In this video, I'd like to chat with you about the four triggers that we can
use
in combination with automation and playbooks on the 40 Analyzer.
Now, I mentioned these in the overview and it's going to briefly mention them
here,
and then we'll take a look at them in the interface on the 40 Analyzer.
And the four triggers are event trigger.
And what that means is that the playbook is run when an event is created that
matches the configured filters.
So based on the rules that are set up, if an event shows up, it matches the
filter,
it'll go ahead and trigger the playbook.
Another trigger is the incident trigger.
And that's where an incident is created. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's where an incident is created.
Now, that incident could be created by an event handler or it could be manually
created,
but based on the rules for the instant trigger, if they match those rules, that
would launch a playbook.
Another trigger would be on schedule, where the playbook is run during the
configured schedule.
And that would include detail like the start time, end time, interval, and the
interval frequency
for that schedule.
And then the last one is on demand.
And with an on demand trigger as part of a playbook, that means that an
administrator
actually clicked a button to make that playbook run.
It didn't happen automatically based on an event or an incident or based on a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It didn't happen automatically based on an event or an incident or based on a
schedule.
It's just because the administrator wanted that playbook to run.
And that's what caused it.
So let's take a look at some playbooks that are using some of these triggers.
So back at the 40 Analyzer to go to the automation section,
we're going to go down to incidents and events, go down to automation,
and then we'll go to playbook.
So let's look at a few examples.
How about this one right here?
I was playing with this earlier.
So for this one, the trigger is the event trigger.
So if we click on the pencil to edit it, effectively, this trigger says, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we click on the pencil to edit it, effectively, this trigger says,
if we have an event that comes in where the severity is greater than or equal
to high,
boom, this playbook is going to launch.
So at the moment, I have this playbook disabled.
We'll enable it a little bit later and see it in action.
But that's an example of an event trigger.
So we'll cancel that.
Let's go back to automation.
So most of these, not all of them, but most of them are on demand trigger.
So if we do a create new, that'll give us the option from scratch to specify
the trigger that we want to use.
So here are the four different triggers, event, incident, schedule, or on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here are the four different triggers, event, incident, schedule, or on
demand.
Then here for incident trigger, we can specify, for example, when an incident
is created, a new incident,
click OK there.
And we can also specify conditions.
So we could add a condition of if there's a new incident and the status is
equal to
closed, remediated, that would then be the trigger for the rest of the action
steps.
Maybe the action steps would be things like creating a new report, emailing
that to a particular individual.
In fact, I think of it, if we have the action of closed, remediated, that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In fact, I think of it, if we have the action of closed, remediated, that
wouldn't be with a new
incident. So let's go ahead and specify for the type and update.
There we go.
And we'll click on OK there.
And if that update is that that incident has now been closed, we can set it up
as a trigger.
So for this incident, if it's updated and it's set to close slash remediated,
maybe we want to have a report automatically run that includes that information
.
So we'll go ahead and save this.
So then based on this trigger, we can specify an action.
So let's go ahead and specify in a local host that we want to generate a report
.
So using the local connector and then the action would be to run a report and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So using the local connector and then the action would be to run a report and
then we'll go ahead
and specify the report we want to run.
And as far as the reports that show up here, it's reports from the report
section that have
caching enabled. So if you want a report to be able to run as part of a
playbook,
just make sure you hit the little checkbox for cached.
So let's run this IPS report or more likely a report that says, hey,
just or whatever report you want that's going to be generated automatically
based on this playbook.
So then we can add filters matching any condition or all conditions.
So let me add one filter criteria here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let me add one filter criteria here.
So do a plus and then for action, there's a section for 40 gate, a section for
40 mail,
a section for 40 analyzer, fantastic.
And here from the 40 analyzer list, we could specify the filters we want to use
.
So say client IP address equal to, let's say 10 dot 20 dot 0 dot 50.
And then for devices, we'll include all our 40 gates as part of that.
And we also do variables for that as well.
So for time period, let's go and do the previous seven days and click on, okay.
And for the connector, we're using the local connector and we'll click on, okay WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for the connector, we're using the local connector and we'll click on, okay
.
So that was a lot of squeezing for a little juice.
That's why a lot of the prebuilt templates we can use for the playbook.
So this will actually trigger based on those conditions from an incident.
And as a result, it'll run this report and then going back to triggers.
If we edit that and click back here, these are the four different trigger types
that we can use
that will launch effectively a playbook.