Workflow triggers

Triggers start a workflow. They are either event-based (when a specific platform event occurs) or schedule-based (on a predefined schedule). They are grouped by category.

Users

• User disabled – Triggered when a user is disabled.
• User enabled – Triggered when a disabled user is re-enabled.
• User created – Triggered when a new user is created for the tenant.
• User deleted – Triggered when a user is deleted.

Devices

• Device registered – Triggered when a new device is successfully registered.

Alert

• Alert created – Triggered when any monitored service or system component generates a new alert.

Tenants

• Tenant created – Triggered when a new tenant is created.
• Tenant enabled – Triggered when a disabled tenant is re-enabled.

EDR

• EDR incident created – Triggered automatically when a new incident is created in the system.
• EDR incident updated – Triggered whenever an existing incident is updated.

Tasks

• Task completed – Triggered when a task finishes execution.

CyberApp integrations

• CyberApp enabled – Triggered when a CyberApp integration is enabled on a tenant.

Schedule

• Schedule – Runs the workflow automatically at a predefined interval (daily, weekly, or monthly). No platform event is required to initiate execution.