---
title: "Key Concepts for Automation"
slug: "key-concepts-automation"
updated: 2026-09-09T16:09:40Z
published: 2026-09-09T16:09:40Z
canonical: "docs.redcanary.com/key-concepts-automation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Concepts for Automation

# Key concepts

There are several key elements that comprise automation: Triggers, Playbooks, and Actions.

## Triggers

**Triggers** describe when automation should begin. Triggers start with an event (such as **When a threat is published** or **When an Endpoint status changes**) and can be limited by **conditions** such as **and Threat Severity is....** Each trigger can be linked to one or more playbooks, making both triggers and playbooks highly reusable.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/time threat(1).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A53%3A28Z&se=2026-11-01T17%3A53%3A28Z&sr=c&sp=r&sig=%2BrkPGoVzzNB1eFoOUICLq9%2BWKgce9141dwy29p3ew1I%3D)

## Playbook

**Playbooks** are a group of actions you want to take to achieve a goal. Playbooks can range from the simple (**“Email my security mailing list”**) to the complex (**“Notify an on-call phone tree, network isolate any affected endpoints, and begin remediation.”**)

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/action(1).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A53%3A28Z&se=2026-11-01T17%3A53%3A28Z&sr=c&sp=r&sig=%2BrkPGoVzzNB1eFoOUICLq9%2BWKgce9141dwy29p3ew1I%3D)

## Action

An **action** is the specific action taken by the automation, whether sending an email, calling a phone, changing a firewall rule, or sending an alert to your Security information and event management (SIEM). Zscaler MDR’s supported actions are constantly expanding as we enable new integrations.

#