Name: Rubrik Workshop: Protecting Your M365 Data
Uploaded: 2026-05-21T18:16:57.600Z
Duration: 49 min 8 s
Description: Rubrik Workshop: Protecting Your M365 Data

Transcript for "Rubrik Workshop: Protecting Your M365 Data": Hey, everyone. Good morning. Good depending on where you're joining us from. We'll just give ourselves a minute or two to get everyone, let everyone settle in. And, the numbers are going up, so we're just waiting for that stable number to just get started. Yes. Good morning. Welcome, everyone. As we wait folks to trickle in, why don't you go you guys go in the chat and let us know where you are joining us from? That'll be interesting to learn, where you where you are joining us. I'm in Vegas. Al Alpeka is in the Bay Area. Indeed. And it's a nice warm day here. Hoping, Ed, it's not too hot for you. Not quite. Not quite. Not bad. Not yet. Okay. Not yet. That's good. Emmett's joining us from Minneapolis. I was just there last week. Beautiful city. Indeed. I really like the downtown area, and they have great food options. They do. They do. And Boston as well. Mhmm. Minneapolis. Nice. Bad. schools. Yes. Indeed. Oh, Barbados. Nice. Fancy. Austin as well, so hope it's not too hot yet at least. Newport, Virginia. Not fancy. I think we can go ahead and start up. Okay. You ready? Yes. I am. Alright. Let me get okay. Perfect. Let's, Thank let's do some housekeeping before we begin. you, Ed. Again, welcome, everyone. Thanks for joining today for this Rubik workshop focused on protecting your m three sixty five data. We really appreciate all you all for being here, taking time out of your day. And our goal is to make sure that your time, your valuable time is, is well worth it as we deliver clear and practical content on m three sixty five production. We're excited about today's session. We have a strong lineup of content, time for q and a, and even a guided lab experience. We'll give it just a moment, for more people to come in. But if you're here for the m three sixty five or anything Rubrik related, you're absolutely in the right place. Quick note. On the right hand side of your console, you'll see a few helpful tabs. The chat tab is where you'll share messages and updates. The docs tab is where you'll find useful links. There are links to our technical white paper as well as our guided lab, and, additional resources related to m three sixty five protection. The q and a tab is where you can submit questions. This is the best place for anything you'd like addressed in this session. And we strongly encourage you to ask questions early and often, and we'll do our best to answer them as we go. And, we'll cover we'll have time at the end to also cover them. Engagement is really what makes these sessions, valuable, not just for you but for everyone attending. If you're wondering about something, chances are others, are as well. So your questions often lead to deeper insights and discussions. With that, I'll step aside and hand things over to Alpika, our technical expert, whom you will find super knowledgeable, and she'll walk us through today's deep dive. Thanks again for being here. Let's get started. Take you away, Alpika. Thank you so much, Ed. And, again, like, good morning, good afternoon, everyone. So this is this webinar is targeting our m three sixty five workloads, but if you have questions about others, we can answer it as well, like Ed mentioned. My name is Alpika Singh, and I'm a senior technical marketing manager here at Rubrik. I do cover everything that is related to SaaS, AI, unstructured data, and, Kubernetes, as well as databases, data protection for Rubrik. So, you know, wide width of product knowledge. So if you have any other questions around SaaS, other SaaS workloads, or other workloads, feel free to ask that. And I'm here with Clint. You don't see him, here his face right now, but he is right here with us. He's our sales engineers on our PLS side of things, and he talks to m three sixty five prospects and customers day in and day out. He he does POCs. He is a great, great, great person to talk to as well. So if I don't have answers to the questions, he's there to help us out as well. And while I'm talking, he's, he will be helping us through q and a. So, you know, while I'm talking, you have questions, put in your questions. Clint is there to answer anything, and everything. Also, if you have questions, you know, very specific to your environment, don't be alarmed. You can still ask us. If we don't have the right answer, we'll make sure to follow-up and get you the right answer. So ask questions ask questions early. If there are a lot of questions and if it's relevant to the slide, we might just take a pause and start answering questions before, we continue with the presentation. You know, we want to make this very interactive. This is for you so we can, tailor it, to however you see fit. K. So ask away. And, after I do the technical deep dive, I will just, show you what the lab looks like, and you can take the guided lab, and try it out at your own time, and ask us questions. K. With that, we all know that m three sixty five is under attack. There's always constant news about, different, groups taking over the m three sixty five application and extorting money out of it. Now m three sixty five started as an on prem solution, and now it has evolved to, this, something that is available to everyone via cloud. Right? So, it's become a SaaS application, and, all your crown jewels actually live in M 365. So, it's always under attack just so that they can extract you for money. Now the attack on M three sixty five doesn't just start with M 365. Right? It starts with your identity. And what we've seen is that, over 90% of the organizations, have had at least one or more identity related incident as well along with m three sixty five. So and then, there's year in year over year increase, in ransomware attacks, like, 275%. That that's a huge number for our Microsoft customers. Now the goal is that they, get into your ENTRE ID, get some privileges, get some escalated privileges, get into your Microsoft three sixty five because that's where all the crown jewel is, all your, critical data, IP, all of that information. Right? And, also, via Entra ID, they can then traverse to your cloud accounts or your on prem account. So, you know, this is the entry point essentially to your entire infrastructure. And a lot of times, you have multifactor authentication enabled. And, usually, it's via, either the Microsoft Authenticator app or via your email. Right? So everything is tied together. So it's it's, that is one reason why the attackers are going after these two applications first and then going to your other applications. So, you know, right now, can you answer this for yourself or for me also? Like, can you reduce your surface area of attack? Right? Do you know, how quickly you can, recover your m three sixty five if there is a cyberattack? That's few questions that you constantly need to ask yourself considering it's it's very important to, keep your m three sixty five up and running all the time. Now, to answer these questions, essentially, what you need is end to end cyber resilience. Right? So when we talk about cyber posture, first, to reduce your attack surface, what you need to know is where your sensitive data is. Purview doesn't give you all of that information. Are you able to discover, classify, and constantly monitor your sensitive data to see who has access to it? Does it have, global access, or is it available on the Internet? Things like that. You do need to make sure that you have sites insights into this. And then, again, like I mentioned, like, overexposed, like, if something is available to everyone, like, especially if it's customer data or your revenue data, things like that, if if it's available, to everyone, and if that goes into your Copilot, your agents are getting trained on it. And that it can even happen that the entire world has that information. You do not want that to happen. Right? So you need to make sure that you understand, all your data access and you you can control it at any point of time. The other aspect is always, whenever there is an attack, you know, assume identity breach, and you always need to, recover your Entra ID to make sure only the right users are able to log in and only the right users have access to your data. And the other aspect is even m three sixty five recovery. Now if you're trying to do a mass recovery, a, there are a lot of API limitations. I'm sure you're aware of it. And it can take weeks to months to recover your entire m three sixty five data. Like, you have years worth of data. Right? So it will take time. But what you need is a way to prior prioritize the recovery so you are able to get back up and running quickly. So, you know, keeping these four aspects in mind, it's really important that you think about it and then make sure that you are able to answer this for yourself that can you do this today? Right? If not, we have Rubrik Security Cloud, which provides the end to end resilience, cyber resilience for your data. Now Rubrik Security Cloud is essentially a centralized platform. So it manages all your Entra ID, backup and recovery operations for your m three sixty five, your other SaaS applications, and even your cloud and your on prem, workloads as well. It can do all of the discovery classification and monitoring of your sensitive data. So we have capabilities built in that can identify all the risky behavior, who has sensitive information, things like that, and I will get to that in just a little bit, but just giving you an overview. Again, like, recovery of Entra ID, very important. Able to reach like, automate the entire recovery process for your AD as well as Entre ID, is really important. Again, if you're trying to recover it individually, it can take forever, and there are always errors. But Rubrik can essentially automate that process for you. And, of course, m three sixty five, that's what we are here to talk about. So, we have a lot of prioritize and different recovery options as well, but being able to recover, the environment quickly and get our customers back up and running, that's the most important thing. So we are making sure that your critical data is recovered first. Right? So, now this solution is essentially designed with Microsoft three sixty five, with the Microsoft team. So, it's co engineered. So what Microsoft three sixty five provides is the threat prevention governance, making sure that their cloud infrastructure, their Azure environment is always secure, and always up and running versus Rubrik comes in as a cyber recovery player, essentially giving you access to air gapped, backup and immutable backups. So even if there is an intrusion, and a cyber attack, you are able to recover your data from a clean snapshot and get your and you're able to get back up and running quickly. Again, like, Rubik provides coverage for all your Azure workloads, a lot of other SaaS applications on prem and other things as well. So what does this infrastructure look like? What does the architecture look like? So there are three main components. First is Rubrik Security Cloud. Again, like, global management plane. This is where you log in to onboard, your m three sixty five, set up SLA policies. You can monitor all the alertings. Everything that happens is through Rubrik Security Cloud. And this is true for m three sixty five, and if you're protecting on tri d, on prem, cloud, everything, all the workloads are centrally managed via RSC. Next is the Rubrik host of secure resources. Now this solution is a subscription based model. What that means is that, we want to make sure that, we provide you with the air gapped immutable backups. So, the all the, compute as well as the storage resources where the backups are actually stored, are actually in the Rubrik hosted Azure subscription. This is this is by design. This is just to make sure that, the customers have access to their backups if they're attacked. Now next is the m three sixty five environment itself. Now this is the customer hosted, and then we do support the backup, essentially, data protection for, Exchange, OnePoint, share, OneDrive, SharePoint, and Teams, plus Entra ID and on prem so you can get an end to end solution, for your infrastructure. Now we'll get into how the setup actually works. So once you get your access to m three sixty five license, essentially, get access to RSC, the first thing you will do is, log in to RSC and then enter the URL for your m three sixty five subscription. Once, you do that, you do have to provide your admin credential. Like, this is your global admin credential. And now, we don't store this admin credentials anywhere. It's not in memory, not stored anywhere. This is just so that we can do the initial authentication and, essentially, issue RSC OAuth two dot o tokens so that, in the future, whenever the backup recovery and other operations need to take place, you don't have to enter your admin credentials. It just authenticates, via OAuth, tokens. Now that's pretty much true for all the SaaS applications, and that's what, we are doing as well. So once the authentication is complete, we spin up one, enterprise app for each of the protected workloads. So one for Exchange, one for enter OneDrive, one for SharePoint, and one for Teams. This, enterprise app essentially is meant for future authentication, whenever there is any operation that goes on between Rubrik and your m three 65 subscription. What's that? Rubrik will spin up dedicated resources, for in in in the form of AKS clusters. It's a scale out, setup, basically. So if you start with four nodes, of the, of exocompute, it can quickly scale up, to essentially match the requirement or or the compute needed for the backup recovery and other operations. Next is the Azure Key Vault. We do encryption of data. So the root key is essentially stored in the Azure keyword. And the third is the blob storage. That's, ZRS or zone redundant storage, making sure your, backups are always available. And this is where your, backups will actually live once the back backup operation starts. Once these resources are spun up, we go and do the inventory of all the supported workloads. We tell you what, you know, what are the users, what files. Essentially, you can decide what you want to protect after that. Now after this step is always the application of, SLA policy. This is where you define which groups you want to protect. You can protect the entire subscription, or you can protect individual workloads. So you can choose to protect just Exchange and OneDrive and not worry about something else. Right? So, there are multiple options available. So depending on your requirements, you can set up SLA policies, to protect your data. So one favorite question we get is about Multi Geo support. Yes. We do support Multi Geo, and, while onboarding, it's a simple checkbox. So if you if you do have, data across the globe and if it needs to live in particular region, you can enable that as well. We have a concept of CDLs and PDLs. CDL is essentially central data location. This is the default location if, you know, you don't have any preferred data location set. Now what is preferred data location? Preferred data location is, if suppose there's a user in UK and you want the data to be backed up only in The UK region, that's where that would be the preferred location, for the your UK employees. So just setting a preferred location, is what known what is known as PDLs. And, of course, you do have to, specify a centralized data location, for regions, that doesn't require the data to live there. Again, like, very easy setup, just a checkbox while onboarding, and Rubrik will take care of that data, of, where the data is stored. And you can also enable road based access control. So admins living in UK can only access that backup, and the rest of the world cannot. Things like that. So a lot of, cool features there. When we talk about backup now, we did the initial onboarding. We've applied SLA, then what happens? Based on, the SLA, you define, like, how often you want to backup. Right? So, when it's time for backup, RSC will automatically kick start a job backup job. It will, go, and ask the AKS cluster to essentially spin up exocompute nodes. So you start with x number of pods, then these pods authenticate via the enterprise app. And then once that is completed, it then accesses your application data. So Exchange, OneDrive, SharePoint, and Teams, and, essentially identifies what, data needs to be backed up. Now one thing to note is that your first backup will always be a full backup, and the subsequent backups are then incremental backups. So what Rubrik will do is that it'll take the snapshot, from the previous backup, compare that, to your current dataset, identify, what has changed, and only that delta, the difference. It will then copy that data over to Rubik's subscription. And once the data is copied, there are a couple of operations that happen. First is indexing of the data. Indexing is very important, so you can, you know, do granular restore. You can do file searches and things like that. And, also, we do a lot of data classification and threat analytics. We'll get to that in a bit. But, everything is performed as soon as the backup happens. Once the operations are completed, we go ahead, use the key vault, essentially, the root, key encryption key to, encrypt the data. And it's an envelope encryption, so there are multiple layers of encryption that happens, of your data, and then it's stored in the block storage. Once the data is, backed up, we go ahead and send all the metadata to Rubrik Security Cloud, and then we spin down the, AKS cluster or the nodes compute nodes essentially because the operation has now completed. So this is how the backup works, and the restore is just the opposite. So, if you are an admin, you log in to RSC, and you want to perform backup. Oh, sorry. If you want, do a recovery operation, you identify one file or files or entire folder, entire share, whatever you want to recover or your entire subscription. Right? Whatever you want to recover, you select that, identify all the snapshot, where you which you want to use to recover from. Once that is completed, RSC gets into action. So RSE will then, spin up the compute nodes required to, finish the restore operation. It does the authentication via the, enterprise app and then decrypts the data, and then moves it to your, subscription. And that's it. And then once the data movement is complete, it will spin down all the compute notes. I'll take a pause and see if there are any questions so far. I don't see any, so I will continue. Okay. So we talked about that we perform a lot of threat analytics. So now when we get into threat analytics, there are three key features. First one is anomaly detection. Like the name suggests, we are looking for anomalies. Now what are anomalies? Things like if there are massive deletion events, encryption events. So we are looking for for, things that don't happen in your infrastructure on a day to day basis. And Rubrik's, ML agent is not a agent, but the ML algorithm learns your infrastructure over time, so it's able to detect that. So, the first step is to, to calculate the diff FMD. Now FMD stands for file metadata. You know, remember I talked about the fact that during the backup operation, once the backup data lands into Rubrik security into the Rubrik subscription, we do a lot of indexing. And as part of the indexing process, we, you know, create a file met file metadata as well. So, what the anomaly detection workflow will do is that it'll take the current file metadata, compare it to the previous file metadata, and create the diff FMD. Now once that is completed, it goes through the anomaly detection machine learning model. So this is where we look for, like, massive deletion events, like, if the user still exists and your entire folder is deleted, things like that. Massive changes, like the entire, you know, file structure change, things like that, is what we are looking into. If there are such major anomalies, we create an anomaly list, and then it's sent to RSC. That's where the anomaly detection UI lives, and that's where you can see this information. The second phase is to do the encryption detection. So, the diff m diff FMD goes through an entropy scan or to look for encryption. The results of that is fed into the ransomware SS table, and that table goes through, another ML model, which is specifically looking for encryptions. Now if there are any encryptions found, the results are again, sent to anomaly detection UI. So, basically, for an anomaly, you can see if there are any encryption present as well. These are not two different set of information, but for an object, you will see it as a single line single line item, and you can see that in the demo as well. Then we get into threat monitoring. Now threat monitoring is essentially, a proactive way to scan your backups and look for any, IOCs or identity, or indicator of compromise. So it's looking for any day zero threats that are present in your infrastructure. How does that work? So Rubrik has, a threat intelligent feed that essentially contains, threat latest threat intel from some third party, organization, Rubrik ZeroLab, and also from Google Threat Intelligence. So it is, it has, hashes as well as Yara rules. This this doesn't consist of all threads that has existed, like, from ten years ago, but we are looking for the most common thread that is prevalent across the globe. And this is daily, sometimes hourly update. It just depends on how frequently the threat updates are coming in from these, these three, different identities. So this as soon as the backup completes, using this threat intelligent feed, we will scan your backup, and we will look for any threats. If there are any threats detected, we will then inform you of that threat. So there's a threat monitoring dashboard that lives again in Rubik's Security Cloud, and it will tell you that indicators of compromise, which is IOC, is found for x, y, and z object, where that thread is located, what is the exact location, what are what is the hash value, a lot of other details, for you to use. Again, like, that's part of the demo. We we can get into it in just a little bit. Okay. Threat hunting. Now this is a reactive, tool that we are providing our customers. If there is a threat, we want to enable our customers to figure out the blast radius, figure out which other objects are probably affected by it, when it first started, things like that. What is a clean snapshot? So it's a wizard driven workflow where you add the hash value of the threat, and then we will do the scan of your backups to look for that hash value. Again, like, Rubrik will not provide you with that hash value, for threats, when you're doing any threat hunting feature. This is something that comes from your SecOps team. You know, if you're running if if you are if you are compromised, if your environment is compromised, I'm sure you're working with your SecOps team so they can give you that information so you can look for that threat across your, dataset. Next is the data discovery classification. Now, to remember, like, to reduce your cyber exposure or, have a good cyber posture, you don't do you do need to identify where your sensitive data lives and who has access to it. Right? So, for that, we have, another application called data discovery and classification. The way it works is that, you launch the data you launch this application via Rubrik Security Cloud, and there are prebuilt, policies, or you can create custom policies. Like, the prebuilt policies are looking for PII, HIPAA, GDPR data. We have prebuilt, sorry, analyzers to look for specific sensitive data. So, we have analyzers that look for your, Social Security number, passport information, things like that. Or HIPAA, when it comes to HIPAA, it's looking for if there are any customer patient records, things like that. Give me a second, please. Sorry. So you essentially apply these policies, to the workloads. And once you do that, after every backup, we will go ahead and scan your backup and look for the sensitive data. Once the analysis is complete and if there are any violations found, like, for example, if there is HIPAA data that, maps to HIPAA policy and it has open access or, you know, it's out available on the Internet, things like that. It will tell you, if there are any such violations found. Even if there are no violations, there are there is nothing reported, but it can tell you exactly where all your sensitive information lives. Now data access governance. Now, this is this feature comes in very handy when you are prepping for your Copilot, right, when you are trying to figure out how your agents will be trained and what data you're using. Now if you are backing up active directory, Entra ID, Windows, as well as, Microsoft three sixty five, essentially, Rubrik will use all the user saves, ACLs, group membership information, any audit logs, document contents to, you gather this we gather this information from the Rubrik backup. And don't worry if you don't back up, everything with Rubrik. We will gather as much information, from m three sixty five backups if that's what you want to do. Once that is completed, we will then do our evaluation to look for if there are new risky identities that have come in. If there, if there are any permissions, that are missing on files, data classification. We class do a lot of document classification as well. Once that is completed, we look for any violations, such as, like, if there are any, missing or incorrect MIP labels, if there are misplaced data, overprivileged, things like that. So, essentially, we are doing a lot of analysis on your backup, and then doing the evaluation, looking for violation. And if there are any violations found, you, can take action from RSC. So, for example, for overexposed data, you can, remove any public link. Or if you don't want to do that, you can actually create a ticket. And in that ticket, you can put in all the information, that you have gone from Rubrik, and Rubrik can create the ticket as well. You can even add, remove MIP labels, things like that. And, the other great part is that we, do have API integration with a lot of, DLP, SIM, SOAR, vendors. They all are our partners, so we can, take this take these violations and send it to your Seymour or, integration as well. Now we get into different recovery options. Mass recovery, I'm not going to go into that where you just do, your entire subscription recovery. If that's what you need, that's what you do. But, we all know about the API limitation. So if you want to you know, mass recovery may not be, an option, every time. So we have another option called prioritize recovery, where you can recover the most recent and most critical data first, before recovering all of your data. So the way it works is that you identify the Entra ID group, or you can, just do it at a user level also, and identify which workloads, you want to recover first. You define, the scope of the recovery, meaning, how many days prior to today you want the recover you want to recover the data for. So, it could be one day, seven days, fifteen days, or all the way up to thirty days. Once you identify that, what Rubrik does is that at you for Exchange and OneDrive, it uses the backup metadata and identifies all the, items that have been either created or modified in the past, say, you know, whatever time frame you've defined. So if you've defined seven days, we will look into past look through all the data and find the most relevant data, that has been added or modified in the past seven days for Exchange and OneDrive. But when it comes to SharePoint, we go and, access the Microsoft access logs, and essentially build a restore plan based on sites that have been most used, in the past, say, seven days or whatever is the defined time frame. And then we identify the, the the files or the site that needs to be and the files that needs to be restored. Once all of that is completed, RSC will kick start the recovery process. So, essentially, it'll, instantiate all the AKS cluster, and it will start the restore process. What happens here is that first, you know, you can get your critical users up and running with their most critical data. And then in the background, you can also choose to recover the rest of the data. So, that way, as you know, your most critical users are up and running quickly, within the same day rather than, you know, dragging it out for weeks. K. So this is, what makes your recovery a 100 times faster, than mass recovery. The other cool feature what I love is that self-service restore. Now imagine if I if not imagine. I have done that in the past. Like, I go and delete a file thinking I don't need it or I accidentally deleted it. Twenty five days later or a month later, two months later, I realized that, oh, where is that file or where is that email? Now what I will have to do is that I will have to create a IT ticket, and then IT will figure out how to restore, what is the file name. There's a lot of back and forth. And if you look at what I that's not your IT team's primary job. Right? They have other things to take care of. And they may get to your ticket, say, a week later. But if you need that data, we give our users this option of self-service. So as a user, I can log in to RSC. I can only see, not even see, but I can only search for files across my account. I can only look for emails across my own identity. And then once I figure out what that what needs to be recovered, I select the snapshot and redo the recovery. So this ways, there are no extra IT tickets. However, the cool thing is that if I do a recovery, the IT admin will also be notified, that x, y, and z, like, Alpaca went ahead and recovered x, y, and z file on this date. So as an admin, you also have control over, to see what everyone is doing. And as a user, I can also do self-service restore and get my data back up and running, if I need it. So, you know, just to sum it up, if you look at the attack timeline for during a cyber attack, Rubrik provides you with that data security posture pre attack. Like, it identifies where your sensitive data is. If there are overprivileged data, you can take action pre attack and essentially look at reducing your, attack surface and making sure that your data is safe and secure. Next, if you do have an attack, Rubrik will help you with anomalous activity detection, identify, the blast radius. You can identify what is a clean snapshot to recover from. That's why the cyber recovery and, different threat analytics features I talked about. And then, most importantly, you are able to recover and prior prioritize your recovery. You know, you will obviously do the identity recovery first, making sure only the right users have access, and then you can, restore the critical data first before the mass restore. So, again, like, built in workflows for both your identity, your, m three sixty five data as well, offering you this complete cyber resilience, making sure that you can get up and running quickly if you do have any cyber incident. Now with that, I will take a pause and see if there are any questions. Clint, anything, we wanna highlight? Oh, great. I see that there are a lot of questions in the chat as well. So thank you so much, Clint, for taking care of them while I was talking. If there are no more questions, I'm going to quickly show you what the UI looks like and what the demo will look like. So these these demos essentially are, guided click through demo. You can use your right, left, arrow key if you don't want to click as well. So, the product was, talks about protecting on Friday, recovery, AD, onboarding of your m three sixty five, how do you protect and recover, then even recovery to another subscription, self-service recovery, threat analytics. Everything that I talked about is, covered here. I just wanted to show you threat analytics, so I'm gonna click on threat analytics. One and, essentially, just show you. So this is our threat analytics dashboard. You can see the anomalies, threat hunts, and then threat monitoring. Right? Like, they are the applications. And, also, this is our centralized dashboard, talking about if there are any anomalies, any threat, or any threat hunts ongoing. So okay. What happened? Sorry. Give me a second. Okay. So, remember we talked about how, Rubrik does a lot of threat an anomaly detection in the background. So, if there is an anomaly, this is how Rubrik will, this is how you can see it on the dashboard. And if there are any, encryption like that, we see a log bit anomaly, it will actually highlight that as well. If you go in and dive in deeper, it can tell you exactly how many suspicious files are there, what are the activities, when did the event first started, when did the anomaly first started. And then you can actually identify, like, essentially, if you get into the demo, it will tell you, what you can do with that. K? The other aspect was the threat monitoring because, this is our proactive feature, where you can see how Rubrik can tell you, if there are any active indicators of compromise. So if there are any threat present, this is what you will see on Rubrik Security Cloud, you know, what objects are affected, how many files you have, with matched indicators of compromise, what was the date when it was first detected, and the match type. So if I go to next and you click on the name, Rubrik will list up all the files, where the thread was, was there and also give you all the IOC detail. Right? So all the hash values, what are the affected snapshot, and, you know, which family the thread belongs to and things like that. So there's a lot of cool features built into the platform on top of your backups and recovery, you know, giving you the complete cyber resilience, making sure that you know what is affected, and what is a clean snapshot to recover from and identify all the blast radius. Okay. I will pause because I've been talking a lot. Clint, anything I missed? I don't see anything. Okay. I want to give you your time back. Ed has given you the list, or given you the list of all the docs that you can access to get more information and also the link to the lab to learn more about Rubik, before you even talk to our sales team. So, you know, if you want to see any more live demos, talk to our sales team. Do reach out to us, and, you know, they can help you, get all the questions answered, get, on-site meetings set up with your team. So do let us know how we can help you. Thanks a lot for spending the hour with us. I'll give you some time back, and, have a good rest of your day. Thank you so much.