Name: Roll Back to the Future: A First Look at Identity Roll Forward
Uploaded: 2026-10-06T09:51:05.754Z
Duration: 35 min 4 s
Description: Roll Back to the Future: A First Look at Identity Roll Forward

Transcript for "Roll Back to the Future: A First Look at Identity Roll Forward": Thanks for jumping on, everybody. We will jump into the goodness behind the covers and the backstage as the webinar calls it is my good friend, Vijay. He's gonna join me halfway through, and we'll talk more about some of the logic and some of the reasons why we built the the real forward concept that we're gonna walk through today. So we're gonna break this up into three sections. You know, first and foremost, I wanna kind of establish what am I seeing from a marketplace standpoint. You know, over the last couple of years, I've had, I don't know, well north of a thousand conversations with our customer base around this incident response problem that that folks have when it comes to, they'll call it their IDPs very generically, active directory, Microsoft Entra ID, Okta. You name it. We're seeing it across the the IDP ecosystem. And, fundamentally, where Rubik comes into place, how do I help you when this worst case scenario happens? How do I give you the ability to respond and do it in a way that won't impact the the business? And I think the cool thing of what we're gonna talk about today is that it's a new and novel approach that I haven't seen done in the marketplace. And as Vijay and I will talk about, it really became out of conversations like these with folks like you. What are you dealing with? How would you handle this reroll? What problems are you gonna run into? So, hopefully, this gives you some new insight into how you update your current incident response plan or fill in the gaps. And and probably more importantly, start thinking about a lot of these nuances that we've seen, like I said, we roll during incident responses that you'll, unfortunately, will have to think about, you know, knock on wood, I guess. You won't have to think about it sometime during your career. But, overall, I think one thing that I see change across the board is this concept of a anonymous adversary. Sorry. I say, autonomous adversary. We've seen Hugging Face. We've seen the plethora of reports from every vendor out there, OpenAI, Meta's getting on the game, Google. Everybody has some kind of rogue agent coming to place. And it's really fundamentally changed every conversation I've been, especially over the six months where, you know, if I look at this shift here, it's gone from... Here's this theory from back in February 2026. How does that work down in the area? And just overnight, we saw this become real world. Right? We've seen these agents go out in the marketplace. So it's really become this conversation of not if this happens, but when and what is the damage that's gonna be done out there. So I say this is a fun time in the marketplace, but also realistically from a defender standpoint and probably folks like you, this is very, very difficult in terms of how to adjust. So this is, like, the airline context and in how we're thinking about these these solutions across the board. When these attacks happen, there's a couple of things that that play out almost exclusively, across the board every time. And I built this identity workflow, again, based off of re roles. Like, this isn't some theory. This is what I've seen, as I'll talk about here, both in public case studies that we can reference as well as with our internal incident response team. So it plays like... Just plays out like any other attack. You have your peace time. You have your IDPs in your environment, Active Directory, Intra, Okta. Majority of the time, our customers have those three, if not some some subset of each. And every day, there's different changes throughout the ecosystem. And each and every day, it can be a a large number, but, really, the the big piece comes in play when it comes to across every single day, you have more and more changes, things that make your IDP your IDP that's happening day in and day out. And over, you you know, a couple of month time period, those really start adding up. So example we'll use here is 285,000 changes, which is, again, is based off of where we roll. You know, what we've seen across our customer base, what we would expect to see for the amount of changes, everything from, you you know, security group access to Abigail got married and she has to have a name change. Like, all those are accounted for when you think of these changes that are in your ecosystem. So peacetime is what you guys know day in, day out. War time usually starts with some kind of compromise event. It's gonna be on the weekend, gonna be at 2AM when everybody's asleep, how it happens every time. Once that detection is in place, one of the first things that always happens is you engage your outside incident response firm, Mandiant, CrowdStrike, Palo Alto, whoever it may be. These are the folks that you want helping solve these different challenges. And their primary purpose is how do I help you find patient zero? Who was that person initially compromised and what happened next? And that what happened next question is always the most difficult to solve. And, really, what that looks like is you have that needle in a haystack. So there's there's two options I see play out during these initial responses. First and foremost, you try to find every single backdoor that crack or, create it. Again, like we talked about, you're you're doing a needle in the haystack. So in this example, I pulled just 15 of the most common TTPs that are out there. Definitely not an exhaustive lift by any sense of the definition, but a good way to think about the problem that we all deal with during these IRs. So just in these 15 instances or 15 TTPs, I should say, you have to look at all those changes across your ecosystem. So 285,000 changes, was this TTP used in this area? And a lot of times, it's a combination of changes that say yes or no. So you're sort of thinking about millions and millions of forensics checks that your IR firm has to do. And it really becomes this daunting task, especially when time is clicking. Right? Your IDP is down. You have to get it back up or running ASAP. It is, like, the definition of a tier zero application. Everything relies on it, and you can't take the time to find this new home haystack. And just as importantly, there's a couple examples down here, the ones highlighted in yellow. If these occur, you have to do a full rebuild no matter what. Like, no exceptions. Your IDP itself is compromised. Finding backdoors is not gonna matter because they have the keys to your kingdom. You can't sell that unless you're rebuilding, which is really why option two here is the default, defacto option without without exception in today's ecosystem. Again, I've seen this both in public examples, like the state of Nevada, like Stryker, where they talk about having to rebuild the IDP from scratch. Stryker brought in Palo Alto. Palo Alto put out some good information during the initial phases of the attack. A lot of good nuggets in it, but one of their exact quotes was we had to rebuild the IDP to the precompromised point. Otherwise, they're having to find this backdoor and becomes a new haystack conversation. The really interesting point from the state of Nevada example was how much does it actually cost. Right? So it comes from agency, they publish the cost. And if you look at the math here, nearly 27% of their total incident response cost was just rebuilding Active Directory itself. Not intra ID, not Okta, just AD itself was a massive massive, piece of that puzzle form. So you're having to bring in these outside firms like Microsoft to do this rebuild. It's gonna be expensive. It's gonna be time soon... Consuming. Nobody wants to do as part of the process. So this is kind of what we wanna help solve as an organization. And a lot of the questions we have from our customer base around what this looks like. So, hopefully, that sets the stage. At this point, I will invite my good friend, Vijay, to jump on stage with me, and we will kind of, just give you the lowdown of what we're thinking about, what this rule forward concept is, and how do we brought it to the table. So, Vijay, without further ado... Perfect. There you are. Yeah. Yeah. No. First of all, Vijay, a quick intro on your side. Who are you? What do you do? Tell us the goodness. Yeah. Hi, everyone. Good morning, good afternoon, good evening. Hope you all are doing great. So my name is Vijay. I lead the product team, here at Rubrik, working on our identity resilience portfolio. Drew is my partner in crime. We work together to drive this vision and product forward. So, yeah, excited to be here and, chat roll forward. So, Vijay, I was just thinking, like, you've been on board for a couple months now. I think day two at Rubrik, you got stuck into a room with me, and we're talking about this roll forward concept. Maybe, like, just what was your initial impression? Like, coming from the outsider perspective, like, you have no Rubik knowledge. You came from, like, an identity background. But, like, what was this rule forward thing when you first heard it? Yeah. I mean, to be honest, it was like, what are you even talking about? My background is I've been in the identity space for the last, decade, and, you know, I deeply empathize with the I'm pain that I'm seeing. So, like, when I heard about this all forward concept, I think my first reactions were, okay. How would this even work? Because, like, if it works, it's magic. But, like, really, can this be possible? Because this is not something that we've heard about in the field and we've heard about as a capability in IIM's hands. So, it was it was, like, just intriguing for me to understand what was going on. And then as I got into the details and as we understood what was going, and then now being three months in, understanding where we are right now and where the vision is, it's it's super exciting to see, like, where this is going. Yeah. I think one of the the big telling point for us as an organization and kind of where our thought process started to change is when more and more of the conversation shifted to you have to rebuild. Like, no exception, you're having to rebuild the organization. You can you can kinda see that from, like, a product, direction for us. You know, if you look look back a year or two ago, a lot of the features we had were this this concept called rollback, which is still fantastic and you're driving it, and there's a lot of great use cases. But less and less, we saw that thing useful or used in real instant responses because nobody knows. Like, maybe, Vijay, like, what's the challenge customers have in terms of finding that persistence, and why why is it such as daunting task that folks have to deal with? Yeah. Yeah. So, like, again, so I've I've been, like, in so many of these conversations with our customers. And, you know, traditionally, customers think about backup and recovery as, like, there's, okay, let's just go back to a clean point in time and then call it done. But then it's not as simple. Like Drew was mentioning, you know, going back to a clean point in time is just part of the job. But then once you go back a clean point in time, you have all of your joiner mover lever processes that are happening. You have so many legitimate changes that are happening. You really have a needle in the haystack kind of problem to figure out what is the malicious change, what is the legitimate change, and how do customers do it today. Like, the way customers do it today is once you go back in time and go back to a clean point, you have to manually do all of this reconciliation by hand, understand all of the context, and then refigure and reconfigure all of these changes. While you are doing all of this stuff, people lose access to apps. Like, the business is still down. Like, you have not recovered. Recovering clean is one thing, but this clean and current concept, something that is, like, just so new. And so, like, it's just... This process is so complicated because you have to understand everything that has happened, which can be in thousands. You have to understand which ones is legitimate, which ones are malicious, and all of the context is spread. So, that's that's that's super difficult to solve. Yeah. I I think you you nailed on the head. It's just what makes IDP an IDP. Right? You're rebuilding through x period of time in the past call thirty days. Like, what did you guys do as, you know, an an identity team? Or what did your identity team do in those thirty days? Like, a lot. Like, by its nature, IDPs are just fancy databases on the back end that are very transactional. One of my my favorite conversations with this came from the the CSAT, one of the big sporting goods companies we were talking about. This was earlier in the year, closer to the, you know, January, February timeline. He was thinking about this in the context of, his holiday season. Right? They bring on twenty, twenty five thousand workers during their their big holiday rush, and his mind where he went to, like, great. If I had to rebuild to, I don't know, December 15, like, what do I do? Like, those 20,000 workers are now back in my environment. He's thinking about it purely from a security standpoint. Like, what is that risk? What compliance areas? Do these people have access that they shouldn't? But then also his his I'm team in the back is like, how do we know how to solve that? Like, I don't know how to determine who those 20,000 workers are. Like, should they be there? Maybe some temp workers stayed on. Like, maybe they they moved into a different organization. Like, all those things keep going on and you really just... Your mind just starts going crazy. Like, you can go that that... There's so many rat holes here once you start thinking about this challenge. Just to just to put a pin on that for one second and just explain the gravity of what you just said, Drew. Like, you know, from... If I am an IAM admin, like, you know, I've been thrown all of these terms around zero standing privilege, least privileged access, entering the right people have the right access. Like, just hear out for one second. When you said, oh, if I have to go back in time to this, then, like, suddenly these users who should not have access are starting to appear back in the directory or users who should have access but are no longer in the directory. This is a pretty big change and pretty important security outcome that I'm admins need to solve. And, like, that's a pretty big problem to, make sure that you get it right. Because if you don't get it right, this is gonna cause significant security challenges in the org. Yeah. I... A 100%. Like... And I think, you know, just a double clicking that, like, again, like, the only way to get it right in I'll start with this background, like, you have to before we build because, like, you just don't know what happened as part of that process. Like, it's such such a difficult task. This is where that that roll forward concept comes into play. The block we make sense. Right? You're rebuilding, then you're rolling forward back to these time periods that's out there. So, Vijay, I think, I'll show up maybe a couple of more after state diagrams here for the folks in the call understand. But anything else top of mind that that you wanna make sure we cover? No. No. I think I think so far so good. Let me just show the after state and then, you know, show how it works. Where we left off is you're having to rebuild. So the incident response from from patient zero, you have your compromise detected back here. If you remember my example from this warning gig company with December, You can see that highlighted here because we still have that that timeline directly from them. But, finally, what you're doing during this rebuild is you're rewinding all these changes. Right? We'll go back in time, undo all these changes that are part of your IEP system day in, day out, and you have to do everything again. Like, I can't stress this enough because you don't understand what happened. And this is the challenge that we have. Now that I'm at this rebuild point, I've removed this... The the fracture from your environment. I'm, quote, unquote, clean. But now all these other changes are are out of the system. And this is really where this roll forward concept comes in, and I think it's so so useful for our customers because it gives them the ability to solve this for the first time. You're always between this rock and a hard place. So it's like, I know I have to rebuild. It's going to suck. It's gonna cause so much headaches, so many problems, but, like, I have to do it. Now I wanna give everybody the the easy button around here as well. So how does Rubrik kind of help solve this? First conversation piece that I always have to bring up is you... No matter what, you can't forget about our good old friend, ransomware and malware. I think the CrowdStrike stat today is 82% of tax don't have malware, don't have ransomware, but that extra 20 that do are, like, massively impactful. So many headlines that you've seen on this had that in place, and you have to take that into account, especially when it comes to active directory and the Windows based architecture around how do I ensure that I'm not reinventing or re, reinstalling this malware, calling a Groundhog Day situation to where I rebuild and I'm reinfected all of its stuff. So the very first thing we always do is automatically scan every single one of your domain controllers for indicators to compromise. We partnered with Mandiant or Google threat intelligence as they're called now. Their entire threat intelligence feed is built into our system. And as this very fancy, diagram shows, every single one of your DCs is gonna get scanned across the board for those images. And it's really important when you think about things like SysVol. Right? If I'm a threat actor, I'm dropping a rents for a payload in SysVol and having that automatically replicated across your entire DC landscape and having it detonated at once. Like, I wanna be able to find that as part of part of your process. So very first step, automatically scan those 1,100,000 integrated compromise and be able to say, you know, hey. On your immediate DC, at this point in time, I can see that this rain somewhere was detected in your environment. Let me quarantine that. Let me make sure I'm not reinfecting your environment. Because no matter how grim there we get as part of our recovery mechanism rebuilding, there are small pieces of the environment that are gonna be called folder based that potentially have these threats. We're also gonna have a a piece of analogy that we call, threat hunting. I shouldn't say we call it. Like, generally, it is threat hunting where if there is a unknown IOC, I can plug that into the system as well. The cool piece there is pure speed. I can scan every single one of your domain killers, I think, 70,000 copies, something along those lines, tens of thousands of copies of it, across the timeline. So it's a call today, in this example, minus thirty six days ago. I will scan all those in less than a minute and say, here's a previously unknown piece of of malware, some indicator compromise that maybe it's never seen before. It's unique to your environment. Let me identify that as well. So both those options are in place. So this gives you the ability to, you know, get past that 150 page document from Microsoft. You're doing this three step installation wizard. We're doing it as quickly as possible. Like, think of this as dead simple as as you could expect. Our assumption needs to be, like, if you're an identity SME and you know Active Directory, you have to assume that whoever is doing this IR has no idea. Maybe you're on vacation. Maybe your entire team is an off-site. This needs to be so easy that I... You know, one thing I always tell Vijay is that my dad needs to be able to do this. My dad worked in construction his entire life. He has no idea what asset directory is, but we did make this as simple as possible. So step one, identify the malware. Step two, give you the ability to start this rebuild process, especially when it comes to Windows in a way that is dead simple without introducing that that malware to your environment. And then step three here is what I think of as this identity drift analysis. So you have, you know, back in December, now you have January. What were those changes that were were part of your process? So day in and day out, I am preemptively logging every single change within your environment across AD, Entra, and Okta. Those live changes as they're happening is being stored in a Rubrik system in a mutable log. A lot of goodness around this. As you can imagine, seeing this real time activity allows us to get on so many different tasks. But for me, the most important piece is that I know every single change that I'm about to undo in your environment. I know the compromise point. I know the rebuild point. Here's the list of all those changes within the environment. Once I have that in place, the other big piece is, how do I classify those? How do I know what's good? How do I know what's bad? And the way I think about this is I wanna look at your identity supply chain. What are all the other systems that you use that feed into AD or that AD feeds into that tow you these deep... These different pieces of intelligence. So from a... All the bad guy perspective, Microsoft Crouch or Microsoft Defender, CrowdStrike Falcon, all these tools that find these indicators to compromise, help you find patient zero. Let me ingest those into the system. So easy example, if they say, you know, Drew is trying to do some kind of Kerberosing attack, I probably should ignore every change Drew made in the system. I don't wanna bring those back. And all that upstream intelligence are coming from these world class tools like Couch, like, Black Defender. And then on the same side, we have Workday, SailPoint, your IGA, your HR record, management tools. These are what is authorized. Drew was onboard into the system. I can see that change in a Workday. I can see that falling down to SailPoint or to your IGA, and all that intelligence could go and say, like, these are authorized changes. So it's not just here's these 250,000 changes. Here's the ones that we know are safe. Here's the one that are authorized, that follow a known pattern, that are nothing that we've got from a threat perspective. But then here's the ones that, oh, like, I definitely need to ignore these. These are clearly indicators of compromise. I want to ignore these. I wanna go through a fine tooth comb. Let me bring those back at a later date once I'm more confident. That way, I can go from this rebuild point and basically roll it forward. Right? Bring it back to the to the to the to the today state. So not only you're current, you're clean and current as one of my good friend Patrick says. So I'll stop here again. I have Vijay jump back up on stage. Vijay, my friend. Alright. So we've talked about the problem statement. We talked about some of the things back and forth. We've talked about how do we solve it. You know? So you're way past your day one. We've been in many rooms since we talked. What have been some of the conversations you've seen with customers around, like, how they would actually use this and why it's so important to have those, those supply chain... Supply chain tools part of this equation? Yeah. I I think you explained the problem so beautifully. It's it's because today, your source of truth... Like, the goal of the IDD is to be your source of truth for all of your identity data across your stack. However, we know, you know, sometimes that's not the case because you might have an IGA system. You might have, you know, an HR system that writes directly into AD but not be integrated with your cloud IDPs. We know that identity is fragmented, and so we know that the security stack is broader than just your IDP. So our goal is, like, you know, we're trying to figure out how do we bring all of the signals together to help with the malicious and, like, legitimate, classification because that takes away the the the the the manual labor and brings the context. Because reconciliation was always never a data problem. It was a context problem. So now you have all of the context in one place, and now you can use that context to kind of rebuild your identity, which is which is very, very cool. Context is keen. Like Yeah. As troubles I give Gautner, they have this amazing term called IVIP, you know, identity visibility and intelligence platform. And I I love it because it... That's a great way of describing that problem statement. Like, there's so much that goes into identity these days. Like Yeah. On the surface, you know, maybe you take your your your executive who's never thought about identity. He's gonna think about AB. He's gonna think about ENTRE, like, not thinking about the thousand other, you know, puzzle pieces that go with it. And that's what makes this so hard and why it's so challenging for our customers to get back up into it because, I I mean, a lot of time, like, oh, like, walk me through what your incident response plan is, and we'll help customers update those. Like, oh, no. We're good. Like, I can do this in in twenty minutes and we're up to the races. I'm like, that's awesome. Like, you're the only person in the world I've ever heard do it. Like, tell me about it. Tell me about it. Yeah. We we double clicked into it. Like, oh, like, I'd never even thought about that. What about this other thing? It becomes this this tedious test that, you know, people have always forgotten about, you know, especially by thinking about this in a larger, rubric context. Yeah. All the lessons learned we've had as, like, this cyber resilience incident response recovery company, like, it had... It made its way into the identity space, and it's still trickling down across the board. So it's been a lot of fun, a lot of education, and driving it from there. And this this mind shift change is what is so important and unique because we need to evolve from thinking about it as backup and recovery and start thinking about it as your identity resilience. And what we mean by identity resilience is you have to recover at machine speed, you have to eliminate persistence, and you have to rebuild to clean and current. And, like, you know, this was never possible before, but now it's actually possible. And now this involves, like, peep... Like, in many of the conversations, do we ask the question, how has your conversations been with customers? Like, people are like, oh, really? Is this even possible? Like, I didn't even know. And now it's like the shift in thinking, which I think, like, as more and more customers are aware of it, as more and more customers try it, it's gonna... The the... You know, we we really are excited about how customers are gonna see value from this. Yeah. A 100%. You know, does this work with with Workday and how does this work with SailPoint? Let me pull up the demo and I will show you. Yeah. I know. So, if you haven't seen it yet, this is the instant response dashboard. This is the the landing piece in the the Rubrik identity world. I always like to scroll down to this view. It's my own personal favorite because it shows all of that activity that we're ingesting day in, day out, second by second as is happening real time. You know, in this case, it's just a subset of those changes, but you can see all these different information in your environment. It's a lab ecosystem, so we got these nice pretty graphs that show off. You know, rewrote, it probably looks a little different. But the question isn't, can you take this information? Can you log it? It's what do you do with that? So during a real world incident response, you know, the way you would start this process is, you know, usually, you're starting with active directory. This is your source of truth. It's what entry relies on. It's the heart of the solution. And, you know, you can go through and start this recovery process. And what you'll see now is this this, this new clean recovery tab to where instead of just going through the ADFR process, I wanna bring in all these recover, classification pieces as well. So recover the force. Classify all the changes. So if you said, recover the thirty days ago on the back end, we're starting that diff that says here's double changes. Here's the classification, how does Workday come into play. Workday is how we start doing that classification, and I'll show you that here in a second. And then from there, it's going through and just, kicking off the process. I wanna go through and do a recovery of the clean snapshots. So this is things that don't have the ransomware in place. I'm automatically scanning around that because I preselected that. I'll go through and say, is the snapshot they chose, is it clean or not? And if it's not, we throw a nice little warning message. I'll go through and say, do I wanna recover just the DCs? Do I wanna go through and promote host, which is key when it comes to reruled. Right? You're doing a larger rebuild, and I can bring back the entire ecosystem. So once, in this case, I'll just do recover DCs. Tell me where I wanna go to pick the host and what kind of off the races. You go through, start the rebuild process, and then then the next piece here is the the, the roll forward piece. In this case, the screen is all, already set up. So I kicked off the eighty fourth recovery, but now what I've done is done that diff on the back end. So if I gone through, I can see the the domain that I'm restoring. I'm looking at the points in time here. In this case, it was just a couple hours. So what were all the changes that happened within that ecosystem? So I have all these changes that are ready to roll forward. These are things that we've marked as good. And and where is our substitute flat? In this case, it's SailPoint. So I have the integration with SailPoint. I'm looking at the activity on that side. I'm looking at what that system is doing day in, day out. If the change came from SailPoint, I can classify it as a good source. So I can dive into the weeds here and look at all the changes that are happening, see each and every, minute detail here. So I can see that there's some, GitHub user group and look like Margaret here was removed from it. Great. I can bring that back. But I also wanna look at things that I'm not sure of. You know, I don't wanna give you an overconfidence as part of this process or not, or probably just important, like, is there something to be suspicious of? What defines suspicious? Oh, in this case, the source of truth was Microsoft Defender. Microsoft flagged something. There's a known TTP that is happening on this IT admin account. Let me look at these changes as part of the process. Okay. Great. It's potentially compromised user, created a different target account. Okay. I need to look at that now. I don't wanna I don't wanna bring that target account, into the ecosystem because it's potentially compromised. So it just gives you the ability to look at every single changes and group them together. So in this case, instead of going through and worrying about, you know, what was it, twenty twenty two hundred changes, I can very, very, easily say these are the areas I want to look at more specifically. And in this case, I actually don't have the the Workday integration, enabled yet kind of by design, but I can see this Workday service account. But I don't know if this is actually coming from Workday or not. I know it's named Workday. Right? I can probably say it's a good indicator that this is a known service account, but because I don't have the integration enabled, I can't differently say this was actually done within the Workday system. So let me go through that with a little bit more of a fine tooth comb. I can go through and say, I know this is my account. These look all pretty pretty straightforward. I don't have to worry about all of them. I can then mark them for a roll forward and clean it in that process. So instead of having to look at those changes, these are all ready to bring back as part of your system. Once that's in place, all you have to do is start this different roll forward process, and I'll go through and say, I'm ignoring these things I don't know. I don't have anything suspicious, but I do have all the legitimate changes part of the process, and I'll start bringing those back individually throughout the process as it goes. So, hopefully, that gives you guys a, a decent understanding of what that looks like. The goal there is trying to make it as simple as possible, but also understand that there are ups and data sources that we wanna look at throughout this process. Vijay, any last minute things, we should cover here? I think around the limitations on IDPs that you integrate with. So right now, our IDPs, that we cover are, intra, octa, and active directory. That's current, coverage that we have on the IDPs. And then, you know, with our road map, we will expand to other IDPs like paying or IDRA and things like that. Yeah. And one thing I'll I'll say around that as well is, you know, say you have some kind of homegrown solution that you created this custom web portal that customers can go into, like, what the interactions are, you know, almost exclusive that's gonna be tied to some kind of service account. So part of what we do from a workflow perspective is it gives the ability to say that, like, you know, widget a, toolset, service account, like, those are good. Like, I wanna pre authorize those as well. So we try to classify everything as much as possible. There's a plethora plethora of filtering options you guys can customize for your environment as part of those workloads. Yeah. At the end of the day, every IDP is gonna be slightly different. Like, we're never gonna have a perfect solution. There has to be some customization that you guys have built into that flow as well. Well, I think, hopefully, give everybody a couple of minutes back. If you have any questions, reach out to your account talent team. Reach out to me or Vijay directly. We're always happy to jump on and have these conversations. Generally appreciate everybody's time. Hopefully, everybody has a good rest of your day, and we'll talk soon, hopefully. Thanks, everybody. Thank you so much.