Skip to content




Rubrik is a cloud data management company based in Palo Alto, California, United States founded in December 2013 with offices in Morrisville, North Carolina, Bangalore, India, Lawrence, Kansas, Amsterdam, Netherlands, Nottingham, England and Cork, Ireland.

Product Details

Vendor URL: Rubrik Data Backup - Gartner on Ransomware Recovery

Product Type: Zero Trust Data Security

Product Tier: Tier I

Integration Method: Syslog, JSON

Integration URL: Security Hardening Best Practices - Rubrik

Log Guide: N/A

Parser Details

Log Format: Syslog

Expected Normalization Rate: 90%

Data Label: RUBRIK

UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
auditName principal.user.user_display_name
auditUserId principal.user.userid
class metadata.product_event_type
cluster_name src.resource.parent
clusterId src.hostname
clusterName src.resource.parent
command src.process.command_line
description security_result.action
dhost target.hostname
dhost target.ip
dst target.hostname
dst target.ip
dst_domain target.administrative_domain
dst_port target.port
error_code additional.error_code
errorCode additional.errorCode
error_message additional.error_message
errorMessage additional.errorMessage
error_reason additional.error_reason
errorReason additional.errorReason
error_remedy additional.error_remedy
errorRemedy additional.errorRemedy
event_id additional.event_id
event_series_id additional.event_series_id
eventName metadata.description
file_path src.file.full_path
job_type security_result.description
node_ip observer.ip
object_id src.resource.product_object_id
objectId prinicpal.hostname
object_type principal.application
objectType principal.application
observer observer.hostname
observer_domain observer.administrative_domain
path src.url
product_event metadata.product_event_type
proto network.ip_protocol
seriesId additional.seriesId
severity security_result.severity
shost principal.hostname
shost principal.ip
source principal.ip
src principal.hostname
src principal.ip
src_domain principal.administrative_domain
src_port principal.port
Statically Defined extensions.auth.type
Statically Defined src.resource.resource_type
Statically Defined metadata.event_type
Statically Defined metadata.vendor_name
summary security_result.summary
suser principal.user.userid
type security_result.description

Product Event Types

type,subtype severity UDM Event Classification alerting enabled
src, dst, and protocol Information NETWORK_CONNECTION
session opened USER_LOGIN
session closed USER_LOGOUT

Log Sample

<30>Jan 31 16:26:11 OBSERVER_DATA snmpd[909]: Connection from UDP: []:59689->[]:161

Sample Parsing

metadata.event_timestamp = "2022-01-31T16:26:11Z"
metadata.event_type = "NETWORK_CONNECTION"
metadata.vendor_name = "Rubrik"
metadata.product_event_type = "snmpd"
metadata.description = "Connection from UDP: []:59689->[]:161"
metadata.ingested_timestamp = "2022-01-31T16:26:32.615608Z"
metadata.ingestion_labels.key = ""
metadata.ingestion_labels.value = ""
metadata.ingestion_labels.key = ""
metadata.ingestion_labels.key = ""
metadata.ingestion_labels.key = ""
metadata.ingestion_labels.value = "cyderes_zh_0.gz"
principal.ip = ""
principal.port = 59689
principal.asset.ip = ""
target.ip = ""
target.port = 161
target.asset.ip = ""
observer.hostname = "OBSERVER_DATA"
network.ip_protocol = "UDP"

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon