What Changed

Three net-new Playbooks added to the NetApp Ransomware Resilience solution (v3.0.0 to v3.1.0), bringing the total playbook count from 6 to 9:

  • NetApp-RansomwareResilience_Block_User_Playbook - calls the NetApp Ransomware Resilience block-user API endpoint to revoke user access. Supports permanent or timed blocks (1, 2, 4, 8, 12, 24 hours). Parameters: user_id (required), user_ips (required for NFS, optional for CIFS), duration (optional). Entity types: Account, IP.

  • NetApp-RansomwareResilience_Unblock_User_Playbook - restores user access after review/approval. Parameters: user_id (required), user_ips (required for NFS, optional for CIFS). Paired counterpart to the Block User playbook for controlled recovery.

  • NetApp-RansomwareResilience_Volume_Online_Playbook - brings a volume previously taken offline back into service. Parameters: volume_id, agent_id, system_id (all required). Complements the existing Volume Offline playbook to complete the offline/online containment cycle.

All three Playbooks authenticate via a dependency on the existing NetApp Auth Playbook, targeting the NetApp BlueXP API at https://api.bluexp.netapp.com. Each is deployed as a Microsoft.Logic/workflows resource with a system-assigned managed identity and an HTTP trigger, making them attachable to Microsoft Sentinel automation rules or manually triggerable from an incident.

Operational Notes

  • Deployment order: Auth Playbook must be deployed first; these three playbooks reference it by name via ARM parameter NetAppRansomwareResilienceAuthPlaybookName.
  • The Block User playbook handles both string and numeric duration types (a type-handling fix was applied during review).
  • No Analytic Rules or Data Connectors were modified in this PR - detection coverage is unchanged.

Affected Files

Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Block_User_Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Block_User_Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Unblock_User_Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Unblock_User_Playbook/azuredeploy.json
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Volume_Online_Playbook/README.md
Solutions/NetApp Ransomware Resilience/Playbooks/NetApp-RansomwareResilience_Volume_Online_Playbook/azuredeploy.json
(packaging artefacts: 3.1.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_NetAppRansomwareResilience.json, createUiDefinition.json, mainTemplate.json)