hydden.docs

# Workflows use triggers. Each trigger comes with a set of available variables to be configured for the specific action use case. Below is the list of available triggers and their variables. Use these variables in the respective Payload, Body, or Description text fields on the add/edit workflow modals.

Variables are auto displayed when the { is entered into the Payload/Body/Description field.

For Threat Detection

Threat detected Threat resolved
{Title}
{ThreatID}
{ThreatName}
{JobTime}
{Platform}
{Name}
{Site}
{Status}
{Options}
{Accounts}
{Names}
{Ids}
{Score}
{ActiveAccounts}
{InactiveAccounts}		 “{Title}
{ThreatID}
{ThreatName}
{JobTime}
{Platform}
{Name}
{Site}
{Status}
{Options}
{Accounts}
{Names}
{Ids}
{Score}
{ActiveAccounts}
{InactiveAccounts}

[!Note] To activate the workflow and threat rule association, enable the Allow Workflow Trigger checkbox on the add/edit Threat Detection Rule modal.

img

For Collection Status

Collection successful Collection failed
{Title}
{JobID}
{JobName}
{JobType}
{JobTime}
{Platform}
{Name}
{Site}
{LastRun}
{LastClient}
{NextRun}
{Status}		 {Title}
{JobID}
{JobName}
{JobType}
{JobError}
{JobTime}
{Platform}
{Name}
{Site}
{LastRun}
{LastClient}
{NextRun}
{Status}

Data Validation Status

Data validation successful Data validation failed
{Title}
{JobID}
{JobName}
{JobType}
{JobError}
{JobTime}
{Platform}
{Name}
{Site}
{LastRun}
{LastClient}
{NextRun}
{Status}		 {Title}
{JobID}
{JobName}
{JobType}
{JobTime}
{Platform}
{Name}
{Site}
{LastRun}
{LastClient}
{NextRun}
{Status}

Classification Status

Classification added Classification removed
{Title}
{ClassificationID}
{ClassificationName}
{JobTime}
{Platform}
{Name}
{Site}
{Status}
{Options}
{Accounts}
{Names}
{Ids}
{Score}
{ActiveAccounts}
{InactiveAccounts}		 {Title}
{ClassificationID}
{ClassificationName}
{JobTime}
{Platform}
{Name}
{Site}
{Status}
{Options}
{Accounts}
{Names}
{Ids}
{Score}
{ActiveAccounts}
{InactiveAccounts}