Key concepts

There are several key elements that comprise automation: Triggers, Playbooks, and Actions.

Triggers

Triggers describe when automation should begin. Triggers start with an event (such as When a threat is published or When an Endpoint status changes) and can be limited by conditions such as and Threat Severity is.... Each trigger can be linked to one or more playbooks, making both triggers and playbooks highly reusable.

Playbook

Playbooks are a group of actions you want to take to achieve a goal. Playbooks can range from the simple (“Email my security mailing list”) to the complex (“Notify an on-call phone tree, network isolate any affected endpoints, and begin remediation.”)

Action

An action is the specific action taken by the automation, whether sending an email, calling a phone, changing a firewall rule, or sending an alert to your Security information and event management  (SIEM). Red Canary’s supported actions are constantly expanding as we enable new integrations.