Setting Up Actions

Configure automated responses that trigger when employees cross score thresholds or specific security events occur. Actions ensure threats are addressed promptly without manual intervention.

Action Configuration

Navigate to Admin → Actions to manage automated actions. The actions page shows all configured actions with their trigger conditions, status, and execution count.

Creating an Action

  1. Click Create Action
  2. Choose the trigger type:
    • Score threshold: Triggers when score enters a band
    • Event-based: Triggers on specific event types
    • Scheduled: Runs on a schedule (e.g., weekly training reminders)
  3. Configure the action type and parameters
  4. Set approval requirements (auto-execute or require approval)
  5. Activate the action

Available Action Types

ActionCategoryRequires Approval
Send email notificationNotificationNo
Send Slack/Teams messageNotificationNo
Create SOC ticketNotificationNo
Assign training moduleTrainingNo
Schedule coaching sessionTrainingNo
Require step-up MFAAccess ControlNo (default)
Revoke sessionsAccess ControlYes (default)
Restrict accessAccess ControlYes (default)
Lock accountAccess ControlYes (default)
Send webhookIntegrationNo
Approval Defaults
Actions that restrict employee access require security team approval by default. While this can be changed to auto-execute, we strongly recommend keeping approval enabled to prevent disruption from false positives.

Approval Workflow

When an action requires approval:

  1. The action is queued in Admin → Actions → Pending Approvals
  2. Designated approvers receive a notification
  3. An approver reviews the context (employee, score, triggering event)
  4. The action is approved or rejected with an optional comment

Action History

View all executed actions in Admin → Actions → History:

  • Timestamp and trigger details
  • Target employee
  • Action taken and result (success/failure)
  • Approval status and approver (if applicable)

Next Steps