Creating an Action

Open the Main Menu from the upper left-hand corner and choose the API Actions option under the EventWatch section.

The Action page allows you to set up an automatic workflow that occurs when behavior rules are triggered. Actions can be assigned to specific rules in order to specify when alerts should be forwarded to any desired users. Behavior actions define what actions should be performed when a certain behavior alert is triggered. Actions can be defined for multiple behavior rules, and multiple actions can be defined for a set of behavior rules.

Click "+ ACTION" button in the upper right corner of the list to add new behavior event action in the pop-up window.

The first field in this form is a name to describe what the action does. Next, select the behaviors (rules) that this behavior action should apply to. Next, select the Actor APIs you want to apply to the rules (defined in the second tab of API Actions page). Lastly, add condition and select any desired lambdas (optional). Lambdas can be used to perform more complex functions on an action.

In the second tab of API Actions page, APIs/endpoints information are given. You can also configure new action API by clicking the "+API CONFIG" button on the right side.

For example, an action with actor type “Email” will send an email to specified users when something occurs. An action with actor type “Slack” will send a Slack message to a specified channel when something occurs (refer to Slack).