Name: The Rubrik Roundup
Uploaded: 2026-11-04T18:18:06.575Z
Duration: 1 h 1 min 28 s
Description: The Rubrik Roundup

Transcript for "The Rubrik Roundup": Hey, everyone. Welcome to the Rubrik Roundup. I'm Justin Rees. I run product marketing here at Rubrik for on premises data protection and unstructured data. If you've been to one of these before, welcome back and you know the drill. If not, here's the deal. Once per quarter, we walk you through what's new, what shipped, why you should care, and more importantly, how you'd actually, use these new things. We do have our technical marketing team on the call live, to help with the chat. So if you have any questions at any point, please feel free to drop those in and and they'll respond. Alright. So let's dive in. Before we go too deep into what's new, I thought I'd give you a quick kinda level set on the platform. And so you've probably heard this one or maybe you've said it yourself. We have data protection, so we're fine. And that makes sense. For a long time, that was enough. That's not the world that we're in now. Attackers go after backups first, or they come in through the identity systems. And, of course, now there's AI in the mix, which touch real systems. So having a copy, that's not enough anymore. And so the real question is, can you get back to clean state and how fast? And that's what Rubrik Security Cloud is built for. And I think it really comes down to these four things. First, data protection. Immutable and air gapped backups, so your copy is actually there when you need it, cyber recovery, finding the clean point and getting back fast, identity security, because if AD, ENTRE, or Okta is down, I mean, nothing else really counts. And, of course, AI protecting it and using it to make all of this faster. And so everything you see today maps back to one of these four. Same platform, same console. You're not bolting on another tool. And so here's how today will go. Avanash will kick things off, for us on enterprise data protection, then Samya on unstructured data, and then we'll take you through through some AI and SaaS updates before Shweta gets into identity. And then we'll talk about cloud. And then, of course, Brian on the technical marketing team, will do a live kinda walk through for us to show some of these things, live and in use. Alright. With that, enough from me, let's get into the fun part. What's new? I'll pass it to Avinash to take it away. Hello, everyone. Welcome, and thanks for joining us today. My name is Avinash Agunwal, and I'm the product marketing manager for enterprise data protection at Rubrik. And in next few minutes, we're gonna talk about some of the latest and greatest features that we have come up with on the enterprise data protection site, something a lot of you are living and breathing every day. So let's get started. Alright. Let's get started with databases. So the first one is MySQL databases, for which we launched the native support earlier this year. And now we are bringing high availability for MySQL databases, because failovers happen, and your backup is something that should not break. So Rubrik now protects MySQL high availability pairs as a single workload. So in case there is a failover, you can continue your backup chain continues. And you can also run backups from the standby node, and that's straight from your Rubrik security cloud. As a result, the failover approved backups, the faster production, and complete etching coverage is something that you get out of this. And this feature is not generally available for you. So if you want to utilize this, you can use it for your MySQL databases. So next up, let's talk about the virtualized environment as many of you are modernizing your hypervisors or already running multiple hypervisor platforms. And Rubrik has been making continuous efforts and investment toward, enhancing the cyber resilience for your virtualized environment. And the first one in that list today is the cloud integration and export to Azure local ARC VM for Azure local environment. So Rubrik now maps your Azure local VMs to their Azure local identity. And now you can recover them directly as Azure local RFPMs and not plain Hyper VMs. So... And also the recovered VMs land in the right resource group and network, and they are all manageable from Azure portal. So as a result, you get Azure native recovery in which the VMs return as RFPM, as I said, and not, Hyper VVMs. You are instantly portal ready, and, also, there is no extra licenses required. So this particular feature for Azure local is currently available for our customers. So if you are interested enabling this, you can reach out to your Rubrik account team, and they can definitely help you out with enabling this feature from your Azure local environment. So the next one is the cyber recovery feature for hypervisors. So we are bringing all the goodness of cyber recovery feature for Hyper V and Azure local so that you can build your recovery plans well in advance before the attack. And with this, you will be able to find the clean snapshot with threat analytics capabilities and validate in a clean room before restoring the VMs in the right order. So in terms of the benefits, I think you will be able to get the detection flow state into the recovery with one workflow. You'll be able to recover an order, and you'll be only able to recover what's verified and that's clean. You can reach out to your account team in case you want to have it enabled for your HyperZone environment. And for Azure local, we are coming soon with this feature. Additionally, if you are gonna attend or if you are planning to attend the Microsoft Ignite event next week, then feel free to visit the Rubrik booth over there so that you can speak with the Rubrik expert. They can definitely help you understand more about these features and how Rubrik protects Hyper V and Azure local environments today. So the last in the list is, Proxmox virtualized environment. We have added a bunch of features to help you enhance the cyber resilience for your Proxmox environment. So we have added two things. The first, threat analytics. So it has anomaly detection that helps you spot the anomalies and ransomware activity in your backups. We have threat hunting and monitoring to look out for the known threats, and then you have sensitive data discovery that shows what data in your environment is at risk. In addition, we have also added a flexible recovery options for you. So you have the file level recovery available now. So you can restore individual files, and you do not need to restore the entire VMs in that case. So all of these features are now available for Proxmox. So you can definitely avail and utilize these features in your day to day, and these are now available for your consumption. So that brings us to the end of the updates for enterprise data protection. Stay tuned and keep watching this space for more updates. Thank you. Now let's hear the next set of updates from the next speaker. Hi, everyone. I'm Soumya Sani. I lead product marketing for unstructured data here at Rubrik. Today, I'll walk you through four updates built around one idea, keeping your unstructured data protected and making sure you can recover it when it matters the most. As you listen, keep one question in mind. If a cyber event hit your NAS tonight, how long would the recovery take? Let's start. First, Rubrik hosted protection for on prem unstructured data. Let's start with the problem. Your business depends on data like medical scans, engineering designs, and AI datasets. It is costly and hard to recreate. If it is lost or locked by ransomware, the applications that use it stop. To protect it on prem, you have to buy, rack, and maintain backup storage. And with AI driving demand, that equipment is now costly and slow to get. This offering is built on our NAS cloud direct service, and it takes that burden off your team. Rubrik runs the storage, the capacity, and the updates. Your security team manages policy and recovery in Rubrik Security Cloud or RSC without managing the systems underneath. Lightweight software components, data movers installed on-site connect customers' NAS to Rubrik's cloud. So there are no bulky backup servers or large appliances to install on prem. Every backup goes to a Rubrik hosted vault. It is isolated on a separate Rubrik identity domain and protected by retention lock. So production admin credentials can't reach it or delete it. One policy covers NAS from different vendors. You can recover to a different area, to cloud storage, or to an isolated recovery environment where you can test recovery safely, and ransomware detection runs on every backup. Threat hunting across your backup history helps you find a safe recovery point. The result, less to manage and a stronger recovery. Second, copy and migrate. Moving file data is hard. It often means scripts, manual work, and a lot of watching. Copy and migrate makes it simpler. It is policy driven engine that syncs file and object data from your source to a target, and you manage it all in RSC. You can move NAS data to a new platform, a second site, or cloud storage, and prediction stays with it. Destination policies are applied right in the RSC. You create a copy schedule, pick a target, and assign it to your shares. Schedules can run hourly, daily, weekly, or monthly. The first run copies everything in parallel batches, so large datasets move quickly. After that, only the changes follow, so the target stays up to date. Use it to refresh hardware, copy to the new platform, Cut over once it's caught up and pause the schedule. One thing to keep in mind, this is a one way copy with no versions. It is not a backup. If a file is deleted at the source, it is deleted at the destination on the next run. Run. Third, NCD offline recovery. Here's a hard situation. Ransomware or a network cut leaves you unable to reach RSC. Normally, a restore depends on RSC, which holds your index and configuration. So you can't start a restore even though your backup data is in your own storage. Offline recovery is your last resort restore path. It prepares for that day ahead of time. You give Rubrik an offline recovery target, such as an s three bucket. A small copy of your index and configuration syncs to it. After the first sync, only changes move. There's no extra full backup and no second copy of your data. If you lose connection to RSC, you boot the NCD VM you already run into offline mode from the VM console. There is nothing new to deploy. You enter your target details, and the VM reads your index, configuration, and restores to your source storage. When RSC is back, you exit offline mode and backups resume. Three things to know. First, set it up ahead of time because the first full sync must finish before anything is recoverable. Second, it is recovery only, and offline mode pauses backup on that VM. So treat it as a break glass option. Third, your recovery point can be up to twelve hours. Client side encryption is not supported, and keep your target somewhere that would not fail with your main environment. Last, sensitive data discovery anywhere. Many teams can't say where sensitive data sits on their file shares. Until now, discovery on Nasdaq Direct needed backups in Rubrik Cloud Vault and a first full backup within fourteen days. Sensitive data discovery anywhere removes that. It scans your NFS, SMB, and generic s three sources directly from your data mover VMs with no backup needed to help you meet data privacy requirements. It runs as its own job with one scan task per share on a schedule you set. Only the data types you assign are scanned. File content stays on your VM. LSE stores file names, file paths, and results. You see findings in object inventory and reports, and you can add data movers to scale out. Then you can apply the protection policies, retention lock, and legal hold to your critical data, which helps with audit and compliance. Scans add reload, so schedule them for off hours. This is an invite only preview for the enterprise edition customers. Those are the four updates. Together, they give you more ways to build cyber resilience for your unstructured data. Thank you for listening. And with that, let me turn it over to the next speaker. Hi. I'm Damien Lim, product marketing for SaaS and AI at Rubrik, and I'll be covering what's new in AI resilience. Let's start with how we help you find the attack paths in your code before attackers do and how you can simply ask Rubrik, the topics I'm be covering today. So your scanners read one file at a time. Attackers don't. So how do you find what they'll find first? So meet Rubrik Code Guardian. It redeems an air gapped copy of your repository, pairing Anthropic's mythos with a custom rubric harness. It finds multistep attack chains and ranks them by business impact. Think like your attacker. It reasons across files, services, authentication paths, and chains minor bugs into real takeover paths. Trust the findings. Chains are ranked by exploitability, blast radius, and business criticality, so your team sees less noise and zero production risk because it scans an air gap copy, never live repo, and find that chain vulnerabilities that single file scanners miss. Know what to fix first, backed by validated attack paths and harden the code from GitHub or Azure DevOps without granting live access. Rubrik Code Guardian, now available in private preview. Attack your code before attackers do. Your team runs AI agents everywhere. So why does every Rubrik question still mean another console? Meet Rubrik Ai, the industry's most comprehensive cyber resilience agent built right into Rubrik Security Cloud. It discovers, reasons, acts across your data, identity, and applications. And Rubrik MCP plugs into the agents you already run straight into Rubrik Security Cloud. Real answers from your live data, about 2,000 Rubrik operations your agents find on their own, and nothing changes without your approval. A failed backup, diagnose and fix on your say so. A Microsoft three sixty five recovery plan for your most critical users in seconds. Your SOC agent needs the last clean recovery point. You just need to ask. One in three Rubrik customers worldwide already use Rubrik AI. And in its first week of MCP preview, one global bank made 856 distinct API calls. Rubrik AI and Rubrik MCP are generally available now, So stop switching consoles and start asking Rubrik. And now let's move to SaaS resilience. Your business runs on apps like Microsoft three sixty five. So here's how we get your critical teams back first in hours, not weeks, so anyone can back up Microsoft three sixty five. Getting the business running again is the hard part because no one knows what to restore first. Autonomous business recovery with Rubrik AI is the first AI agent that recovers your business, not just your data, so stop guessing. It finds the people and data your business runs on, builds a recovery blueprint, and shows whether you will, hit your RTO before an incident. Approve the plan, and your minimum viable business is back in hours, not weeks. And you know what to restore first. Hours of manual triage become a plan at machine speed. And critical teams are back in hours in... Inside your Microsoft API limits. And that holds for a major outage, API throttling, or even rogue agent damage. It is now limited availability today. And with that, let me turn it over to the next speaker. Hey, everyone. I'm Shweta, senior associate PMM for identity here at Rubrik. During our last Rubrik roundup, you told us that the number one thing you'd like to hear more about was identity. You asked, and we listened. The entire Rubrik team has been hard at work building new features for identity resilience. And today, I'm super excited to walk you through what's new. We'll unpack a new approach to identity recovery that can cut your RTO by up to 56, reveal how you can quickly recover clean and current without losing wanted business progress, and you'll also learn how protection for Entre ID and Okta just leveled up. Enter IFR or identity first recovery. IFR extracts the n t d s dot dit file or the database of AD objects, SysML data, which is policies and scripts, and AD integrated DNS so they're not tied to the underlying OS. Then Rubrik introduces these into a clean Windows instance. This includes portability across on prem, hypervisors, and cloud. So IFR excludes OS binaries and registry hides, and you get a clean slate on which to recover, all of which minimizes the risk of reintroducing threats. IFR also accelerates ADFR or active directory forest recovery. Moving a roughly two GB identity database instead of a 60 GB system image means less data to transfer and a faster path to recovery. In other words, IFR recovers just the directory and not the whole machine. In our internal testing, IFR cut recovery times by up to 56% for active directory database sizes of around 500 MB. So malware scanning is critical to recover information in the data layer and threat monitoring is designed for that as we've seen. But identity is especially hard to recover because it changes constantly, and EDR tools aren't built to protect it. We've seen how and why you should recover quickly with IFR. But now there's a paradox. You've recovered clean, but it's a stale snapshot, and you've wiped your most recent legitimate IDP changes, like new users, deactivated accounts, and DNS record updates. Rebuilding them means days of manual reconciliation while the business stays down. If you've been following our rubric roundups, you may remember that we had earlier talked about our roll forward capability. I'm happy to announce that roll forward for active directory and Entre ID is available today. So how does roll forward work? First, you identify a clean baseline and recover to it so that you evict attackers. Rubrik generates a diff table to compare the clean versus current state so that you can identify every user, group, and permission that changed. Rubrik labels them as safe, unclassified, or harmful with context from the identity intelligence fabric. The identity intelligence fabric is a quick way to reconcile context from ITDR tools such as CrowdStrike Next Gen Identity Security and Microsoft Defender for Identity, IGA tools like SailPoint or HRIS tools like Workday with IDP changes to reconcile context from these tools with IDP changes. This way, SOC and IAM teams don't need to manually cross reference tickets and spreadsheets to understand which changes were legitimate. Today, our ITDR integrations are generally available, as well as a SailPoint integration for IGA and a Workday integration for HRIS. By bringing SailPoint's comprehensive access and governance capabilities and Workday's authoritative employee life cycle data directly into the fabric, we bridge a critical visibility gap. These key integrations allow teams to validate whether an identity change is legitimate based on trusted sources of truth. These integrations don't just accelerate workflows and drastically slash your RTO. They deliver the definitive context you need to avoid the chaos of endless tabs and stale spreadsheets. Going back to roll forward, after you've recovered to a clean state and reconciled wanted changes with the identity intelligence fabric, teams can then triage changes and select specific changes to reapply. Rubrik pushes them live. With roll forward, the directory reflects the current state of the business instead of a stale snapshot. Crucially, you evict attackers and keep wanted IDP changes, preserving months of work. Moving on to Entre ID. Rubrik already protects and recovers a wide range of Entre ID objects. We've expanded Entre ID protection to help organizations protect governance devices and recover cleanly to a new tenant. First, let's talk about governance. So in Entre ID, access packages, device policies, and conditional access policies are typically hard deleted with no native rollback. This means that recovery is your only option. With this new launch, we have expanded protection and recovery of Entra ID governance objects, specifically access packages with their assignment policies and roll scopes, catalogs, access review definitions, and PIM settings. All EntraID governance objects can be recovered during a full tenant or granular recovery, enabling enterprises to restore the governance configuration automatically instead of by hand. Next, Intune policies protect the health and access constraints of endpoints. If device compliance policies are wiped, attackers get an easy way to maintain persistence. That's why we expanded Entre ID Protection to secure and recover 17 Intune object types spanning compliance, configuration, endpoint security, Intune admin roles, and more. Recovery covers policy properties with assignments and dependencies and gives customers a choice to overwrite, merge, or skip when conflicts arise. Finally, cross tenant recovery or CTR is critical in managing worst case scenarios like an attacker getting control of a global admin account. Rubrik cross tenant recovery restores on try the objects from a compromised tenant into a separate clean tenant, including users, groups, conditional access policies, and administrative units. It reestablishes relationships till a minimum viable business tenant comes up whole rather than as a collection of orphaned objects. Rubrik fully orchestrates CTR. Restoring identities, governance, and Intune policies from a single platform means identities come back with the right privileges, devices come back on a known good baseline, and guardrails stay intact. And last but definitely not least, let's move on to Okta. We already protect Okta tenants, backing up users, groups, applications, and policies, and providing point in time recovery for them all in a logically air gapped environment. Given Okta's value, we're deepening this protection. First, Okta life cycle management or LCM provisions identities from Okta into downstream SaaS apps. It depends on the set of configurations most teams don't protect. Provisioning settings, push group mappings, profile mappings, group rules, and event and inline hooks that drive life cycle management capabilities. Additionally, if an Okta workflow, such as a JML workflow or child flow is compromised, accidentally changed, or deleted, Rubrik lets organizations restore it to its last known good states. Next, similar to Entre ID, Rubrik will now offer cross tenant recovery for Okta. During a full tenant compromise, this lets teams stand up a minimum viable tenant and keep managing the incident. Rubrik helps customers reconstruct identities and application settings between a preview and production organization, as well as test identities in a preview org. And finally, remember that most enterprises source identities from active directory and sync them into Okta. Recovering Okta while active directory is compromised, brings attackers back, and breaks automation. That's why Rubrik will now treat Okta and active directory as one system, not two silos. This means that customers can recover Okta with the backing of a fully synced active directory. All this helps customers accelerate incident response, hit RTO targets, and minimize operational downtime, all from a single platform platform that helps you reduce tool sprawl and TCO. Thank you all for sticking with me, and I hope you enjoyed listening to this update as much as I enjoyed delivering it to you. And now I'll pass it to our next speaker. Hi, everyone. I'm Anurad Dubey, and I lead product marketing for cloud data protection solutions here at Rubrik. And today, I'll walk you through what we have launched in cloud this past quarter. But but first, broadly, every AI initiative today runs on your cloud, resting on three interconnected layers. The code that builds everything, the data models learned from, and the application that delivered the AI outcome. Lose one and the AI on top goes with it. Yet, most of this foundation today relies on a patchwork of native features and point tools for production, while cloud focused attacks keep climbing up. Availability, unfortunately, is not resilience, and you need recovery you can prove across all three, protect the code, secure the data, and recover the application so you can power your AI with confidence. Here's a quick view. On code, we've expanded our DevOps protection beyond just repositories. On data, we are now protecting your AI data foundation. That is Apache Iceberg on AWS and Google BigQuery. And on applications, we continue to expand our coverage with the new Azure PostgreSQL flexible server coming out for Azure cloud. Everything I'll cover today is generally available. And, with that, let's start with code. Most teams think of DevOps production as repositories first, but code is only one link in the chain. Plans live in work items and issues, decisions in pull requests, knowledge in wikis, guardrails in the settings. Lose those, and engineers lose the context to rebuild even if the code survives. Native version history only covers the repos and sits in the same security domain as the data. So it isn't really a true backup, and it leaves the rest of the workflow completely exposed. That's why Rubrik DevOps Protection now covers the the whole workflow beyond repos and pipeline. You back up Azure boards, work items, wikis, and organization settings in Azure DevOps and issues and pull requests in GitHub, all under the same SSA policy engine with immutable and air gap backups. Coverage is expanding progressively, so the customers can start protecting these, these today, and new customers get a solution that has matured alongside the teams that have been relying on it for quarters. Now moving to data. This is where the AI learns. So enterprise data has moved into low cost cloud object storage with the table layer like Apache, Iceberg, making it queryable like a database. That's the lakehouse along with the managed warehouses like BigQuery that make up this AI data foundation. But these platforms were built by data engineers or not and not backup admins or even IT ops. So protection was rarely designed here. Snapshots and time travels are merely pointers in the same account as the data, and replication copies a bad delete as faithfully as the good data. And none of it understands the table. For AI you can trust, the data underneath must be recoverable, and two upcoming launches are addressing exactly that. First, we have Apache Iceberg on AWS because this is where the business now increasingly runs. Analytics, real time pipelines, and AI training all read from these iceberg tables, and autonomous agents increasingly have read access to them directly. But an iceberg table isn't a folder or files. It's five interdependent layers. So data files, manifests, manifest lists, metadata, and the catalog pointer. Lose anyone, and the table is unquerable or functionally unrecoverable. A snapshot isn't a backup, and rebuilding is not recovering. Restore the objects, and someone still has to rewire the catalog by hand while the business waits. Rubrik Apache Iceberg Protection Now generally available is catalog aware. What it means is that it packs up the data, metadata, and catalog together for both AWS Glue and Amazon s three tables with immutable copies in your own AWS account or Rubrik cloud... Cloud Vault. It takes incremental backups of only the latest compacted snapshot, so it stays efficient even at petabyte scale. On recovery, the table comes back working and queryable and not as a piles of files, and... That you have to validate. You can also have an isolated branch recovery so that you can validate your recovery before promoting it to production. Protection works at account level, so no... So new tables are covered from day one on the same platform as the rest of your AWS estate. Next, Google BigQuery. Google BigQuery has grown from where reports used to live and into the backbone of your AI data foundation. Financial and regulatory records, customer analytics, ML training data, and the live data AI agents query. So when the data is deleted by mistake, encrypted by ransomware, or wiped by a rogue admin or an agent, the damage doesn't stay with the data team itself. Pipelines break, dashboards go dark, and model and agents answer from a missing or corrupted data. And BigQuery's native tools leave real gaps. Time travel reaches back seven days at most and covers tables only, not used or retained. Snapshots are manual with no SLA policy. And because everything lives in the same project as production, one stolen credential can take out the data and its safety nets together. That's the gap Rubrik data protection closes. Setup is agentless and it takes minutes. New datasets are protected automatically under the SLA driven policies. Backups are again immutable and air gapped and can live in your own GCS account or Rubrik with detention that isn't capped just at seven days. Recover a whole dataset including tables, views, and routines, and not just a single table. The same or different project or even a different region. And it runs on the same platform and policies at the rest of the Google Cloud estate. Finally, applications. Every application today that delivers AI outcome has a data layer underneath, and many databases are powering that today. Increasingly, Azure PostgreSQL is a critical part here. And to recover these applications, you absolutely have to recover these databases. Native backup for Azure PostgreSQL runs out of road at scale. Built in backups cap at thirty five days, and the longer term option tops out at one terabyte with weekly full backups. So Rubrik now protect Azure, Proseget SQL, flexible server, and it's generally available. It provides daily immutable backups, point in time recovery, and retention that's far beyond thirty five days for servers up to 16 terabytes. It's agentless and adds no load to your production and sits under the same SLA policy as the rest of your Azure cloud estate. So new server and... Are protected the moment they appear. So that's the quarter in cloud. Your developer workflows, your AI data foundations, and your application databases all protected. Thank you, everyone. And now we'll turn it over to the next speaker. Let's do a quick demonstration of some of the things we've talked about. My name is Brian Knudtson. I work on the tech marketing, team within... Here within Rubrik, and gonna walk through some of the stuff that that my my colleagues have presented to you so far. A lot of these all work around kind of the concept of when a cyber attack happens. There's really kinda three main questions that that you're going to ask or three definite questions you're going to ask about what happened and what got affected. Can I trust my identity, you know, the the the identities that maybe got compromised, and how fast can the business communicate and operate post the event, especially if they've they've taken out m three sixty five, your email, those kinds of things? And so what I'll do is walk through three of the the key things that we announced to you this week that, will show you how Rubrik can help you answer those things. So let's jump in with the first one, and we'll talk about the, Rubrik MCP. So this gives you the ability to, within tools like Cloud Code, which you can see here, being able to access Rubrik Security Cloud and directly query it and and be able to ask it questions. So let's say that we had a user call in, and they're they're using our Zafri application, and they reported some weird behavior. And they wanna they wanna see what's going on. So let's just ask real quick. Are there any threats or anomalies in the in the last twenty four hours? K. Let's go with that. So what's happening here is it's it's actually using the, the Rubrik MCP that I have configured to connect into, that environment and actually query and, ask the question of what's... You know, how how can we answer this. It's gonna analyze it. This this is AI. So it's it's gonna pull the raw data. It's gonna look for other clues and give me kind of a a rundown of really what's going on in the environment in the last twenty four hours. So here we already have some results. And looking at them real quick, we can see we have 37 critical anomaly events coming from anomaly detection, in the last twenty four hours. And these are high confidence, high levels of encryption. So roughly 5,000 files added, 5,000 removed, about a 100 modified in each event. So it's gonna do some analysis. It's gonna give us some information about what's going on. I can see Zafri in here in a few places. Haverford's, another part of that solution there. Another is Zaffrey. So there's definitely something potentially going on there. It's gonna give us some analysis. So it's gonna find some stuff that is going on there that may be connected. You know, it's saying it's likely a lab. In this case, that is the case, but let's pretend like it's not. And, you know, it's it's saying they can't necessarily find everything. So we're we're definitely seeing that there's something going on here, and it it warrants some additional verification. So next, let's let's dig a little bit deeper and see if I can if I can really get to the crux of things for us. So can you create a report on the Zafri and Haverford systems The most recent clean point in time is the sensitivity of the affected data. Prioritize it ties the list based on sensitivity. Okay. Let's go with that. And so, again, it's going to be querying the the Rubrik MCP that I have set up, talking to, Rubrik Security Cloud to, to answer these questions, asking me a lot of questions along the way, asking permission to do things. We have Claude tied down pretty tight, so that, you know, we have to do a lot of reviews and understand what's going on, as as we do things. And and what this is going to do is really kinda give us an answer to, what do we what do we do next? What do we need to deal with, looking at both sensitive data and anomalies to be able to cross correlate in those systems that that I identified that are important to this application, what's going on and what we need to deal with. And and that's important because, you know, just figuring out what to do next can be one of the biggest things when you get that alert that there's an anomaly happening. And since this is through an AI interface, it is possible to tie this in with with other, systems that you may have that can tie into this MCP, potentially giving a level of permission to security analysts, you know, even even some of your compliance type teams that would need to answer questions like what sensitive data was affected. Instead of them having to go in and run reports and cross correlate a bunch of different reports potentially, trying to dig around, ask a simple question and be able to get potentially a very complex answer, which in most cases, these these cyber events are, and build that report that can be easily understood by whoever needs to see it up to and including executive summaries, in in the environment. So being able to to work through this, correlate all that data is is one of those powerful things that we get with AI. Okay. Well, while this is running, I'm gonna transition over to the next part of the demo so that we can see, you know, one of one of the main things that we need to do once we kind of understand what's been affected is understanding our identity and where compromised identities may be coming into play. Okay. So jumping into our identity resilience screen, you can see there's a clean recoveries option that's now available on the screen. And as we go into that, what we'll see is a list of the clean recoveries that have occurred. These are full forced recoveries of this clearwater.com domain. We can go in and see that it was recovered successfully. We can view the tracker and see all the things that that occurred as part of this recovery, and see that not only are all the individual items completed, but so is the whole thing. Now going into this one, what we wanna do is we went back in time quite a bit, and we want to roll forward the pieces that were missing. And so here we can see that there are over 2,000 changes that occurred between the point we recovered and the most recent snapshot that we have, where ideally or most likely things are not very healthy. We we don't necessarily wanna get the bad stuff in. And one of the things we've introduced is the ability to classify some of these sources automatically is to to ease this burden of trying to figure out what's going on in those 2,100. So here we can see that we've classified some sources that are legitimate from Workday and SailPoint. These are sources of truth when it comes to identities within the organization. And so we we are going to trust anything that comes from them. We can also add IP ranges that allow us to, be able to say, hey. We know good things are gonna be coming from these IP addresses, so let's automatically mark those as legitimate. We can also look at suspicious changes and automatically mark things that come from CrowdStrike, Microsoft Defender, other tools that we integrate with that can give us alerts on these things. We can also add IOCs, that that we know will be indicative of bad things happening. So once we've got all that, it's gonna categorize these things automatically. If we look at the changes that are already marked to roll forward, we can see SailPoint is is classified up over 2,000 classifications. And so since we have these marked as as a safe space that these changes came from, we can trust those. Now if we go back to the changes to review, there's 37 of them. We can see this work day one has has a bunch of changes. If we look at the classification, we can see that they're they're safe. So clicking in here, we can look at all these changes. We can review them if we want to, or we could just select all and mark which ones we want to roll forward. So those will add to the roll forward list. And coming back to the changes to review, you could say we just have two left. So one of these came from Microsoft Defender, found IT admin, did a bunch of stuff. We can go through here. We can review what happened. Ultimately, we're not gonna trust these. So let's go back, and we'll look at these unmatched ones. These unmatched ones didn't categorize in any of those places. So these are changes that occurred from a bunch of different places, and and being able to review these one by one. Only 22 of them, so we can take the time to go through them. We could just say, hey. We don't know where these came from. We're going to assume that they're bad. If we need to manually recreate these changes, we can do that later. So let's go back to Clearwater. And with that, we feel pretty good about these 2,154 changes that we wanna pull in from previous backups into the domain that we just restored. So pretty easily, we can go over here and click roll forward. We could see some some of the details we just looked at. We acknowledge the fact that we may be rolling forward potentially bad things. That's that's on me as the person that's configuring that. So let's go ahead and roll forward. And now it's it's moving forward. And, it... It's reconstituting those changes is what it's doing one by one to to recreate those items. So if we want to, we can view the progress and and watch this thing proceed. But while that's running, because it's gonna take a little bit of time, what we'll do is we'll move on to the last part of our demo, which is to look at bringing back our communications channels. Our our most precious data is sitting in m three sixty five, and our most critical users need this data back quickly. And so how can we do that? Well, with with the new autonomous business recovery integrated with Rubrik AI, we can make this really, really easy. So we're gonna enter the subscription for this Rubrik demo environment. We're gonna look at the critical operations groups. Here, we can create groups, and these groups can be based on users, groups, or SharePoint sites or a combination of those that give us things like these. So let's say we created this priority one recovery group. This is our executives. We wanna make sure they've got the communication mechanisms in place because they're the ones that are gonna have to be communicating with people about what's going on. I can come in here and select create recovery plan for them. And note the the little star icon, of course, means that this is using Rubrik AI. And what we can do as as part of this, similar to what we saw with the MCP, is to be able to use natural language conversation to create these recovery plans. I've done a lot of Doctor over the years, and the... One of the toughest things is just trying to figure out what the plan needs to be. You know, what's most critical? What's the most important thing to bring back first and then coordinate that with all the other stuff that needs to come back as well? And so what it's done is it's analyzed kinda the the the users and these groups and the SharePoint sites that would be a part of this group, and it's asking me, you know, one two part question, which workloads. So let's say all three. And for number two, let's say seven days, and off it goes. And it's going to now analyze everything in that group based on these kinda two filters, if you wanna look at them that way, or these two pieces that we feel are the most important things to pull back. And, again, this is in the mindset of being able to run this plan when we say, hey. There's been an incident. We need to we need to recover quickly. We wanna recover the most important stuff first. I'll tell it to go ahead and create the recovery group. So it's gonna work on that. And then start the analysis once this group is created. Start the analysis of what needs to come back. Once that analysis is done, which it is, we now have the ability to, go in and and prompt it further. We can we can say, hey. I wanna limit it to only doing attachments that are less than one meg because I wanna get back up and faster. And if I need to restore those individually, I can do that. When this is over, we can go into the ability and do an autonomous business recovery. So this finance group already has a recovery plan built, and we can take a look at that. And as part of going through the creation of the recovery group or the recovery plan, you can look at this kind of thing. And you can say, okay. Well, this finance group has, you know, these types of things based on the criteria that we gave it. We can choose to recover everything else in the background once we've got the critical stuff up or we can leave it off for now. You know, if this is just our first of of 10 different groups we need to get up and running, we may not want to recover all the all the data immediately. So we leave that as an option. Then we can choose in place or in a new location depending on the situation, and then it gives you the the responses or the the expected returns of that. And then we can click recover, and the process would then begin at that point. So we very quickly taken the time to build that recovery plan before an incident happened. And when the incident happens, you know, essentially three steps through a wizard, and our data would start recovering, back into that existing m three sixty five environment or potentially into a whole different one if if we need to cut bait and move to a whole new one. So those are three of the things that we've talked about today. I'm gonna bring on the rest of my team here, and we... We're gonna live answer some of your, q and a questions that have come in through there. So if you have questions and you haven't put them in in the q and a panel, please do that now, and, we'll we'll dig in and try to answer as many of them as we can. Awesome. Thanks, Brian. It's always super awesome to see just how easy it is to use the platform. I think one thing that stands out is, you know, as you're going from all of these different workflows, it's all the same platform. And so I think just the ease of use is unmatched. But before we, you know, get to questions, I wanted to pull it all together real quick for for folks on the line. If there's one thread through today, it's this. Cyber resilience isn't just a backup. It's your data, it's your identities, your cloud, and now all of your AI. And all of it has to come back clean. And so if I had to pick a few to go back and, you know, rewatch, all of the offline recovery for NAS, Because to be honest with you, you know, that's the scenario nobody wants to plan for, but it... We all should. Rubrik AI, building an m three sixty five recovery plan around your most, critical people first. And all of the role can afford capabilities for identity and getting back to clean without throwing away months and months of good kinda changes. And one more thing, if the cloud section got your attention, come... Please hang out with us on November 10 at the Cloud Resilience event. It is virtual and and online. The whole thing is built around one idea. Your AI is only as good as the data beneath it, and most of that data lives in the cloud. And so if you're not a 100% sure your cloud can restore, this is the event for you. And we'll be, playing across the globe, so there's, definitely a time that works, wherever you are. So please join us. Links in the chat. Grab your spot. And if you've got a teammate who owns cloud or is interested in cloud, definitely send it their way as well. And so with that, that's all we had for you today. If you have any questions, please submit them now. And the technical marketing, folks on the call, are here to help and and we'll start to take those. And again, huge thanks to today's presenters and to the technical marketing team, you know, for keeping up with the chat. You guys are awesome. And thank you all for spending the time with us today. If you, missed anything, the replay will be, posted as well. But beyond that, we'll see you on the tenth. Bye for now. Hey, everyone. Thank you for joining another Rubrik roundup. We're so glad to see you here and attend. So we're gonna get to the questions. We have a few, that came in through, the the chat. We got those answered, and I have a few more queued up here. So I've got the technical marketing team here, who is our our specialists internally across these different, areas. Yes. So first one I saw that was, very intriguing, around Iceberg, for AWS. So, Mike Preston is our cloud specialist, on the technical marketing team. And the question is, so Iceberg has, where AWS has the ability to do snapshots, which it calls time travel. What, so, like, if someone has time travel, why would they need a backup? Yeah. That's a that's a great question. And it's important to understand, like, really what a snapshot is. And, essentially, like, a snapshot is just a pointer. Right? So when you make changes, a new snapshot gets created, and it just points to the new data. So that's what allows time travel to kinda go back and forth so quick. It can just, you know, reference those pointers or those snapshots. The biggest issue is, I mean, if somebody goes after your your AWS Glue or your S3 tables, when they purge those, they're gonna purge those snapshots right along with them. They live right along in the same identity domain. They're they're right alongside in the actual same AWS service. So, if a table goes, the snapshots of that table are gone as well. So you definitely need to get a backup outside of that account to to support, you know, recovering from that. Gotcha. So it's just the, age old snapshots versus backups, that we're all used to. Okay. Cool. Yeah. One question came in for specific to roll forward. And this is one that... It's it's still a little bit new to me. But the question is, how does roll forward understand which changes are good and which changes are bad? So I, am gonna throw this over to Kevin Johnson, who is our identity specialist. Kevin, what do you think? Yeah. That's that's that's a really good question. We get we get this all the time. So there's there's there's a whole bunch of magic that goes in with with RollForward, but, really, what we're doing is we're leaning on the identity intelligence fabric that, Shweta was talking about there. So we... And I I I I guess taking a step back. So when we do a roll forward, the first thing that we're gonna do is we're gonna identify a clean point in time. Once we've identified that clean point in time, we know we have a snapshot for that. So we have a snapshot for the point in time that we're at now. We have a snapshot for the point that we're gonna recover to, which is our clean point in time. Because Rubrik has the preemptive recovery engine, we can generate a diff of every single activity that's happened in the identity provider between those two points in time. So that gives us a potentially huge list of everything that's that's that's that's that's gone on between those two points in time. The next thing we do is we then start rooting that through the, the identity intelligence fabric, and we we can kind of start looking at, signals from things like, ITDR tools, like, CrowdStrike NextGen, Identity Security, Microsoft Defender for Identity. Those things can tell us, hey. These things are probably bad things, so we will mark them as suspicious. We also have integrations with, HRIS tools like Workday and, IGA platforms like like SailPoint, for example. So anything that's routed through those platforms is likely trustworthy. You know, it's... Unless you end up in a situation where a threat actor has has been able to get all the way into your Workday instance, in which case, yeah, you've you've you've got problems. But it... The the... This is a nice thing about this is we we kind of file those things into different buckets, and those buckets kinda help you make make a decision as to whether you're gonna take those through into your recovered environment or not. There may well be, in the testing that we've done, in almost every situation, there's there's a scenario where there's some stuff that is is neither classified as suspicious or legitimate, and that's that's kind of what you need to kind of go through manually. Now that might not sound sound great, but, you know, honestly, if we if we if we think about it, if we've got if we've got 30,000 changes that we that we need to go through and we're able to automatically classify 19 and a half thousand of them. That that leaves you with, you know, a a a much smaller number of things that you need to go through manually. But, also, these are just recommendations. So you can still go in and go, hey. Okay. Well, this thing that was marked as probably legitimate, we can mark that as suspicious and vice versa. But, ultimately, all we do is we map the map the stuff that we're happy to carry forward. Before roll forward, we replay them back into the recovered environment. So that brings you back to you end up with a clean scenario, you've got a clean baseline, and only the legitimate stuff has been carried forward into your environment. Got you. Yeah. It seems like over the past couple of years as we focus on this as a company, the complexity of the recovery process for customers is universal. There's so much changes to Active Directory and it's something that has to be treated that is dynamic versus static. I think that's something really 100%. foundational. for everybody. Okay. Cool. So there's actually, you know, a new capability around threat hunting and threat monitoring. And the question, is asking, you know, is that the same engine, that we're using across the other workloads, for for identity specifically? Oh, yeah. Sure. So, yeah, it's it's exactly the same engine. So all of the stuff... All of the good stuff that we can do for VMware virtual machines, for Microsoft three sixty five, for data, it doesn't matter what that workload is. We're using the same engine under the hood, to do that that that that threat hunting, the threat monitoring side of things. We've just extended that to enable it for active directory as well. Gotcha. Yeah. So it seems like the biggest takeaway here is that, you know, keeping in mind the the ability to correlate, you know, this this dynamic workload is is paramount, and also that you have this on a single platform, you know, without having to add on, you know, additional components. So that's that's really great to hear. 100%. Okay. Yeah. So we're jumping over to, like, a very interesting topic, which is Azure local. This is a specific question around, of of that. So, do recovered VMs keep their Arc identity resource group and tags? So basically, the configuration as it's being restored. So Brian has paid some attention to this, in the in the past few months here and and done some deep dives. So, Brian, what's the, what's the answer to this question? Yeah. That's an easy one. Yes. That's that's the advantage of connecting that Azure account to, Rubrik's secure cloud so that you can, you know, register those virtual machines that are running locally as part of the the Azure portal so that you get that full access as if they were Azure VMs. When restoring a virtual machine from a backup, you get the choice if you want to restore as a, Hyper V VM or as a... As your local VM. As long as it knows what that is, it's backed up that information. You've connected that subscription. We can we can pull back and put it right back in the portal as as it was before. So really cool capability that was... You know, really makes it an Azure VM at that point. Gotcha. Yeah. I mean, that's a that's a really nice quality of life because as I was looking at, the update to that, I was thinking about, like, you know, if you had to recover, you know, a lot of these virtual machines, reregistering them, you know, in that particular point in time would be, something that would be a real pain. So I'm glad we added that. Licensing question. I don't know how we couldn't escape a licensing questions, but is is this any... Does this require any additional licensing, this this protection capability? Yep. No. For for simple backup recovery aspect of things, being able to do the Azure local aspect of of it and connect into the Azure portal, that's all included when when you buy a secure vault. It's when you want to do the data thread analytics or the, upcoming, orchestrated recovery pieces you need enterprise edition, in place. Yeah. Otherwise, it's it's included for the basic backup and recovery functionality. Okay. Awesome. Great to hear. So final question. This one's actually one I was asking myself, is around unstructured data. So Alpika, who is our specialist for unstructured and AI, what is NAS CD copy, and how is that different from from backups? It's quite confusing. Underneath the covers, the mechanism looks the same, but they're slightly different. Now... So copy is, like, again, like a policy driven. Like, everything that happens at Rubrik, all the backups, recoveries, or even copy, it's also policy driven. Now it is a one way sync of all your file and object data from your source to target. So your source can be your NetApp filers, and your destination could be a cloud storage. You just take the copy. Rubrik takes, your data from on prem and just copies it to your destination, which can be another on prem, another... It can be in any of the clouds. It doesn't matter. But it will maintain one to one replica of your current, source state. So if you go ahead and delete a file, you know, once you do the copy in a next run, Rubrik will also go ahead and delete the copy from your, copied version of the data in your target. Versus backup, you know, it's it's point in time snapshot. Right? So if you've deleted, a file in your current, production environment, your current snapshot will not have that file, but your previous snapshots will have the file in case you want to do a recovery. So copy is not, you know, a recovery mechanism. It's basically to move your data from source to destination. So think about if you're trying to do, any AI analytics or if you're trying to move your data from on prem, to another on prem or another cloud to cloud, you can use copy feature. Also, if you're doing a lot of test and dev analytics as well. So, you know, these are some of the typical use cases, but but don't, don't rely on copy as your backup. Right? So it will only have the current state of your data. So if your data gets encrypted, that means your data will be encrypted in your destination too. So you always need another backup, but, it's just a way of moving data. Got it. So it sounds like we're surfacing, like, one of the key strengths of NAS CloudDirect or unstructured data protection. product, which is the ability to move... Scan and move data at a very rapid pace, right, which is basically. unmatched within, any other products. So... Okay. That's really great because I know there's a lot of use cases for using unstructured data for AI, use cases, as well as just like traditional, test and dev. So that's that's really great to hear, because, you know, as technical people, we love that feature. It's fast and it's it's awesome. So... Yep. Okay. Yeah. Just wanted to mention one more thing, Jeff, that you don't need. additional infrastructure. Like Jeff mentioned, like, it's just moving the data. So, your existing, infrastructure like the backup will work as it... Like, for copy the same, mechanism works so you don't need to deploy anything more. Excellent. Love to keep that thing going on for customers. because we do not want any more baggage. Yeah. That would not be great. Okay. So, that is the end of all of our q and a. I'd like to thank everyone for joining. Appreciate all of your time, and, we will see you on the next one. See you. See you all. Thank you. Thank you.