Workflow actions

Action components automate action execution.

Notifications

• Send email to tenant admins – Sends an email notification to tenant administrators.
• Send email to users – Sends an email notification to one or more users.

General

• Delay – Delays workflow execution for a specified duration.

Users

• Create user – Creates a new user under the specified tenant.
• Configure notifications – Configures user notification settings.
• Manage user roles – Assigns or modifies user roles and permissions.

Alert

• Get alerts – Retrieves alerts and their payload properties based on the specified alert type.
• Get tenant from alert – Retrieves the tenant associated with the alert.
• Get workload from alert – Retrieves the workload associated with the alert.
• Dismiss alert – Dismisses the alert.

• Post custom alert - Creates a custom workflow alert with an optional device association.

Devices

• Get list of devices – Retrieves a list, for a specified tenant, of devices which host a specific workload type. The result includes device attributes such as name, IP addresses, and operating system.
• Apply protection plan – Applies a protection plan to the workload. The protection plan is taken from the list of existing ones.
• Revoke protection plan – Revokes the applied protection plan from the workload.
• Get backup status – Retrieves the current backup status of the workload.
• Run patch management – Initiates the patch management process on the device.
• Run script – Executes a script on the device. The script is taken from the list of existing ones.
• Get security status – Retrieves the current security status of the workload.
• Get device online status – Retrieves the online status of the workload, and the date and time it was last seen online.
• Run backup – Starts a backup task on the selected device.
• Get patch management status – Retrieves the patch management status of the device.
• Run vulnerability assessment – Runs a vulnerability assessment on the device.
• Run malware scan – Executes a malware scan on the device.

EDR

• Assign incident – Assigns the EDR incident to a specified user.
• Change state – Updates the state of the EDR incident.
• Quarantine – Quarantines the detected file or object.
• Stop process – Terminates a specified process on the workload.
• Add comment – Adds a comment to the EDR incident.
• Isolate device – Isolates the workload from the network.