Name: Roll Back to the Future
Uploaded: 2026-09-30T18:55:08.497Z
Duration: 38 min 8 s
Description: Roll Back to the Future

Transcript for "Roll Back to the Future": Thanks for jumping on, everybody. We will give it another minute for a couple of folks to roll in, and then we will jump into the goodness Behind the covers in the backstage as the webinar calls it is my good friend, Vijay. He's gonna join me halfway through, and we'll talk more about some of the logic and some of the reasons why we built the the roll forward concept that we're gonna walk through today. So bear with us. We'll give, some last minute struggles a couple minutes, and then I will jump on here shortly. Alright. We'll, we'll jump right into it. I will quickly switch to make sure my mic is on. Looks like it is perfect. So we're gonna break this up into three sections. You know, first and foremost, I wanna kind of establish what am I seeing from a marketplace standpoint? You know, over the last couple years, I've had, I don't know, well north of a thousand conversations with our customer base around this incident response problem that that folks have when it comes to they'll call it their IDPs very generically, active directory, Microsoft Entra ID, Okta. You name it. We're seeing it across the the IDP ecosystem. And, fundamentally, where Rubrik comes into place, how do I help you when this worst case scenario happens? How do I give you the ability to respond and do it in a way that won't impact the the business? And I think the cool thing of what we're gonna talk about today is that it's a new and novel approach that I haven't seen done in the marketplace. And as Vijay and I will talk about, it really became out of conversations like these with folks like you. What are you dealing with? How would you handle this real world? What problems are you gonna run into? So, hopefully, this gives you some new insight into how you update your current incident response plan or fill in some gaps. And and probably more importantly, start thinking about a lot of these nuances that we've seen, like I said, we roll during incident responses that you'll unfortunately will have to think about, you know, knock on wood, I guess. You won't have to think about it sometime during your career. But, overall, I think one thing that I see change across the board is this concept of a anonymous adversary. Sorry. I say, autonomous adversary. We've seen Hugging Face. We've seen the plethora of reports from every vendor out there, OpenAI, Meta's getting on the game, Google. Everybody has some kind of rogue agent coming to place, and it's really fundamentally changed every conversation I've been, especially over the six months where, you know, if I look at the shift here, it's gone from here's this theory from back in February 2026. How does that work down the area? And just overnight, we saw this become real world. Right? We've seen these agents go out in the marketplace. So it's really become this conversation of not if this happens, but when, and what is the damage that's gonna be done out there. So I say this is a fun time in the marketplace, but also realistically from a defender standpoint and probably folks like you, this is very, very difficult in terms of how to adjust. So this is, like, the underlying context and and how we're thinking about these these solutions across the board. When these attacks happen, there's a couple of things that that play out almost exclusively, across the board every time. And I built this identity workflow, again, based off of rerolls. Like, this isn't some theory. This is what I've seen as I'll talk about here, both in public case studies that we can reference as well as with our internal incident response team. So it plays like just plays out like any other attack. You have your peacetime. You have your IDPs in your environment, Active Directory, Intra, Okta. Majority of the time, our customers have those three, if not some some subset of each. And every day, there's different changes throughout the ecosystem. And each and every day, it can be a a large number, but, really, the the big piece comes in play when it comes to across every single day, you have more and more changes, things that make your IDP your IDP that's happening day in and day out. And over, you know, a couple of month time period, those really start adding up. So example we'll use here is 285,000 changes, which is, again, is based off of your role. You know, what we've seen across our customer base, what we'd expect to see for the amount of changes, everything from, you know, security group access to Abigail got married and she has to have a name change. Like, all of those are accounted for when you think of these changes that are in your ecosystem. So peacetime is what you guys know day in, day out. Wartime usually starts when there's some kind of compromise event. It's gonna be on the weekend. It's gonna be at 2AM when everybody's asleep, how it happens every time. Once that detection is in place, one of the first things that always happens is you engage your outside incident response firm, Mandiant, CrowdStrike, Palo Alto, whoever it may be. These are the folks that you want helping solve these different challenges. And their primary purpose is, how do I help you find patient zero? Who was that person initially compromised, and what happened next? And that what happened next question is always the most difficult to solve. And, really, what that looks like is you have that needle in a haystack. So there's there's two options I see play out during these initial responses. First and foremost, you try to find every single backdoor that the actor, created. Again, like we talked about, you're you're doing a needle in the haystack. So in this example, I pulled just 15 of the most common TTPs that are out there. Definitely not an exhaustive lift by any sense of the definition, but a good way to think about the problem that we all deal with during these IRs. So just in these 15 instances or 15 TTPs, I should say, you have to look at all those changes across your ecosystem. So 285,000 changes, was this TTP used in this area? And a lot of times, it's a combination of changes that say yes or no. So you're sort of thinking about millions and millions of forensics checks that your IR firm has to do, and it really becomes this daunting task, especially when time is clicking. Right? Your IDP is down. You have to get it back up or running ASAP. It is, like, the definition of a tier zero application. Excuse me. Everything relies on it, and you can't take the time to find this new one in the haystack. And just as importantly, there's a couple examples down here, the ones highlighted in yellow. If these occur, you have to do a full rebuild no matter what. Like, no exceptions. Your IDP itself is compromised. Finding backdoors is not gonna matter because they have the keys to your kingdom. Right? You can't sell that unless you're rebuilding, which is really why option two here is the default, de facto option without without exception in today's ecosystem. Again, I've seen this both in public examples, like the state of Nevada, like Stryker, where they talk about having to rebuild the IDP from scratch. Stryker brought in Palo Alto. Palo Alto put out some good information during the initial phases of the attack. A lot of good nuggets in it, but one of their exact quotes was we had to rebuild the IDP to the precompromised point. Otherwise, they're having to find this backdoor, and it becomes a yield haystack conversation. The really interesting point from the state of Nevada example was how much does it actually cost. Right? It's a government agency. They published the cost. And if you look at the math here, nearly 27% of their total incident response cost was just rebuilding Azure Directory itself. Not intra ID, not Okta, just AD itself was a massive, massive, piece of puzzle form. So you're having to bring in these outside firms like Microsoft to rebuild. It's gonna be expensive. It's gonna be time soon consuming. Nobody wants to do it as part of the process. So this is kind of what we wanna help solve as an organization, and a lot of the questions we have from our customer base around what this look like. So, hopefully, that sets the stage. No pun intended. At this point, I will invite my good friend, Vijay, to jump on stage with me, and we will kind of, just give you the lowdown of what we're thinking about, what this rule forward concept is, and how do we brought it to the table. So, Vijay, without further ado, let's see if good old Goldcast will work and let you jump. We'll go on stage. Perfect. There you are. Yeah. How are you doing, Ruth? Yeah. First off, Vijay, like, I totally forgot at the beginning. Like, I don't even think we did intro. So maybe. a quick intro on your side, Vijay. Who are you? What do you do? Tell us. the goodness. Yeah. Hi, everyone. Good afternoon. Good morning. Good afternoon. Good evening. Hope you all are doing great. So my name is Vijay. I lead the product team, here at Rubrik, working on our identity resilience portfolio. Drew is my partner in crime. We work together to, you know, drive this vision and product forward. So, yeah, excited to be here and, chat, roll forward. Yeah. And just, folks, for the call, like, Vijay and I made a personal decision not to have any prestaged questions. So we are. doing this live. We wanted to have a no filter moment and really just give this kind of back and forth between friends in terms of what are we seeing from the marketplace and then how we're driving it. So, Vijay, I was just thinking, like, you've been on board for a couple months now. I think day two at Rubik, you got stuck into a room with me, and we were talking about this roll forward concept. Maybe, like, just what was your initial impression? Like, coming from the outsider perspective, like, you have no Rubik knowledge. It came from, like, an identity background. But, like, what was this role forward thing when you first heard it? Yeah. I mean, to be honest, I was like, what are you even talking about? Like like, I mean, Yeah. I think the first time I heard about this roll forward guy and I'm just trying to, my background is I've been in the identity space for the last decade, and, you know, I deeply empathize with the I'm pain that I'm seeing. And so, like, when I heard about this all forward concept, I think my first reactions were, okay, how would this even work? Because, like, if it works, it's magic. But, like, really, can this be possible? Because this is not something that we've heard about in the field and we've heard about as a capability in I'm hands. So, it was it was, like, just intriguing for me to understand what was going on. And then as I got into the details and as we understood what was going, and then now being three months in understanding where we are right now and where the vision is, it's it's super exciting to see, like, where this is Yeah. I think one of the the big telling point for us as an organization and kind of. where our thought process started to change is when more and more of the conversation shifted to you have to rebuild. Like, no exception. Yeah. You're having to rebuild the organization. You can you can kinda see that for, like, a product, direction for us. You know, if you look look back a year or two ago, a lot of the features we had were this this concept called rollback, which is still fantastic and driving it, and there's a lot of great use cases. But less and less, Yep. we saw that being useful or used in real instant responses because nobody knows. Like, maybe, Vijay, like, what's the challenge customers have in terms of finding that persistence, and why why is it such as daunting task that folks have to deal with? Yeah. Yeah. So, like, again, so I've I've been, like, in so many of these conversations with our customers and, you know, traditionally, customers think about backup and recovery as, like, there's okay. Let's just go back to a clean point in time and then call it done. But then it's not as simple. Like Drew was mentioning, you know, going back to a clean point in time is just part of the job. But then once you go back a clean point in time, you have all of your joint and move lever processes that are happening. You have so many legitimate changes that are happening. You really have a needle in the haystack kind of problem to figure out what is the malicious change, what is the legitimate change, and how do customers do it today. Like, the way customers do it today is once you go back in time and go back to a clean point, you have to manually do all of this reconciliation by hand, understand all of the context, and then refigure and reconfigure all of these changes. While you're doing all of this stuff, people lose access to apps. Like, the business is still down. Like, you have not recovered recovering clean is one thing, but this clean and current concept is something that is, like, just so new. And so, like, it's just this process is so complicated because you have to understand everything that has happened, which can be in thousands. You have to understand which ones is legitimate, which ones are malicious, and all of the context is spread. So, that's that's that's super difficult to solve. Yeah. I I think you you nailed it ahead. It's just what makes IDP an IDP. Right? You're rebuilding. through x period of time in the past call thirty days. Like, what did you guys do as, you you know, an identity team? Or what did your identity team do in those thirty days? Like, a lot. Like, by its nature, Yeah. NTPs are just fancy databases on the back and that are very transactional. One of my my favorite conversations with this came from the the CSAT, one of the big sporting goods companies we were talking with. This was early in the year closer to the, you know, January, February timeline. He was thinking about this in the context of, his holiday season. Right? They bring on twenty, twenty five thousand workers during their their big holiday rush, and his mind when you went to, like, great. If I had to rebuild to, I don't know, December 15, like, what do I do? Like, those 20,000 workers are now back in my environment. He's thinking about it purely from a security standpoint. Like, what is that risk? What compliance areas? Do these people have access that they shouldn't? But then also his his I'm team in the back is like, I don't even know how to solve that. Like, I don't know how to determine who those 20,000 workers are. Like, should they be there? Maybe some temp workers stayed on. Like, maybe they they moved into a different organization. Like, all those things keep going on, and. you really just your mind just starts going crazy. Like, you can go that that that's so many rat holes here. We'll start thinking about this challenge. Just just to just to put a pin on that for one second and just explain the gravity of what you just said, Drew. Like, you know, from if I am an IAM admin, like, you know, I've been thrown all of these terms around zero standing privilege, least privileged access, ensuring the right people have the right access. Like, just hear out for one second. When you said, oh, I have to go back in time to December 8 and, like, suddenly these users who should not have access are starting to appear back in the directory or users who should have access but are no longer in the directory. This is a pretty big change and pretty important security outcome that I am admins need to solve. And, like, that's a pretty big problem to, make sure that you get it right. Because if you don't get it right, this is gonna cause significant security challenges in the org. Yeah. I a 100%. Like and I think, you know, just a double clicking that, like, again, like, the only way to get it right, and I'll start with this background, is, Yeah. like, you have to before we build because, like, you just don't know what happened as part of that process. Like, it's such such a difficult task. This is where that that roll forward concept comes into play. By the way, I've tried to kill a term roll forward more times than I count. Like, I was in the room when we wipe ordered this, and, like, we just threw it out there, but it stuck because so many customers have said it back to us when we're describing this problem. So, hopefully, it makes sense. As much as I've tried to kill it, we're still talking about, quote, unquote, roll forward because it does such logically make sense. Right? You're rebuilding, then you're rolling forward back to these time periods that's out there. So, Vijay, I think, I'll show up maybe a couple of more more after state, diagrams here for the folks in the call to understand. Like, anything else top of mind that that you wanna make sure we cover here? Oh, No. No. I think I think so far so good. Like, we'll just show the after state and then, you know, show how it works. That's the super. awesome it. thing. Alright. Let me see if I can get, man, I'm so used to Zoom these days. Let me see if I can get sharing screen work in here again, and we will jump back on with Vijay for some questions at the end. So definitely do not hesitate to throw those out here, folks. 100% worth calling out there again. But, we're back to our a good old human hands machine speed screen. Where we left off is you're having to rebuild. So the incident response from from patient zero, you have your compromised detected back here. If you remember my example from this holding company with December, you can see that highlighted here because we stole that that timeline directly from them. But, But, formally, what you're doing during this rebuild is you're rewinding all these changes. Right? You're going backwards in time, hence, the the batch of the future theme here that you've seen, which I think is still hilarious. We'll go back in time, undo all of these changes that are part of your IDP system day in, day out, and you have to do everything again. Like, I can't stress this enough because you don't understand what happened. And this is the challenge that we have. You know, now that I'm at this rebuild point, I've removed this the the fracture from your environment. I'm, quote, unquote, clean. But now all these other changes are are out of the system. And this is really where this roll forward concept comes in, and I think it's so so useful for our customers because it gives them the ability to solve this for the first time. You're always between this rock and a hard place of, like, I know I have to rebuild. It's going to suck. It's gonna cause so much headaches, so many problems, but, like, I have to do it. Now I wanna give everybody the the easy button around here as well. So how does Rubrik kind of help solve this? First conversation piece that I always have to bring up is you no matter what, you can't forget about our good old friend, ransomware and malware. I think the CrowdStrike stat today is eighty two percent of attacks don't have malware, don't have ransomware, but that extra 20% that do are, like, massively impactful. So many headlines that you see on this have that in place, and you have to take that into account, especially when it comes to active directory and the Windows based architecture around how do I ensure that I'm not reinventing or re, reinstalling the smaller, causing a Groundhog Day situation where I rebuild and I'm reinfected all the good stuff. So very first thing we always do is automatically scan every single of your domain killers for indicators of compromise. When you've partnered with Mandiant or Google Threat Intelligence as they're called now, Their entire threat intelligence feed is built into our system. And as this very fancy, diagram shows, every single one of your DCs are gonna get scanned across the board for those images. And it's really important we think about things like SysVol. Right? If I'm a threat actor, I'm dropping a ransomware payload in SysVol and having that automatically replicated across your entire DC landscape and having it detonated once. Like, I wanna be able to find that as part of part of your process. So very first step, automatically scan for those 1,100,000 indicators compromised and be able to say, you know, hey. On your media DC, at this point in time, I can see that this rain somewhere was detected in your environment. Let me quarantine that. Let me make sure I'm not reinfecting your environment. Because no matter how granular we get as part of our recovery mechanism, we're rebuilding, there are small pieces of the environment that are gonna be called folder basic, potentially have these threats. We're also gonna have a a piece of that analogy that we call, threat hunting. I shouldn't say we call it. Like, generally, it is threat hunting, where if there is a unknown IOC, I can plug that into the system as well. The cool piece there is pure speed. I can scan every single one of your Domingue dollars, I think, 70,000 copies, something along those lines, tens of thousands of copies of it, across the timeline. So so call today, in this example, minus thirty six days ago. I will scan all those in less than a minute and say, here's a previously unknown piece of of malware, some indicator compromise that maybe it's never seen before. It's unique to your environment. Let me identify that as well. So both those options are in place. So this gives you the ability to, you know, get past that 150 page document from Microsoft. You're doing this three step installation wizard. We're doing it as quickly as possible. Like, think of this as dead simple as as you can expect. Our assumption needs to be, like, if you're an identity SME and you know Active Directory, you have to assume that whoever is doing this IR has no idea. Maybe you're on vacation. Maybe your entire team is an off-site. This needs to be so easy that I you know, one thing I always tell Vijay is that my dad needs to be able to do this. My dad worked in construction his entire life. He has no idea what active directory is, but we need to make this as simple as possible. So step one, identify the malware. Step two, give you the ability to start this rebuild process, especially when it comes to Windows in a way that is dead simple without introducing that that malware to your environment. And then step three here is what I think of as this identity drift analysis. So you have, you know, back in December, now you have January. What were those changes that were were part of your process? So day in and day out, I am preemptively logging every single change within your environment across AD, Entra, and Okta. Those live changes as they're happening is being stored in the Rubik system in a mutable log. A lot of goodness around this. As you can imagine, seeing this real time activity allows us to get on so many different paths. But for me, the most important piece is that I know every single change that I'm about to undo in your environment. I know the compromise point. I know the rebuild point. Here's a list of all those changes within the environment. Once I have that in place, the other big piece is, how do I classify those? How do I know what's good? How do I know what's bad? And the way I think about this is I wanna look at your identity supply chain. What are all the other systems that you use that feed into AD or that AD feeds into that tells you these deep these different pieces of intelligence? So from a all the bad guy perspective, Microsoft Crouch or Microsoft Defender, CrowdStrike Falcon, all these tools that find these indicators to compromise, help you find patient zero. Let me ingest those into the system. So easy example, if they say, you know, Drew is trying to do some kind of Kerberos ing attack, I probably should ignore every change Drew made in the system. I don't wanna bring those back. And all that upstream intelligence are coming from these world class tools like Couch like, like Defender. And then on the same side, we have Workday, SailPoint, your IGA, your HR record, management tools. Like, these are what is authorized. Drew was onboard into the system. I can see that change in Workday. I can see that flowing down to SailPoint or to your IGA, and all that intelligence could we go and say, like, these are authorized changes. So it's not just here's these 250,000 changes. Here's the ones that we know are safe. Here's the one that are authorized, that follow a known pattern, that are nothing that we were brought from a threat perspective. Then here's the ones that, oh, like, I definitely need to ignore these. These are clearly indicators of compromise. I want to ignore these. I wanna go through a fine tooth comb. Let me bring those back at a later date once I'm more confident. That way, I can go from this rebuild point and basically roll it forward. Right? Bring it back to the to the to the to the today state. So not only you're current, you're clean and current, as one of my good friends, Patrick, says. So I'll stop here again. I have Vijay jump back up on stage. Vijay, my friend. And to find the button. There we go. I'm here. Alright. So we've talked about the problem statement. We talked about some of the things. back and forth. We've talked about how do we solve it. You know? So you're way past your day one. We've been in many rooms since we talked. What have been some of the conversations you've seen with customers around, like, how they would actually use this and why it's so important to have those, those supply. chain resupply chain tools part of this equation. Yeah. A lot of great questions coming up in the chat, so it's awesome. I I think, like so, Drew, like, you you hit you explained the problem so beautifully. It's it's because today, your source of truth like, the goal of the IDP is to be your source of truth for all of your identity data across your stack. However, we know, you know, sometimes that's not the case because you might have an IGA system. You might have, you know, an HR system that writes directly into AD but not be integrated with your cloud IDPs. We know that identity is fragmented, and so we know that the security stack is broader than just your IDP. So our goal is, like, you know, we're trying to figure out how do we bring all of the signals together to help with the malicious and, like, legitimate, classification because that takes away the the the the the manual labor and brings the context because reconciliation was always never a data problem. It was a context problem. So now you have all of the context in one place, and now you can use that context to kind of rebuild your identity, which is which is very, very cool. Context is keen. Like, Yeah. as trouble as I give Gartner, they have this amazing term called IVIP, you know, identity visibility and intelligence platform. And I I love it because it does a great way of describing that problem statement. Like, there's so much that goes into identity these days. Like, Yes. on the surface, you know, maybe you take your your your executive who's never thought about identity. He's gonna think about AD. He's gonna think about ENTRE, like, not thinking about the thousand other puzzle pieces that go with it. And that's what makes this so hard and why it's. so challenging for our customers to get back up into it because, I I mean, a lot of time, like, oh, like, walk me through what your response plan is, and we'll help customers update those. Like, oh, no. We're good. Like, I can do this in in twenty minutes and we're upset racist. I'm like, that's awesome. Like, you're the only person in the world I've ever heard do it. Like, tell me more. Yes. Right? Then we work. Yeah. We we double click into it. Like, oh, like, I'd never even thought about that. What about this other. thing? It becomes this this tedious task that, you know, people have always forgotten about. You know, especially if I think about this in the larger Rubik context, all the lessons learned we've had as, like, this cyber resilience incident response recovery company, like, it hadn't made its way into the identity space, and. it's still trickling down across the board. So it's been a lot of fun, a lot of education, and and driving it from there. And this this mind shift change is what is so important and unique because we need to evolve from thinking about it as backup and recovery and start thinking about it as your identity resilience. And what we mean by identity resilience is you have to recover at machine speed, you have to eliminate persistence, and you have to rebuild to clean and current. And, like, you know, this was never possible before, but now it's actually possible. And now this involves, like, peep like, in many of the conversations, do we ask the question, how has your conversations been with customers? Like, people are like, oh, really? Is this even possible? Like, I didn't even know. And now it's like the shift in thinking, which I think, like, as more and more customers are aware of it, as more and more customers try it, it's gonna the the, you know, we we really are excited about how customers are gonna see value from this. Yeah. A 100%. Speaking of some of those questions you mentioned earlier, I'll just read through those as well. Like, first of all, appreciate all the question, folks. I'll I'll try to tackle. as a. maybe, a grouping. And I know Vijay was responding as well. You know, how does this work with with Workday, and how does this work with SailPoint? Actually, you know what? This is a good time. Like, let me pull up the demo, and I will show. you. I know. Yeah. I totally forgot about that part. Like, the the most fun here. So let me let me pull it up real quick, and I'll try to answer some of these questions as we go. So, if you haven't seen it yet, this is the instant response dashboard. This is the the landing piece in the the Rubrik identity world. I always like to scroll down to this view. It's my own personal favorite because it shows all of that activity that we're ingesting day in, day out, second by second as is happening real time. You know, in this case, it's just a subset of those changes, but you can see all these different information in your environment. It's a lab ecosystem, so we got these nice pretty graphs that show off. You know, real world, they're probably looks a little different. But the question isn't, can you take this information? Can you lock it? It's what do you do with that? So during a re rolled insert response, you know, the way you would start this process is, you know, usually, you're starting with active directory. This is your source of truth. It's what entry relies on. It's the heart of the solution. And, you know, you can go through and and start this recovery process. And what you'll see now is this this, this new clean recovery tab to where instead of just going through the ADFR process, I wanna bring in all these recover, classification pieces as well. So recover the force. Classify all the changes. So if you said recover the thirty days ago on the back end, we're starting that diff that says, here's all those changes. Here's the classification. I think it was Eric who asked the question, how does Workday come into play? Workday is how we start doing that classification, and I'll show you that here in a second. And then from there, it's going through and just, kicking off the process. I won't necessarily go through this this little wizard. You know? It's basically doing the the process. You know? Actually, you know, we can blow through here quickly. I wanna go through and do a recover of the clean snapshots. So this is things that don't have the ransomware in place. I'm automatically scanning around that because I've preselected that. I'll go through and say, is the snapshot they chose, is it clean or not? And if it's not, we throw a nice little warning message. I'll go through and say, do I wanna recover just the DCs? Do I wanna go through and promote host, which is key when it comes to reworld and, like, you're doing a larger rebuild, and I can bring back the entire ecosystem. So once, in this case, I'll just do recover DCs. Tell me where I wanna go to pick the host and what kind of off the races. You go through, start the rebuild process, and then then the next piece here is the the, the roll forward piece. In this case, the screen is all, already set up. So I kicked off the AD Force recovery, but now what I've done is done that diff on the back end. So if I gone through, I can see the the domain that I'm restoring. I'm looking at the points in time here. In this case, it was just a couple hours. So what were all the changes that happened within that ecosystem? So I have all these changes that are ready to roll forward. These are things that we've marked as good. And and where is our source of truth at? In this case, it's SailPoint. So I have the integration with SailPoint. I'm looking at the activity on that side. I'm looking at what that system is doing day in, day out. If the change came from SailPoint, I can classify it as a good source. So I can dive into the weeds here and look at all the changes that are happening, see each and every minute detail here. So I can see that there's some, GitHub user group and look like market here was removed from it. Great. I can bring that back. But I also wanna look at things that I'm not sure of. You know, I don't wanna give you an overconfidence as part of this process or not, or probably just as important, like, is there something to be suspicious of? What defines suspicious? Oh, in this case, the source of truth was Microsoft Defender. Microsoft flagged something. There's a known TTP that is happening on this IT admin account. Let me look at these changes as part of the process. Okay. Great. It's potentially compromised user, created a different target account. Okay. I need to look at that now. I don't wanna I don't wanna bring that target account, into the ecosystem because it's potentially compromised. So it just gives you the ability to look at every single changes and group them together. So in this case, instead of going through and worrying about, you know, what was it, twenty twenty two hundred changes, I can very, very, easily say these are the areas I want to look at more specifically. And in this case, I actually don't have the the Workday innovation, enabled yet kind of by design, but I can see this Workday service account. But I don't know if this is actually coming from Workday or not. I know it's named Workday. Right? I can probably say it's a good indicator that this is a known service account, but because I don't have the integration enabled, I can't definitely say this was actually done within the Workday system. So let me go through that with a little bit more of a fine tooth comb. I can go through and say, you know, this is my account. These look all pretty pretty straightforward. I don't have to worry about all of them. I can then mark them for a roll forward and clean it in that process. So instead of having to look at those changes, these are all ready to bring back as part of your system. Once that's in place, all you have to do is start this different roll forward process, and I'll go through and say, I'm ignoring these things I don't know. I don't have anything suspicious, but I do have all these legitimate changes part of the process, and I'll start bringing those back individually throughout the process as it goes. So, hopefully, that gives you guys a, a decent understanding of what that looks like. The goal there is try to make it as simple as possible, but also understand that there are upstream data sources that we wanna look at throughout this process. Vijay, maybe yeah. You're already on top of it. I haven't had a change. to mind with that. Any last minute questions that we think, we should cover here? No. I think there was a lot of questions around the integrations and how it works, so I answered them in the chat. There was one question around the limitations on IDPs that you integrate with. I was not sure on the context of the question. Like, maybe, I see Lee, on having the question. So if if you wanna share some more detail on the question, we can definitely take a crack at answering it. But, yeah, apart from that, I think we've covered all of the questions. Yeah. I I would say too, like Oh, yes. Got it. I think there's a good context in the chat. So right now, our IDPs, that we cover are, intra, Okta, and active directory. That's the current, coverage that we have on the IDPs. And then, you know, with our road map, we will expand to other IDPs like ping or IDRA and things like that. Yeah. And one thing I'll I'll say around that as well is, you know, say you have some kind of homegrown solution that you created this custom web portal that customers can go and do, like, where the interactions are, you know, almost exclusive that's gonna be tied to some kind of service account. So part of what we do from a workflow perspective is it gives the ability to say that, like, you know, widget a, toolset, service account, like, those are good. Like, I wanna pre authorize those as well. So we try to classify everything as much as possible. There's a plethora plethora of filtering options you guys can customize for your environments for those workloads. You know, at the end of the day, every IDP is gonna be slightly different. Like, we're never gonna have a perfect solution. There has to be some customization that you guys can build into that flow as well. Love it. Well, I think, hopefully, you give everybody a couple of minutes back. I know Ed was sharing a couple of links for you. I think the main one is to the Rubric website. There's a lot of good details out there. If you have any questions, reach out to your account talent team. Reach out to me or Vijay directly. We're always happy to jump on and have these conversations. Generally appreciate everybody's time, especially middle of the week when we're all kind of pushing back that that hump day and getting towards it. So, hopefully, everybody has a good rest of your day, and we'll talk soon, hopefully. Thanks, everybody. Thank you so much.