and actually quarantine, the bad stuff, whether it's malware, an attacker tool, or a zero day. You know, we're just gonna restore that back into the environment and end up going through sort of this crazy scenario of of having to restore over and over again until we actually get to the right restore point. The third one is understanding what's actually inside those snapshots in terms of sensitive data. Because when an attack occurs, the clock starts ticking, and legal teams, boardrooms, they're really gonna wanna know, like, what actually was affected. Right? Just telling them this application was affected isn't good enough. They need to know exact data. Right? Was any customer info information exfiltrated? Credit card information, financial information. Right? Do we need to notify any of our customers, of this breach? And that's that's the whole ticking clock aspect is we need to be able to give them this information. And most organizations have some sort of handle on where their sensitive data is within their production environment. But if your production environment's gone or security has that environment quarantined, nobody's allowed in, nobody's allowed out, you need to be able to to get this information without relying on production environment. Right? So, cloud snapshots alone cannot give you that type of information. And then finally is getting back to that actually restoring a clean recovery point, understanding how far back we need to restore to and ensuring that that that recovery point is actually clean. So cloud snapshots alone, native tools alone, very slow, what we call cyber RTO or the the amount of time it takes to restore from a cyber attack and, of course, increased operational losses. So if you're relying on just these things themselves, it's no wonder that it's at least, you know, a week, two weeks, three weeks, could be longer where your organization is down experiencing all that revenue loss. So that's really why we built Rubrik Security Cloud and our platform the way we built it. We did this by combining both backup recovery with cybersecurity and taking on a mindset where we're just gonna assume breach. Right? We're gonna assume something bad's gonna happen in your environment. It's not if, it's when. And we're gonna give you tools to mitigate the impact of that of that attack or that in that, threat proactively. So tools to point out where your sensitive data is, who has access to it, what they're trying to do with it. So you could take sort of that information and go and and proactively shore up, make sure you're implying things like least privilege RBAC. We'll give you tools to look at your identities for any misconfigurations or, you know, weak passwords, things like that. Just things you can tidy up ahead of time, because the bad actors are gonna get in, and they're gonna use all those identities and misconfigurations and, you know, access to that data to increase their chances to move laterally to perform that discovery, and they're often in our environments for for months. So the more we can do to harden an environment beforehand, the better. But then we also give you the tools to actually bounce back and recover from that attack. We make sure we have air gapped immutable backups that are actually gonna be there as your last line of defense, and there's a number of security services that we'll go over, that will help you actually recover clean data and recover that clean data faster. So if we take sort of these four points that we had and we start to look at how Rubrik addresses these, the first one was zero days. Number one is as as we take our backups, we're gonna prescan or sorry. We're gonna after it's ingested, we're gonna scan all of that data. We create this massive hash database of every single file you have within your environment. So that way, if there is a zero day and you do have that file hash and you wanna find out is it in my backups, you can easily search across this. And Rubrik does this very, very quickly. Again, because we during the backup process, we actually do that that hashing calculation and store that within the database. It's a matter of just querying that database for a file hash pointing out where they may exist within your environment. I think our last sort of testing was something like 60,000 snapshots in about a minute and a half. So it this happens very, very quickly. There's no, you know, cracking open things and mounting snapshots and and doing a scan and different things like that during the actual recovery process, all this gets done for you ahead of time. Where two is being able to hunt for threats, and quarantine that. Right? So being able to understand where malware may exist within your backup data, where attacker tools may exist within your backup data, and allowing you to actually quarantine that. So when someone does come back in to recover that, they're not gonna recover the bad stuff along with the good stuff. And then, finally, we also prediscover all the sensitive data within that backup itself. Right? So you define things like policies, which say, you know, look for financial data on these workloads or look for, PCI data on, you know, this workload, and we'll actually prediscover that for you and point out to you where sensitive data actually exists. So when your legal teams do come to you and say, you know, was any customer information affected? You can easily answer them even without access into that quarantined, production environment. And, of course, being able to precalculate clean recovery points. So being able to tell you exactly where you need to restore back to. And when we say clean recovery points, number one, that's gonna be free of anomalies, so free of things like ransomware and malware, and also free of things like attacker tools, and different applications that that are common within the threats that we see out there today. So that's really, you know, the big advantage to Rubrik and the big advantage of of how we provide just faster recovery from a cyber threat than, you know, all of our different competitors and then and from the the the native tools as well. So all that clean room functionality that we kinda just went through, right, scanning for malware, scanning for, you know, this configurations, all that stuff, that all happens upfront without the need for another environment to actually do this scanning. So Rubrik's got the heavy grunt work done for you ahead of time before you even think about actually recovering. And we do this all through one unified platform that you can apply to all of your data, whether that's, you know, enterprise, cloud, SaaS, or your identities as well. Scanning, you know, your active directory users, your onshore ID users, your GPOs, scanning those for misconfigurations, and actually backing all of that stuff up and restoring it as well. Because, you know, I data by itself is is somewhat useful. But if you don't have the identities to actually access that data, you you're still down. So, essentially, you know, the first step is this data gets ingested into our data protection platform. And then from there, what we have is called the preemptive recovery engine goes and does all of the scanning. So data threat analytics here includes the anomaly detection. So that's, we'll walk through how this all all works in a bit, but that's being able to pinpoint your exact blast radius. So what actually was affected? Because quite often, that's that's the first question is, well, what do I need to target for restore? And you don't if they're in your environment for months, we don't know how far, you know, that attack has spread. Sure. We'll know if our mission critical applications are down. We'll understand that. Our end users are gonna tell us. But what about those one off applications? Maybe something's built to do month end processing. And, you know, it's not really it's not really used every day, so nobody's gonna tell us about that. Maybe the monitoring systems don't don't pick that up. Right? And maybe there's some files or folders, and the entire workload is actually affected by the attack as well. So Rubrik gonna point out to you, you know, across, you know, your your data center cloud and SAS SAS data, what all was actually affected by this attack so you can really quickly understand, what to target for recovery. Secondly is gonna be the threat monitoring features. So that's looking for malware within within your backups. So the malware that we look for is actually a feed that we get from Mandiant. So when you buy Rubrik, you actually get Mandiant's threat intelligence feed, and, you know, they're one of the world's leading incident response providers. So it scans for things like over 5,000 known malware families, over 600 attacker tools, you know, things like that and points that out to you and allows you to quarantine that so it can't be used for recovery. And then, of course, we have turbo threat hunting, which is pretty much the same as threat monitoring, but allows you to input your own file hashes. Right? So so maybe you're searching for those zero days or or things like that. We've actually had customers use this just to find out where files exist within their environment. Right? Because Rubrik has that global catalog of all your data. You know, they can quick quickly and easily find things like Log four j when we had sort of that fiasco, because, you know, who all knows where Java's installed with with within your environment. Right? It's it's everywhere. So being able to find out exactly, you know, what the file hash of of that affected version of Java was and scan your environment pretty quickly to to help you out with that. We then get into DSPM, or data security, which deals a lot with your data discovery and classification, understanding where your sensitive data lives, who has access to it, what they're trying to do with that access. Right? So that's second piece for our for our user teams. And then, of course, recovery from there, whether it's identity or data and where we recover to, whether it's the same account, a new account. You know, there's there's all sorts of different options. The idea is it's an entire platform. The entire thing's underpinned by, you know, an API first architecture. We have a ton of automations, SDKs and things if you wanna automate this, like things like PowerShell SDKs, Python, Go, integrations into a lot of the security tools that your security teams might be familiar with, things like Zscaler, CrowdStrike. Right? We can actually add a lot of context, into their applications from Rubrik by feeding, you know, results from our threat monitoring or our anomaly detection or a sensitive data classification into that stuff. So with that, that's sort of an introduction to Rubrik. That's kinda why we're here, why we built the application. I do wanna talk now sort of technically sort of how all this stuff works and fits together. This is usually the most interesting piece, in my opinion. But, you know, we we've tried to be transparent as possible, So we do wanna explain to you sort of everything that's happening within your cloud account, say, when we're protecting Azure so you can really understand, how Rubrik works. I do wanna say we're just gonna walk through Azure VMs today. If anyone is interested, feel free to to comment, or I believe my email's on the deck as well. You can send me an email. I'd I'd walk through, you know, how all this stuff works for Azure Blob as well or Azure SQL or Azure SQL Managed Instance or AKS or or basically anything. If it's any other cloud you wanna hear about, do reach out. We can definitely find a workshop that that we're delivering upcoming, or I can do something one off. I I really don't mind. I love talking about this stuff. But we just don't have the time to go through how to how we back up and restore every single workload within Azure because that would take us forever. So we're gonna focus on Azure VMs at the moment, and go from there. So number one is onboarding. Sorta how does Rubrik understand, your Azure account? How do we get access into your Azure tenant? You know, what resources do we need to deploy within your Azure tenant in order to to protect your data? So how it works is our customers will log in to Rubrik Security Cloud. They point us to their their sort of Azure tenant and basically provide credentials so we can go out and configure OAuth authentication. Right? So we can grab that token and actually gain access into your environment. From there, we're gonna go ahead and we're gonna create a resource group, Rubrik specific one within your account. And this is because we do deploy a few resources in your account. We wanna keep those all neat neat and tidy in case you ever wanna kick us out or or remove our access or delete everything. You could go and just, you know, purge the whole resource group if you want. And it's also, you know, for our support teams to be able to quickly find things when they're helping out with different things. So resource gets resource group gets created. We deploy an enterprise application, service principles gets mapped to, you know, some customer specific information within Rubrik own Azure tenant. This is essentially how we're going to, authenticate into your environment from there on in. Right? So everything's, mapped to this customer specific user within the Rubrik Azure tenant. We connect to that service principle, gather all those permissions that we need. I do wanna mention we do have what we call true least privilege. So when you onboard Rubrik, you can say, you know what? You have backup permissions, but no restore permissions. I don't want you to have sort of any right access into my environment moving forward once we deploy these resources. So you can just give us backup permissions. We can perform backups. And then when it's time to restore, you can actually elevate, that service principal's permissions automatically within Rubrik during the restore process. We'll go ahead and do the restore and then remove those permissions again thereafter. So if you wanna harden everything up a little more, that's definitely possible. And then we're gonna deploy an AKS cluster, within your environment. We call this Rubrik Exocompute. And, really, this is just sort of a bunch of lightweight pods that we turn it on and off to do things like we talked about anomaly detection. Right? That's gonna require retrieving some some information from, those cloud snapshots and those backups. So that's what we're gonna use to mount those backups, to do things like data movement, data transfer, tiering, things like that, scanning, indexing, generating those file hashes. You know? Anytime we need compute, we just leverage, Exocompute or an AKS, cluster to to spark that up and do what we need to do. So from there, you know, Rubrik gets onboarded. We go out and we discover everything within your Azure accounts, all of your Azure VMs, your Azure SQL databases, Azure Blob storage accounts, sort of give you an an overview of everything there, and then you can start to decide what you wanna protect. One sort of unique thing we do, you know, before we get into SLA domains here is you'd we can have the ability as well to, quickly sample for sensitive data if you want to understand, like, what you have within your Azure account that's not protected, that contains sensitive information, if you wanted sort of like a a jump start as to what I need to protect first. That's called cloud posture risk. It's a a a cute little dashboard within Rubrik that you can you can use to find out, you know, where, your sensitive data is and whether it's protected or not. But so from there, you use what we call SLA domains to protect, your workloads. So if you're familiar with data protect you know, traditionally, you have jobs. Right? We have a backup job. We have a replication job, maybe an archive job, a job that indexes, you know, things like that, a job to catalog. And all of these jobs are chained together. And if one fails, then, you know, the whole sort of chain crashes and comes down to a halt. With Rubrik, we say sort of taking all the the data protection constructs out of those jobs and bundled them up into what we call an SLA domain policy. So within Rubrik, you assign, or you create these SLA domain policies to, that specify really four things. Number one's gonna be, you know, your frequency, so how often do we wanna take backups, and then your retention, how long you wanna keep those. So you can maybe take one every four hours, keep it for a day, take a daily that you keep for a month, a monthly, for a year, you know, so on and so forth, all of that. The third thing that we put into an SLA domain is archiving. So we can think of archiving as almost like storage tiering. So quite often, you know, maybe we need to keep seven years worth of data. That's, you know, a a common sort of, compliance trend that we see out there, five, seven years' worth of data. But do you wanna keep all that on hot storage? Probably not. You're you're probably not gonna restore something from four years ago. I mean, that's you're just keeping this stuff around to check boxes, for auditors and and and, you know, adhere to different regulations that you have. So maybe you wanna keep your most recent thirty days worth of backups on on hot storage. That's probably what you're gonna restore. And then after that, let's tier it off to cool or cold storage from there. So that's essentially what archiving is is is processing the data at the end of the chain. And then we have the fourth construct, which is replication. And replication is similar to archiving, but instead of processing older backups, it works at the beginning of the chain on those most recent ones. So maybe you wanna take your five most recent backups, and you wanna go ahead and you wanna store them in another, maybe, Azure tenant or another region within your Azure tenant or another region within a completely separate Azure tenant, or you wanna get them out of sort of your identity domain in case this account ever becomes completely compromised and you need to walk away from it, you can restore this stuff, actually in another another tenant itself. And I should mention the backups themselves, those initial backups, they can be stored, you know, on storage that you bring. So cloud storage that you configure within your Azure your Azure tenant, cloud storage in another Azure tenant, or you can leverage, you know, Rubrik hosted storage, what we call Rubrik Cloud Vault, which is Rubrik Managed Storage that we can provide to you, so your backups are completely outside of your your account or even your organization sort of, identity space. So you assign these SLA domains to your workloads, and Rubrik just begins backing them up. Now assigning those can be done on a number of different levels. In this case, we see parent object. In the terms of Azure, that would be your Azure your Azure tenant or subscription. Right? You assign the SLA domain new to your entire tenant. All the VMs within that tenant are gonna they're gonna inherit that. Any new VMs that get created will also automatically inherit that. So we have that situation where data protection is no longer an afterthought. You know, I was a backup admin for years, and there's been, you know, more than a handful of times where someone's come up to me and asked me to restore something that I had no idea about, something they created two weeks ago that, you know, they've ended up, you know, you know, misconfiguring or something that they need to actually restore the backup, but I'm not backing it up because they never actually told me about it. So assigning to the account actually removes sort of that that data protection as an afterthought because it would automatically pick that up. You can then assign directly to the actual VMs themselves or the managed disks within the VM. So if you wanna have sort of a blanket level one assigned to your account that maybe takes a nightly backup, and then for those more mission criticals, you can you can assign a different SLA that goes every four hours or something like that so you could ensure you have the proper data protection placed on the the proper data. Another cool way to assign these SLA domains is through what we call tag rules. So tag I should say let me back up. We have a lot of customers that have hundreds, maybe thousands of actually Azure accounts or tenants or subscriptions, different people within the org different, departments within the organization managing these, you know, but but one common thing that they do have across them all is a common tagging strategy. So being able to tag certain workloads as, you know, production or certain workloads as dev test. Right? They have this common strategy that they use, for tagging, and Rubrik can kinda go into that and pick up on that. So you could set up what we call tag rules within Rubrik Security Cloud. So as we see a tag, in this case, we have a tag a backup tag, and it could be gold, silver, or exclude. And they actually map to SLA domains within Rubrik, in this case, gold, silver, and one called do not protect, which is a standard one, which means don't don't bother protecting this workload at all. So you can break that inheritance. And Rubrik will go out and discover those tags across all of your accounts and assign those to the proper SLA domains. And, again, as these change, as new ones get created, we constantly monitor, refresh that, and assign those to the and and move them around between SLA domains or, you know, add them to new SLA domains, whatever the tag rule dictates. So there's a cool another cool way to sort of get data protection across all of those accounts if you're one of those customers that has, you know, 50, a 100 different Azure tenants, and you wanna standardize your data protection across that. Another cool way to use this is if you use Terraform or infrastructure as code, you can easily add a tag, you know, within your plans. And when you apply those, all of a sudden, you have data protection built right into, you know, your Terraform or your CICD pipelines, just by tagging certain workloads. So once the SLA is assigned, Rubrik automatically starts taking backups, adhering to the constructs within that SLA. Let's kinda walk through that process. So the first thing we're gonna do is we're gonna go ahead and we're gonna use that that service principle to gain access into the environment. We're gonna look at those permissions that we need, whether it's backup or restore, and prompt you to either elevate them if needed. In this case, it's backup, so we get good to go. And then we're just gonna use cloud native APIs to go ahead and create local cloud snapshots of of your data. Right? So there's there's no real magic here. We're we're using cloud native APIs, but the magic really comes on what we do after that backup takes place or after that initial sort of snapshot, takes place. So the next thing we're gonna do is we're gonna go ahead and process things like archiving and replication. So if we need to replicate to a different region, we'll call the proper APIs to replicate that data to a different region. If we need to archive that data off to colder storage or tier it, we're gonna go ahead and call, the APIs to actually archive that off. We're gonna use exo compute where needed to, ensure that the the backups are compressed, ensure that those backups are marked as immutable. So that means when, after they're laid down to disk, they cannot be changed. In the case of Azure, we're gonna leverage Azure worm technology for this, to ensure your backups are gonna be there as your last line of defense. And then, of course, we'll we'll go ahead and clean up after ourselves. For app consistency, again, this is gonna be provided if you want application level consistency within those backups. We can leverage exo compute and auto inject what we call the Rubrik backup service into the, Azure VM for you. Same with, we'll get into file level in a minute. As far as restore, it's essentially the the opposite of this. Right? We're gonna pull the data from the storage wherever it is stored, and then we're gonna go ahead and we're gonna either restore in place, so that's back to the original Azure VM, sort of overriding your production, or restore what we call an export, which means we're gonna create a new Azure VM, from the backup data. And, again, you can place this in the same account, in a new account, you know, where wherever you want it to go. For file level, I do have a slide specifically for it because it is a little bit different and it is a little bit unique. So, again, we're gonna authenticate in using that service principle. We're gonna instantiate exo compute. So we're gonna spark up that AKS, cluster if it's not already running, get the pods we need. And then we're gonna go ahead and we're gonna grab sort of the restore, the point in time that was selected, so the version of the file that you or folder that you wanna restore. We're gonna go ahead and copy that into, a temporary volume within exocompute, pull those files out, stick them into Azure for you at to actually go and ungrab. So we're not sticking them back into the original, virtual machine here. In this case, we're we're providing them to you with the ability to download wherever you'd like, whether it's to your local workstation or another server, you know, wherever you'd like to to restore those four, and then, of course, clean up after ourselves again. So that sorta outlines how we do sort of the everyday operational type of backup and recovery processes. But, again, you know, it this really does little to prepare us in terms of of cyber recovery. Right? If we're hit by a cyber event, we can't just restore to last night's backup. Because last night's backup may have malware in it, may have zero day in it, may have attacker tools on it. Last week's backup may be the same. Maybe last month's backup still has that stuff on us. We can't just restore, blindly into our environment. Otherwise, we get into this sort of Groundhog Day reinfection scenario. So what we've done in the case of this is really built out what we call the preemptive recovery engine. So what this is gonna do is help you with really four four main three things. Number one is determining the scope of the attack. We talked about this already. Right? Determining that blast radius, what all was affected, assessing your sensitive data, finding the threats within your backup data and quarantining them, and then performing a cyber recovery, to whatever environment you see. So I do wanna walk through these pieces and talk a little bit about sort of how all this works and how it all fits together. So the first thing that happens is we ingest your data. We have those air gapped backups. They're immutable. Right? But we don't just back up. Like I said, as we ingest, we then hash. So all those precalculated hashes for threat monitoring, that all happens before the backup job is considered done. And then we analyze. Right? Analyze for file changes, additions, modifications, things like that. Look for signs of encryption. This is the whole anomaly detection piece. That all happens next. Then we detect and classify any sensitive data. And then, of course, all this gets, you know, put point put into the Rubrik UI or accessible through an API or put into one of those security integrations that we saw earlier. All this information happens upfront after each and every backup job. So when the time comes where you actually need to perform a restore, you already have this type of information available to you. So there's no sort of cracking open snapshots, doing the scanning, performing that clean room activity. So let's take a look at each of these services, and I'll talk quickly about how these these sort of work. So anomaly detection where we're determining that blast radius, it's basically a machine learning model, two stages. Stage one looks like looks for file modifications. Right? Things like additions, modifications, deletions, what types of files were actually affected. You know, is this targeted just at PDFs, or was it targeted at Word documents? Basically, looks for patterns, within your vast datasets to understand sort of what's changed. And that's where a lot of vendors will stop with anomaly detection there, and they'll kinda show you the results there. We take that a little bit further, put it into stage two. We're actually looking within the content of the files, looking for signs of encryption, looking for signs of entropy, looking to see if we could see patterns around the types of whether it was ransomware or malware, the the type of attack it was to give you the most information, that you can get in order to arm you with the best, you know, possibility of performing a recovery. So how this works is we take the the current FMD and the previous FMD. FMD FMD is just it's file system metadata. And this is the data that's generated after sort of the backup job. So we look at the two most recent snapshots, and we get a diff from those. So the number of files on added, deleted, modified. Right? That's where we get that information. It goes into a machine learning model there where we start to analyze the types of files that they were, look for different patterns within that. And, of course, at the end of the day, we get an anomaly list. These are the files and folders that have been added, modified, changed. They're these types, you know, that type of information. That goes through sort of other analysis to eliminate false positives. You can kinda train this as well by accepting certain anomalies, rejecting anomalies, things like that. But it's generally, you know, pretty accurate right out of the box, and then that gets, you know, pumped into the Rubrik UI. Phase two then dives deeper looking at the actual data itself, the entropy scan, looking for signs of encryption, storing the results within it, putting it into a sort of another ML model that we have, which has been trained with, like, real world sort of ransomware, strains and simulated ransomware strains. And we could start to predict the actual type of ransomware, the type of encryption that we see, and, again, push that back to you within the UI. So that's anomaly detection. And, again, this happens every one of your workloads directly after the backups. We then get into threat monitoring and threat hunting. Right? This is our ability to dive into those backups to look for threats. In terms of threat monitoring, the feed comes a little bit from Rubrik Infosec, little bit from Rubrik Zero Labs. Paid third party in this case is Mandiant, but it's it's us paying them. Don't worry. It's not you. So that's that threat feed. And you can bring your own threat intelligence feeds as well if you already have some, that you'd like to scan for. But, again, we're gonna scan for over 5,000 known malware families, you know, 479 known threat actors. It's, like, over 600 plus actual attacker tools after each and every backup and point that out to you. So you're gonna get a report every single day saying, you know what? In the last backup, this is what we found, and you can easily go in, make sure you quarantine those. Sometimes you see them in the backup data before the threat actually is unleashed or before the attack takes place. Right? You might see attacker tools pop up because they're spending months inside our environments, trying to to move laterally and get a handle on much as much data as I can. So sometimes you can use this proactively as well instead of just ensuring that you're recovering clean data. The threat hunting piece, again, scans against those file hashes, gives you that same sort of functionality. So if there is a zero day exploit or an actual file hash that you wanna scan for that's not in this threat feed, you can use our threat hunting capabilities to look for that and quarantine that. Terms of sensitive data, it's it's pretty straightforward. You know, we're gonna we're gonna classify all of your data and look at the context of that data, try and figure out what it is. And there's a little bit of machine learning model and AI that goes into this as well. So we're not just saying, you know, this file has Social Security numbers or this file has, credit card data. We'll definitely tell you where all that is. But we can also give you sort of the context around that. Like, this looks like an HR document, or this looks like a a purchasing document, you know, things like that to make it a little bit easier for you to to get the right information over to the right folks, you know, during that sort of time of chaos. There's a lot of different plug ins. You know, we integrate with Purview, so we can actually start tagging, put MIP labels and different things, on different data, detect if MIP labels are missing from certain data and integrate in and actually apply those automatically for you, and also scan your environment, with with little things that you can proactively go and remediate, like publicly accessible, maybe Azure Blob storage accounts, things like that. So, give you sort of some tools to help mitigate the impact before that attack takes place. And then, of course, recovery. Right? This is the most important piece. You can recover ad hoc. So if you, you know, go in, you determine the last radius, you wanna just recover one virtual machine, that's no problem. Or you can save what we call recovery plans, which essentially allow you to go and and, you know, set a you know, these Azure re VMs. I wanna recover these 20 of them. You know, these 10 go first. I wanna run these certain scripts. Then I wanted to, you know, these 10 VMs to be restored to this account. The next five get restored somewhere else, you know, different things like that. And it will automatically pick up. We could see sort of this flowchart here. It will automatically pick up the latest non anomalous and non quarantine snapshot. So in that event, you're just logging in, you're clicking go, and your recovery plan begins to execute, you know, and and you're essentially done at that point. You can actually test these recovery plans as well. So if you wanna restore to, like, an isolated recovery environment or different things like that, totally possible as well. So to kinda summarize, this is where we we sit at the moment with our supported workloads. Some of these leverage what we call cloud native protection. So, like, in the case of Azure, like Azure SQL's cloud native blob, managed disk, Azure VM. And some of them recover or require what we call Rubrik cloud cluster, which is essentially, our on prem solution. However, it's been enhanced and and rebuilt for cloud. So some of them require a little bit of Rubrik compute to run-in the cloud. So things like, Azure files would recover that would require that, or Azure VMware solution is a a big example, of that. So we have, you know, a number of different supported workloads across the three like, it's four big clouds now. I guess we're we're including Oracle. So you can kinda get a handle on what we can protect, in your organization. So with that, I'm done sort of talking about Rubrik for the moment. But I do kinda wanna introduce you into the the labs. So, the way we've approached this is, you know, congratulations. You've all been hired as our new cloud architects at, Zaffre Fashion Group. So we're, you know, a leading fashion house, headquartered in Gravity Falls. I someone really likes that television show who who came up with this idea that, you're gonna walk through essentially bringing through our bringing cyber resilience into Zaffre Fashion Group groups. So we actually have, you know, an actual application that you're gonna be protecting. It's built on Azure VM, Azure SQL, Azure Blob, and AKS. And you'll walk through a number of different steps like performing sort of those day to day type operational recoveries. As well, we're gonna simulate somewhat of an attack on the application, and you're gonna walk through everything we just talked about, like anomaly detection, sensitive data discovery, threat hunting, and and things like that. So before we actually unleash you to the lab, I do kinda wanna show you a few things. Number one is sort of it's a pretty simple application. Azure VM is gonna basically protect the front end server, that that powers the actual website. It connects into an Azure SQL database. It stores all that product information. AKS is actually running a recommendation service. So if you're familiar with, like, Amazon, when it's like, hey. You bought this. You should maybe think about buying these. That's what AKS is doing in this case. And the the blob storage account, is actually going to host all the images and and different branding assets for that for that, storefront. When we look at bringing Rubrik into the mix, certainly, I I just mentioned cloud native protection for VM, SQL, and Blob. So Azure VM, Azure Blob, and Azure SQL, these are all gonna be protected through, XO compute and, Rubrik's, you know, sort of cloud native protection. And then Rubrik CCS is actually needs to be deployed to protect the Azure Kubernetes services. This portion isn't in the lab, though, at the moment, so you don't need to worry about that too much. But I do want you to know that that our cloud cluster or running Rubrik software in an Azure VM is actually required for the the Kubernetes piece. And, of course, you know, Zaffre is gonna protect all their other workloads as well through Rubrik Security Cloud where they have AWS, GCP, m three sixty five, and things like that. The lab itself, pretty interactive. You know, it's pretty straightforward, buttons to move around. I would suggest, like, turning your volume up. There's some videos there and some student calls and and whatnot. But as you walk through, and we have different chapters if you, you know, feel the need to to skip certain portions. You'll certainly see different options. So when we onboard Azure in the Rubrik, we have the option to use the UI or use Terraform or you could, you know, go through both. When you are walking through things, you can either click where it's actually asking you to click. You can use the arrows on your keyboard as well to sort of navigate around and and look at the different things as well. So that's the lab in a nutshell. And I think Chase has dropped the link into the chat. So at this point nope. There it is right there. So the the lab link is there. If you have any issues at all, you know, we'll stick around for for a few minutes, make sure everybody can get in and get going. And, with that, if anyone has any questions, feel free to throw them in there as well. And thanks for showing up. Cool. Thank you, Mike. Thanks everyone for joining. Like we said, we'll we'll stick around for a little bit as you're clicking through the lab. So, you know, any questions that come up or any help you might need, you know, feel free to ping us. We'll be on probably till till about, 2PM here eastern time. So next about another nine minutes or so. So, again, thank you. Thanks for being here, and, we'll see you in the next one. Like, if you cannot click through some of the links in the docs tab, now would be a good time as well to check those out. We have a, an event coming up over at Cloud Resilience on December 10, so it's definitely worth checking out. The link to it is up there. And, yeah. Again, any questions, shoot us over, and, we'll see you again soon. Thank you very much. Bye, everyone.