Configuring automation responses

After you define the triggers, define the actions that run when the automation is triggered.

What you should know

• Some actions in an automation response can be contextualized based on the event that triggered the automation.
• To run the response of one automation within another, add the Run an automation action.
• The system runs all response actions immediately when the automation is triggered. To stagger their execution, add delays between actions.

1. Select the automation and click the Properties tab.
2. In the Response section, click Add an item ().
3. Select an action type and set its arguments.
   You can contextualize actions by using arguments based on the data from the event that triggered the automation. For a full list of available actions, see Action types.

   Note:

   Actions previously reserved for threat levels can also be used in automation responses, with one caveat: they cannot be applied to All entities. For more information, see Threat level actions.
4. To pause the execution of actions for a certain time:
   1. Beside the Add an action button, click the down arrow.
   2. Select Add a delay, and enter the delay in hours, minutes, and seconds.
   3. Click OK.
5. Add more actions as necessary.
6. Click Apply.

After you finish

If the configuration is complete, right-click the automation in the entity tree and click Activate (). If not, configure the advanced settings.