About automation entities
2026-03-11Last updated
An automation entity is a repeatable process in Security Center SaaS. It consists of two parts: a trigger that defines what starts the automation, and a response that defines the actions that follow.
Key benefits of automation entities
You can do the following with automations:
- Trigger automations using combined events
- Use AND or OR logic to define how events are evaluated together
- Trigger automations when events occur a specific number of times within a set timeframe
- Trigger automations when events happen in a specific sequence within a set timeframe
- Create conditional triggers based on event data
- Include or exclude specific entities as event sources
- Run multiple response actions in a single automation
- Run actions with or without delays in between
- Run actions only if a subsequent event occurs within a defined delay after the triggering event
- Use event data to tailor actions
- Control when automations can run
- Set earliest and latest trigger dates
- Apply active and exception schedules
- Define reactivation rules
- Ignore obsolete events
- Manually trigger automations from maps
- Organize automations using folders and partitions
- Speed up system deployment with reusable automation logic
Current limitations
- Audit trails show that a change occurred but don’t yet show what was changed in triggers or responses.
- Some invalid settings may not be detected during configuration, so review your automation settings carefully.
- The Use source time zone option is not yet supported for event-based automations. This option is currently only available to event-to-actions.
- Activity trails are unavailable.
- You cannot set Source to any related entity.
- Execute response as is restricted to the user who created the automation.