Name: The Rubrik Roundup:
Uploaded: 2026-11-04T12:16:09.711Z
Duration: 1 h 8 s
Description: The Rubrik Roundup:

Transcript for "The Rubrik Roundup:": Hey, everyone. Welcome to the Rubik Roundup. I'm Justin Rees. I run product marketing here at Rubik for on premises data protection and unstructured data. If you've been to one of these before, welcome back and you know the drill. If not, here's the deal. Once per quarter, we walk you through what's new, what shipped, why you should care, and more importantly, how you'd actually, use these new things. Alright. So let's dive in. Before we go too deep into what's new, I thought I'd give you a quick kind of level set on the platform. And so you've probably heard this one or maybe you've said it yourself. We have data protection, so we're fine. And that makes sense. For a long time, that was enough. That's not the world that we're in now. Attackers go after backups first, or they come in through the identity systems. And of course, now there's AI in the mix, which touch real systems. So having a copy, that's not enough anymore. And so the real question is, can you get back to clean state and how fast? And that's what Rubrik Security Cloud is built for. And I think it really comes down to these four things. First, data protection. Immutable and air gapped backups, so your copy is actually there when you need it. Cyber recovery, finding the clean point and getting back fast. Identity security, because if AD, ENTRE, or Okta is down, I mean, nothing else really counts. And of course, AI protecting it and using it to make all of this faster. And so everything you see today maps back to one of these four. Same platform, same console. You're not bolting on another tool. And so here's how today will go. Avinash will kick things off, for us on enterprise data protection, then Samia on unstructured data, and then we'll take you through through some AI and SAS updates before Shweta gets into identity. And then we'll talk about cloud. And then, of course, Brian on the technical marketing team, will do a live kinda walk through for us to show some of these things, live and in use. Alright. With that, enough from me. Let's get into the phone part. What's new? I'll pass it to Avinash to take it away. Hello, everyone. Welcome, and thanks for joining us today. My name is Avinash Agarwal, and I'm the product marketing manager for enterprise data protection at Rubik. And in next few minutes, we're gonna talk about some of the latest and greatest features that we have come up with on the enterprise data protection side, something a lot of you are living and breathing every day. So let's get started. Alright. Let's get started with databases. So the first one is MySQL databases, for which we launched the native support earlier this year. And now we are bringing high availability for MySQL databases, because failovers happen, and your backup is something that should not break. So Rubrik now protects MySQL high availability pairs as a single workflow. So in case there is a failover, you can continue your backup chain continues. And you can also run backups from the standby node, and that's straight from your Rubik's security cloud. As a result, the failover to backups, the faster production, and complete etching coverage is something that you get out of this. And this feature is not generally available for you. So if you want to utilize this, you can use it for your MySQL databases. So next up, let's talk about the virtualized environment. As many of you are modernizing your hypervisors or already running multiple hypervisor platforms. And Rubik has been making continuous efforts and investment toward, enhancing the cyber resilience for your virtualized environment. And the first one in that list today is the cloud integration and export to Azure local ARC VM for Azure local environment. So Rubrik now maps your Azure local VMs to the Azure local identity. And now you can recover them directly as Azure local RFPMs and not plain Hyper VMs. So... And also the recovered VMs land in the right resource group and network, and they are all manageable from Azure portal. So as a result, you get Azure native recovery in which the VMs return as ARCVM, as I said, and not, Hyper VVMs. You are instantly port already, and, also, there is no extra licenses required. So this particular feature for Azure local is currently available for our customers. So if you are interested enabling this, you can reach out to your Rubrik account team, and they can definitely help you out with enabling this feature from your Azure local environment. So the next one is the cyber recovery feature for hypervisors. So we are bringing all the goodness of cyber recovery feature for Hyper V and Azure local so that you can build your recovery plans well in advance before the attack. And with this, you will be able to find the clean snapshot with threat analytics capabilities and validate in a clean room before restoring the VMs in the right order. So in terms of the benefits, I think you will be able to get the detection flow straight into the recovery with one workflow. You'll be able to recover an order, and you'll be only able to recover what's verified and that's clean. You can reach out to your account team in case you want to have it enabled for your hypermobile environment. And for Azure local, we are coming soon with this feature. Additionally, if you are gonna attend or if you are planning to attend the Microsoft Ignite event next week, then feel free to visit the Rubik booth over there so that you can speak with the Rubik expert. They can definitely help you and understand more about these features and how Rubik protects Hyper V and Azure local environments today. So the last in the list is, Proxmox virtualized environment. We have added a bunch of features to help you enhance the cyber resilience for your Proxmox environment. So we have added two things. The first, threat analytics. So it has anomaly detection that helps you spot the anomalies and ransomware activity in your backups. We have threat hunting and monitoring to look out for the known threats. And then you have sensitive data discovery that shows what data in your environment is at risk. In addition, we have also added a flexible recovery options for you. So you have the file level recovery available now. So you can restore individual files, and you do not need to restore the entire VMs in that case. So all of these features are now available for Proxmox. So you can definitely avail and utilize these features in your day to day, and these are now available for your consumption. So that brings us to the end of the updates for enterprise data protection. Stay tuned, and keep watching this space for more updates. Thank you. Now let's hear the next set of updates from the next speaker. Hi, everyone. I'm Soumya Sani. I lead product marketing for unstructured data here at Rubik. Today, I'll walk you through four updates built around one idea, keeping your unstructured data protected and making sure you can recover it when it matters the most. As you listen, keep one question in mind. If a cyber event hit your NAS tonight, how long would the recovery take? Let's start. First, Rubrik hosted protection for on prem unstructured data. Let's start with the problem. Your business depends on data like medical scans, engineering designs, and AI datasets. It is costly and hard to recreate. If it is lost or locked by ransomware, the applications that use it stop. To protect it on prem, you have to buy, rack, and maintain backup storage. And with AI driving demand, that equipment is now costly and slow to get. This offering is built on our NAS cloud direct service, and it takes that burden off your team. Rubrik runs the storage, the capacity, and the updates. Your security team manages policy and recovery in Rubrik Security Cloud or RSC without managing the systems underneath. Lightweight software components, data movers installed on-site connect customers' NAS to Rubrik's cloud. So there are no bulky backup servers or large appliances to install on prem. Every backup goes to a Rubrik hosted vault. It is isolated on a separate Rubrik identity domain and protected by retention law. So production admin credentials can't reach it or delete it. One policy covers NAS from different vendors. You can recover to a different array, to cloud storage, or to an isolated recovery environment where you can test recovery safely, and ransomware detection runs on every backup. Threat hunting across your backup history helps you find a safe recovery point. The result, less to manage and a stronger recovery. Second, copy and migrate. Moving file data is hard. It often means scripts, manual work, and a lot of watching. Copy and migrate makes it simpler. It is policy driven engine that syncs file and object data from your source to a target, and you manage it all in RSC. You can move NAS data to a new platform, a second site, or cloud storage, and protection stays with it. Destination policies are applied right in the RSC. You create a copy schedule, pick a target, and assign it to your shares. Schedules can run hourly, daily, weekly, or monthly. The first run copies everything in parallel batches, so large datasets move quickly. After that, only the changes follow, so the target stays up to date. Use it to refresh hardware. Copy to the new platform. Cut over once it's caught up and pause the schedule. One thing to keep in mind, this is a one way copy with no versions. It is not a backup. If a file is deleted at the source, it is deleted at the destination on the next run. Third, NCD offline recovery. Here's a hard situation. Ransomware or a network cut leaves you unable to reach RSC. Normally, a restore depends on RSC, which holds your index and configuration. So you can't start a restore even though your backup data is in your own storage. Offline recovery is your last resort restore path. It prepares for that day ahead of time. You give Rubrik an offline recovery target, such as an s three bucket. A small copy of your index and configuration syncs to it. After the first sync, only changes move. There's no extra full backup and no second copy of your data. If you lose connection to RSC, you boot the NCD VM. You already run into offline mode from the VM console. There is nothing new to deploy. You enter your target details, and the VM reads your index, configuration, and restores to your source storage. When RSC is back, you exit offline mode and backups resume. Three things to know. First, set it up ahead of time because the first full sync must finish before anything is recoverable. Second, it is recovery only, and offline mode pauses backup on that VM. So treat it as a break glass option. Third, your recovery point can be up to twelve hours. Client side encryption is not supported, and keep your target somewhere that would not fail with your main environment. Last, sensitive data discovery anywhere. Many teams can't say where sensitive data sits on their file shares. Until now, discovery on Nasdaq Direct needed backups in Rubrik Cloud Vault and a first full backup within fourteen days. Sensitive data discovery anywhere removes that. It scans your NFS, SMB, and generic s three sources directly from your data mover VMs with no backup needed to help you meet data privacy requirements. It runs as its own job with one scan task per share on a schedule you set. Only the data types you assign are scanned. File content stays on your VM. I see stores file names, file paths, and results. You see findings in object inventory and reports, and you can add data movers to scale out. Then you can apply the protection policies, retention lock, and legal hold to your critical data, which helps with audit and compliance. Scans add reload, so schedule them for off hours. This is an invite only preview for the enterprise edition customers. Those are the four updates. Together, they give you more ways to build cyber resilience for your unstructured data. Thank you for listening. And with that, let me turn it over to the next speaker. Hi. I'm Damien Lim, product marketing for SaaS and AI at Rubrik, and I'll be covering what's new in AI resilience. Let's start with how we help you find the attack paths in your code before attackers do and how you can simply ask Rubrik, the topics I'm be covering today. So your scanners read one file at a time. Attackers don't. So how do you find what they'll find first? So meet Rubik's code guardian. It red teams an air gapped copy of your repository, pairing Anthropic's mythos with a custom rubric harness. It finds multistep attack chains and ranks them by business impact. Think like your attacker. It reasons across files, services, authentication paths, and chains minor bugs into real takeover paths. Trust the findings. Chains are ranked by exploitability, blast radius, and business criticality. So your team sees less noise and zero production risk because it scans an air gap copy never life repo and find that chain vulnerabilities that single file scanners miss. Know what to fix first, backed by validated attack paths, and harden the code from GitHub or Azure DevOps without granting live access. Rubrik code guardian, now available in private preview. Attack your code before attackers do. Your team runs AI agents everywhere. So why does every Rubrik question still mean another console? Meet rubrik.ai, the industry's most comprehensive cyber resilience agent built right into Rubrik Security Cloud. It discovers, reasons, acts across your data, identity, and applications. And Rubrik MCP cuts into the agents you already run straight into Rubrik Security Cloud. Real answers from your live data, about 2,000 Rubrik operations your agents find on their own, and nothing changes without your approval. A failed backup, diagnose and fix on your say so. A Microsoft three sixty five recovery plan for your most critical users in seconds. Your SOC agent needs the last clean recovery point. You just need to ask. One in three Rubrik customers worldwide already use Rubrik AI. And in its first week of MCP preview, one global bank made 856 distinct API calls. Rubrik AI and Rubrik MCP are generally available now, so stop switching consoles and start asking Rubrik. And now let's move to SaaS resilience. Your business runs on apps like Microsoft three sixty five, so here's how we get your critical teams back first in hours, not weeks. So anyone can back up Microsoft three sixty five. Getting the business running again is the hot part because no one knows what to restore first. Autonomous business recovery with Rubrik dot AI is the first AI agent that recovers your business, not just your data. So stop guessing. It finds the people and data your business runs on, builds a recovery blueprint, and shows whether you will, hit your RTO before an incident. Approve the plan, and your minimum viable business is back in hours, not weeks. And you know what to restore first. Hours of manual triage become a plan at machine speed, And critical teams are back in hours in... Inside your Microsoft API limits. And that holds for a major outage, API throttling, or even rogue agent damage. It is now limited availability today. And with that, let me turn it over to the next speaker. Thank you. Hey, everyone. I'm Shweta, senior associate PMM for identity here at Rubrik. During our last Rubrik roundup, you told us that the number one thing you'd like to hear more about was identity. You asked, and we listened. The entire Rubrik team has been hard at work building new features for identity resilience. And today, I'm super excited to walk you through what's new. We'll unpack a new approach to identity recovery that can cut your RTO by up to 56%, reveal how you can quickly recover clean and current without losing wanted business progress, and you'll also learn how protection for Entre ID and Okta just leveled up. Enter IFR or identity first recovery. IFR extract the n t d s dot dit file or the database of AD objects, SysML data, which is policies and scripts, and AD integrated DNS so they're not tied to the underlying OS. Then Rubik introduces these into a clean Windows instance. This includes portability across on prem, hypervisors, and cloud. So IFR excludes OS binaries and registry hives, and you get a clean slate on which to recover, all of which minimizes the risk of reintroducing threat. IFR also accelerates ADFR or active directory forest recovery. Moving a roughly two GB identity database instead of a 60 GB system image means less data to transfer and a faster path to recovery. In other words, IFR recovers just the directory and not the whole machine. In our internal testing, IFR cut recovery times by up to 56% for active directory database sizes of around 500 MB. So malware scanning is critical to recover information in the data layer, and threat monitoring is designed for that as we've seen. But identity is especially hard to recover because it changes constantly, and EDR tools aren't built to protect it. We've seen how and why you should recover quickly with IFR. But now there's a paradox. You've recovered clean, but it's a stale snapshot, and you've wiped your most recent legitimate IDP changes, like new users, deactivated accounts, and DNS record updates. Rebuilding them means days of manual reconciliation while the business stays down. If you've been following our rubric roundups, you may remember that we had earlier talked about our roll forward capability. I'm happy to announce that roll forward for active directory and Entre ID is available today. So how does roll forward work? First, you identify a clean baseline and recover to it so that you evict attackers. Rubik generates a disc table to compare the clean versus current state so that you can identify every user, group, and permission that changed. Rubik labels them as safe, unclassified, or harmful with context from the identity intelligence fabric. The identity intelligence fabric is a quick way to reconcile context from ITDR tools such as CrowdStrike Next Gen Identity Security and Microsoft Defender for Identity, IGA tools like SailPoint, or HRIS tools like Workday with IDP changes to reconcile context from these tools with IDP changes. This way, SOC and IAM teams don't need to manually cross reference tickets and spreadsheets to understand which changes were legitimate. Today, our ITDR integrations are generally available, as well as a SailPoint integration for IGA and a Workday integration for HRIS. By bringing SailPoint's comprehensive access and governance capabilities and Workday's authoritative employee life cycle data directly into the fabric, we bridge a critical visibility gap. These key integrations allow teams to validate whether an identity change is legitimate based on trusted sources of truth. These integrations don't just accelerate workflows and drastically slash your RTO. They deliver the definitive context you need to avoid the chaos of endless tabs and stale spreadsheets. Going back to roll forward, after you've recovered to a clean state and reconciled wanted changes with the identity intelligence fabric, teams can then triage changes and select specific changes to reapply. Rubrik pushes them live. With roll forward, the directory reflects the current state of the business instead of a stale snapshot. Crucially, you evict attackers and keep wanted IDP changes preserving months of work. Moving on to Entre ID. Rubrik already protects and recovers a wide range of Entre ID objects. We've expanded Entre ID protection to help organizations protect governance devices and recover cleanly to a new tenant. First, let's talk about governance. So in Entre ID, access packages, device policies, and conditional access policies are typically hard deleted with no native rollback. This means that recovery is your only option. With this new launch, we have expanded protection and recovery of Entre ID governance objects, specifically access packages with their assignment policies and roll stops, catalogs, access review definitions, and PIM settings. All EntraID governance objects can be recovered during a full tenant or granular recovery, enabling enterprises to restore the governance configuration automatically instead of by hand. Next, Intune policies protect the health and access constraints of endpoints. If device compliance policies are wiped, attackers get an easy way to maintain persistence. That's why we expanded Entre ID Protection to secure and recover 17 Intune object types spanning compliance, configuration, endpoint security, Intune admin roles, and more. Recovery covers policy properties with assignments and dependencies and gives customers a choice to overwrite, merge, or skip when conflicts arise. Finally, cross tenant recovery or CTR is critical in managing worst case scenarios like an attacker getting control of a global admin account. Rubik's cross tenant recovery restores Entre ID objects from a compromised tenant into a separate clean tenant, including users, groups, conditional access policies, and administrative units. It reestablishes relationships so a minimum viable business tenant comes up whole rather than as a collection of orphaned objects. Rubik fully orchestrates CTR. Restoring identities, governance, and Intune policies from a single platform means identities come back with the right privileges, devices come back on a known good baseline, and guardrails stay intact. And last but definitely not least, let's move on to Okta. We already protect Okta tenants, backing up users, groups, applications, and policies, and providing point in time recovery for them all in a logically air gapped environment. Given Okta's value, we're deepening this protection. First, Okta life cycle management or LCM provisions identities from Okta into downstream SaaS apps. It depends on a set of configurations most teams don't protect, provisioning settings, push group mappings, profile mappings, group rules, and event and inline hooks that drive life cycle management Additionally, if an Okta workflow, such as a JML workflow or child flow, is compromised, accidentally changed, or deleted, Rubik lets organizations restore it to its last known good state. Next, similar to Entre Izy, Rubik will now offer cross tenant recovery for Okta. Okta. During a full tenant compromise, this lets teams stand up a minimum viable tenant and keep managing the incident. Rubrik helps customers reconstruct identities and application settings between a preview and production organization, as well as test identities in a preview org. And finally, remember that most enterprises source identities from active directory and sync them into Okta. Recovering Okta while active directory is compromised, brings attackers back, and breaks automation. That's why Rubik will now treat Okta and active directory as one system, not two silos. This means that customers can recover Okta with the backing of a fully synced active directory. All this helps customers accelerate incident response, hit RTO targets, and minimize operational downtime, all from a single platform that helps you reduce tool sprawl and TCO. Thank you all for sticking with me, and I hope you enjoyed listening to this update as much as I enjoyed delivering it to you. And now I'll pass it to our next speaker. Hi, everyone. I'm Anurud Dubey, and I lead product marketing for cloud data protection solutions here at Shooprig. And today, I'll walk you through what we have launched in cloud this past quarter. But but first, broadly, every AI initiative today runs on your cloud, resting on three interconnected layers. The code that builds everything, the data models learned from, and the application that delivered the AI outcome. Lose one and the AI on top goes with it. Yet, most of this foundation today relies on a patchwork of native features and point tools of production, while cloud focused attacks keep climbing up. Availability, unfortunately, is not resilience, and you need recovery you can prove across all three, protect the code, secure the data, and recover the application so you can power your AI with confidence. Here's a quick view. On code, we've expanded our DevOps protection beyond just repositories. On data, we are now protecting your AI data foundation. That is Apache Iceberg on AWS and Google BigQuery. And on applications, we continue to expand our coverage with the new, Azure PostgreSQL flexible server coming out for Azure cloud. Everything I'll cover today is generally available. And, with that, let's start with cold. Most teams think of DevOps production as repositories first, but code is only one link in the chain. Plans live in work items and issues, decisions in pull requests, knowledge in wikis, guardrails in the settings. Lose those and engineers lose the context to rebuild even if the code survives. Native version history only covers the depots and sits in the same security domain as the data. So it isn't really a true backup, and it leaves the rest of the workflow completely exposed. That's why Rubik's DevOps Protection now covers the the whole workflow beyond repos and pipeline. You back up Azure boards, work items, wikis, and organization settings in Azure DevOps and issues and pull requests in GitHub, all under the same SSA policy engine with immutable and air gap backups. Coverage is expanding progressively so the customers can start protecting these, these today, and new customers get a solution that has matured alongside the teams that have been relying on it for quarters. Now moving to data. This is where the AI learns. So enterprise data has moved into low cost cloud object storage with the table layer like Apache, Iceberg, making it queryable like a database. That's the lakehouse along with the managed warehouses like BigQuery that make up this AI data foundation. But these platforms were built by data engineers or not and not backup admins or even IT ops. So protection was rarely designed. Snapshots and time travels are merely pointers in the same account as the data, and replication copies a bad delete as faithfully as the good data. And none of it understands the table. For AI, you can trust the data underneath must be recoverable, and two upcoming launches are addressing exactly that. First, we have Apache Iceberg on AWS because this is where the business now increasingly runs. Analytics, real time pipelines, and AI training all read from these iceberg tables, and autonomous agents increasingly have read access to them directly. But an iceberg table isn't a folder or files. It's five interdependent layers. So data files, manifest, manifest list, metadata, and the catalog pointer. Lose anyone and the table is unquerable or functionally unrecomfortable. A snapshot isn't a backup and rebuilding is not recovering. Restore the objects, and someone still has to rewire the catalog by hand while the business breaks. Rubrik Apache Iceberg Protection now generally available is catalog aware. What it means is that it packs up the data, metadata, and catalog together for both AWS Glue and Amazon s three tables with immutable copies in your own AWS account or Rubik cloud... Cloud Vault. It takes incremental backups of only the latest compacted snapshot, so it stays efficient even at petabyte scale. On recovery, the table comes back working and queryable and not as a piles of files, and that you have to validate. You can also have an isolated branch recoveries that you can validate your recovery before promoting it to production. Protection works at account level, so no... So new tables are covered from day one on the same platform as the rest of your AWS estate. Next, Google BigQuery. Google BigQuery has grown from where reports used to live and into the backbone of your AI data foundation. Financial and regulatory records, customer analytics, ML training data, and the live data AI agents query. So when the data is deleted by mistake, encrypted by ransomware, or wiped by a rogue admin or an agent, the damage doesn't stay with the data team itself. Pipelines break, dashboards go dark, and model and agents answer from a missing or corrupted data. And BigQuery's native tools leave real gaps. Time travel reaches back seven days at most and covers tables only, not used or retained. Snapshots are manual with no SLA policy. And because everything lives in the same project as production, one stolen credential can take out the data and its safety nets together. That's the gap rubric BigQuery data protection closes. Setup is agentless, and it takes minutes. New datasets are protected automatically under the SCL driven policies. Backups are again immutable and air gapped and can live in your own GCS account or Rubik Cloud Vault with retention that isn't capped just at seven days. Recover a whole data set including tables, views, and routines, and not just a single table. The same or different project or even a different region. And it runs on the same platform and policies at the rest of the Google Cloud estate. Finally, applications. Every application today that delivers AI outcome has a data layer underneath, and many databases are powering that today. Increasingly, Azure PostgreSQL is a critical part here. And to recover these application, you absolutely have to recover these databases. Native backup for Azure PostgreSQL runs out of road at scale. Built in backups cap at thirty five days, and the longer term option tops out at one terabyte with weekly full backups. So Droopring now protect Azure, PostgreSQL, flexible server, and it's generally available. It provides daily immutable backups, point in time recovery, and retention that's far beyond thirty five days for servers up to 16 terabytes. It's agentless and adds no load to your production and sits under the same SLA policy as the rest of your Azure cloud estate. So new server and... Are protected the moment they appear. So that's the quarter in cloud. Your developer workflows, your AI data foundations, and your application databases all protected. Thank you, everyone. And now we'll turn it over to the next speaker. Let's do a quick demonstration of some of the things we've talked about. My name is Brian Knutson. I work on the tech marketing, team within... Here within Rubrik and gonna walk through some of the stuff that that my my colleagues have presented to you so far. A lot of these all work around kind of the concept of when a cyberattack happens. There's really kind of three main questions that that you're going to ask or three definite questions you're going to ask about what happened and what got affected. Can I trust my identity, you know, the the the identities that maybe got compromised, and how fast can the business communicate and operate post the event, especially if they've they've taken out m three sixty five, your email, those kinds of things? And so what I'll do is walk through three of the the key things that we announced to you this week that, will show you how Rubrik can help you answer those things. So let's jump in with the first one, and we'll talk about the, Rubrik MCP. So this gives you the ability to, within tools like Cloud Code, which you can see here, being able to access Rurik Security Cloud and directly query it and and be able to ask it questions. So let's say that we had a user call in and they're they're using our Zafri application, and they reported some weird behavior. And they wanna they wanna see what's going on. So let's just ask real quick. Are there any threats or anomalies in the in the last twenty four hours? K. Let's go with that. So what's happening here is it's it's actually using the, the Rubik MCP that I have configured to connect into, that environment and actually query and, ask the question of what's... You know, how how can we answer this. It's gonna analyze it. This this is AI. So it's it's gonna pull the raw data. It's gonna look for other clues and give me kind of a a rundown of really what's going on in the environment in the last twenty four hours. So here we already have some results. And looking at them real quick, we can see we have 37 critical anomaly events coming from, anomaly detection, in the last twenty four hours. And these are high confidence, high levels of encryption. So roughly 5,000 files added, 5,000 removed, about a 100 modified in each event. So it's gonna do some analysis. It's gonna give us some information about what's going on. I can see Zafri in here in a few places. Haverford's, another part of that solution there. Another Zaffrey. So there's definitely something potentially going on there. It's gonna give us some analysis. So it's gonna find some stuff that is going on there that may be connected. You know, it's saying it's likely a lab. In this case, that is the case, but let's pretend like it's not. And, you know, it's it's saying they can't necessarily find everything. So we're we're definitely seeing that there's something going on here, and it it didn't warrant some additional verification. So next, let's let's dig a little bit deeper and see if I can if I can really get to the crux of things for us. So can you create a report on the Zafri and Haverford systems The most recent point in time is the sensitivity of the affected data. Right? Or it ties the list based on sensitivity. Okay. Let's go with that. And so, again, it's going to be querying the the Rubik MCP that I have set up, talking to, Rubik Security Cloud to to answer these questions. Asking me a lot of questions along the way, asking permission to do things. We have cloud tied down pretty tight, so that, you know, we have to do a lot of reviews and understand what's going on, as as we do things. And and what this is going to do is really kinda give us an answer to, what do we what do we do next? What do we need to deal with, looking at both sensitive data and anomalies to be able to cross correlate in those systems that that I identified that are important to this application what's going on and what we need to deal with. And and that's important because, you know, just figuring out what to do next can be one of the biggest things when you get that alert that there's an anomaly happening. And since this is through an AI interface, it is possible to tie this in with with other, systems that you may have that can tie into this MCP, potentially giving a level of permission to security analysts, you know, even even some of your compliance type teams that would need to answer questions like what sensitive data was affected. Instead of them having to go in and run reports and cross correlate a bunch of different reports potentially, trying to dig around, ask a simple question and be able to get potentially a very complex answer, which in most cases, these these cyber events are, and build that report that can be easily understood by whoever needs to see it up to and including executive summaries, in in the environment. So being able to to work through this, correlate all that data is is one of those powerful things that we get with AI. Okay. Well, while this is running, I'm going to transition over to the next part of the demo so that we can see, you know, one of the main things that we need to do once we kind of understand what's been affected is understanding our identity and where compromised identities may be coming into play. Okay. So jumping into our identity resilience screen, you can see there's a clean recoveries option that's now available on the screen. And as we go into that, what we'll see is a list of the clean recoveries that have occurred. These are full forced recoveries of this clearwater..com domain. We can go in and see that it was recovered successfully. We can view the tracker and see all the things that that occurred as part of this recovery, and see that not only are all the individual items completed, but so is the whole thing. Now going into this one, what we wanna do is we went back in time quite a bit, and we want to roll forward the pieces that we're missing. And so here we can see that there are over 2,000 changes that occurred between the point we recovered and the most recent snapshot that we have, where ideally or most likely things are not very healthy. We we don't necessarily wanna get the bad stuff in. And one of the things we've introduced is the ability to classify some of these sources automatically is to to ease this burden of trying to figure out what's going on in those 2,100. So here we can see that we've classified some sources that are legitimate from Workday and SailPoint. These are our sources of truth when it comes to identities within the organization. And so we we are going to trust anything that comes from them. We can also add IP ranges that allow us to, be able to say, hey. We know good things are gonna be coming from these IP addresses, so let's automatically mark those as legitimate. We can also look at suspicious changes and automatically mark things that come from CrowdStrike, Microsoft Defender, other tools that we integrate with that can give us alerts on these things. We can also add IOCs, that that we know will be indicative of bad things happening. So once we've got all that, it's gonna categorize these things automatically. If we look at the changes that are already marked to roll forward, we we can see SailPoint is is classified up over 2,000 classifications. And so since we have these marked as as a safe space that these changes came from, we can trust those. Now if we go back to the changes to review, there's 37 of them. We can see this work day one has has a bunch of changes. If we look at the classification, we can see that they're they're safe. So clicking in here, we can look at all these changes. We can review them if we want to, or we can just select all and mark which ones we want to roll forward. So, those will add to the roll forward list. And coming back to the changes to review, you can see we just have two left. So, one of these came from Microsoft Defender, found IT admin, did a bunch of stuff. We can go through here. We can review what happened. Ultimately, we're not gonna trust these. So let's go back, and we'll look at these unmatched ones. These unmatched ones didn't categorize in any of those places. So these are changes that occurred from a bunch of different places, and and being able to review these one by one. Only 22 of them, so we can take the time to go through them. We could just say, hey. We don't know where these came from. We're going to assume that they're bad. If we need to manually recreate these changes, we can do that later. So let's go back to Clearwater and with that, we feel pretty good about these 2,154 changes that we wanna pull in from previous backups into the domain that we just restored. So pretty easily, we can go over here and click roll forward. We can see some some of the details we just looked at. We acknowledge the fact that we may be rolling forward potentially bad things. That's that's on me as the person that's configuring that. So let's go ahead and roll forward. And now it's it's moving forward. And, it... It's reconstituting those changes is what it's doing one by one to to recreate those items. So if we want to, we can view the progress and and watch this thing proceed. But while that's running, because it's gonna take a little bit of time, what we'll do is we'll move on to the last part of our demo, which is to look at bringing back our communications channels. Our our most precious data is sitting in m three sixty five, and our most critical users need this data back quickly. And so how can we do that? Well, with with the new autonomous business recovery integrated with Rubik AI, we can make this really, really easy. So we're gonna enter the subscription for this Rubik demo environment. We're gonna look at the critical operations groups. Here, we can create groups, and these groups can be based on users, groups, or SharePoint sites or a combination of those that give us things like these. So let's say we created this priority one recovery group. This is our executives. We wanna make sure they've got the communication mechanisms in place because they're the ones that are gonna have to be communicating with people about what's going on. I can come in here and select create recovery plan for them. And note the the little star icon, of course, means that this is using River KI. And what we can do as as part of this, similar to what we saw with the MCP, is to be able to use natural language conversation to create these recovery plans. I've done a lot of Doctor over the years, and the... One of the toughest things is just trying to figure out what the plan needs to be. You know, what's most critical? What's the most important thing to bring back first? And then coordinate that with all the other stuff that needs to come back as well. And so what it's done is it's analyzed kind of the the the users and these groups and the SharePoint sites that would be a part of this group and it's asking me, you know, one two part question, which workloads? So let's say all three. And for number two, let's say seven days and off it goes. And it's going to now analyze everything in that group based on these kind of two filters, if you wanna look at them that way, or these two pieces that we feel are the most important things to pull back. And, again, this is in the mindset of being able to run this plan when we say, hey. There's been an incident. We need to we need to recover quickly. We wanna recover the most important stuff first. I'll tell it to go ahead and create the recovery group. So it's gonna work on that. And then start the analysis once this group is created. Start the analysis of what needs to come back. Once that analysis is done, which it is, we now have the ability to, go in and and prompt it further. We can we can say, hey, I wanna limit it to only doing attachments that are less than one meg because I wanna get back up and faster. And if I need to restore those individually, I can do that. When this is over, we can go into the ability and do an autonomous business recovery. So this finance group already has a recovery plan built, and we can take a look at that. And as part of going through the creation of the recovery group... Of the recovery plan, you can look at this kind of thing. And you can say, okay. Well, this finance group has, you know, these types of things based on the criteria that we gave it. We can choose to recover everything else in the background once we've got the critical stuff up, or we can leave it off for now. You know, if this is just our first of of 10 different groups we need to get up and running, we may not want to recover all the all the data immediately. So we leave that as an option. Then Then we can choose in place or in a new location depending on the situation, and then it gives you the the responses or the the expected returns of that. And then we can click recover, and the process would then begin at that point. So we very quickly taken the time to build that recovery plan before an incident happened. And when the incident happens, you know, essentially three steps through a wizard and our data would start recovering, back into that existing m three sixty five environment or potentially into a whole different one if if we need to cut bait and move to a whole new one. So with that, I really appreciate your time and hope you all have a great rest of the day. Awesome. Thanks, Brian. It's always super awesome to see just how easy it is to use the platform. I think one thing that stands out is, you know, as you're going from all of these different workflows, it's all the same platform. And so I think just the ease of use is unmatched. If there's one thread through today, it's this. Cyber resilience isn't just a backup. It's your data, it's your identities, your cloud, and now all of your AI. And all of it has to come back clean. And so if I had to pick a few to go back and, you know, rewatch, all of the offline recovery for NAS, Because to be honest with you, you know, that's the scenario nobody wants to plan for, but it... We all should. Rubrik AI building an m three sixty five recovery plan around your most, critical people first. And all of the role can afford capabilities for identity and getting back to clean without throwing away months and months of good, kind of, changes. And one more thing, if the cloud section got your attention, come... Please hang out with us on November 10 at the Cloud Resilience event. It is virtual and and online. The whole thing is built around one idea. Your AI is only as good as the data beneath it, and most of that data lives in the cloud. And so if you're not a 100% sure your cloud can restore, this is the event for you. It will be, playing across the globe. So there's, definitely a time that works, wherever you are. So please join us. Links in the chat. Grab your spot. And if you've got a teammate who owns cloud or is interested in cloud, definitely send it their way as well. And so with that, that's all we had for you today. And again, huge thanks to today's presenters and to the technical marketing team. You guys are awesome. And thank you all for spending the time with us today. If you, missed anything, the replay will be, posted as well. But beyond that, we'll see you on the tenth. Bye for now.