About automation entities

2026-03-11Last updated

An automation entity is a repeatable process in Security Center SaaS. It consists of two parts: a trigger that defines what starts the automation, and a response that defines the actions that follow.

Key benefits of automation entities

You can do the following with automations:

  • Trigger automations using combined events
    • Use AND or OR logic to define how events are evaluated together
    • Trigger automations when events occur a specific number of times within a set timeframe
    • Trigger automations when events happen in a specific sequence within a set timeframe
  • Create conditional triggers based on event data
  • Include or exclude specific entities as event sources
  • Run multiple response actions in a single automation
    • Run actions with or without delays in between
    • Run actions only if a subsequent event occurs within a defined delay after the triggering event
    • Use event data to tailor actions
  • Control when automations can run
    • Set earliest and latest trigger dates
    • Apply active and exception schedules
    • Define reactivation rules
    • Ignore obsolete events
  • Manually trigger automations from maps
  • Organize automations using folders and partitions
  • Speed up system deployment with reusable automation logic

Current limitations

  • Audit trails show that a change occurred but don’t yet show what was changed in triggers or responses.
  • Some invalid settings may not be detected during configuration, so review your automation settings carefully.
  • The Use source time zone option is not yet supported for event-based automations. This option is currently only available to event-to-actions.
  • Activity trails are unavailable.
  • You cannot set Source to any related entity.
  • Execute response as is restricted to the user who created the automation.