What Changed

A comprehensive new solution providing six interconnected playbooks for NetApp Ransomware Protection Service integration. The solution establishes automated incident response capabilities for NetApp storage environments through Microsoft Sentinel.

Playbook Architecture

The solution follows a modular building-block approach with foundation and response components:

Foundation Infrastructure:

  • Authentication Playbook — centralized credential management via Azure Key Vault with OAuth2 token generation
  • Async Poll Playbook — monitors long-running NetApp operations until completion

Investigation Capabilities:

  • Enrich IP Playbook — retrieves network interface details, associated storage VMs, and volume mappings for suspicious IPs
  • Enrich StorageVM Playbook — gathers comprehensive storage configuration, volume states, and access policies

Protective Actions:

  • Volume Snapshot Playbook — creates point-in-time snapshots for data protection and evidence preservation
  • Volume Offline Playbook — isolates compromised volumes by taking them offline to prevent lateral movement

Security Impact

This solution addresses a critical gap in automated storage protection during ransomware incidents. Previously, SOC teams had limited ability to rapidly protect NetApp storage assets through Sentinel automation. The solution enables:

  • Immediate Containment — automated volume isolation upon threat detection prevents ransomware spread
  • Data Protection — automated snapshot creation preserves clean recovery points before corruption
  • Investigation Context — IP and storage VM enrichment provides rapid situational awareness of affected infrastructure

Deployment Workflow

The playbooks must be deployed in strict sequence due to dependencies: Auth → Async Poll → Enrich IP → Enrich StorageVM → Volume Snapshot → Volume Offline. Each playbook includes comprehensive deployment documentation and testing procedures.

SOC Integration

The modular design enables flexible automation rules:

  • High-severity ransomware alerts can trigger automatic snapshot + offline workflows
  • IP-based investigations can chain enrichment with protective actions
  • Manual triggering available for analyst-driven incident response

Authentication leverages Azure Key Vault for secure credential storage, with all API communications using OAuth2 client credentials flow.

Affected Files

Logos/NetApp.svg
Solutions/NetApp Ransomware Resilience/Package/testParameters.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience-Auth-Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience-Auth-Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience-Auth-Playbook/azuredeploy.parameters.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience-Manual-IP-to-Offline-Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Async_Poll_Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Async_Poll_Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Async_Poll_Playbook/azuredeploy.parameters.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Enrich_IP_Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Enrich_IP_Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Enrich_IP_Playbook/azuredeploy.parameters.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Enrich_StorageVM_Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Enrich_StorageVM_Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Enrich_StorageVM_Playbook/azuredeploy.parameters.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Volume_Offline_Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Volume_Offline_Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Volume_Offline_Playbook/azuredeploy.parameters.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Volume_Snapshot_Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Volume_Snapshot_Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Volume_Snapshot_Playbook/azuredeploy.parameters.json
Solutions/NetApp Ransomware Resilience/Playbooks/README.md
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_NetAppRansomwareResilience.json, createUiDefinition.json, mainTemplate.json)