Actions

Describes actions, schemas, parameters, and examples for automation, list management, IOC creation, and running automation tasks. Provides detailed structures and valid input formats.

Actions

Action steps perform specific operations like blocking IPs, creating indicators, or running other automations.

Add to List

Adds elements (IPs, domains, ranges) to security lists on Quantum Gateway.

Parameters Schema

{
  "element": string | ParamRef (required),
  "list": string (required),
  "exceptions_list": string (optional),
  "duration": TimeInterval | ParamRef (required),
  "add_reason": string (required)
}

Parameters Detail

element (string/ParamRef, required): IPv4 address to add to the list (must be valid IPv4 when not using parameter reference)
list (string, required): Target list name
- Valid values: Allowed Sources, Quarantined Sources, Blocked Sources, Blocked Destinations
exceptions_list (string, optional): Exception list name (same valid values as list)
duration (TimeInterval/ParamRef, required): How long to keep the element in the list
add_reason (string, required): Reason for adding the element

API Request

This schema defines the parameter structure for the API Request step when creating or updating automations via API.

API Request Step Parameters Schema

{
  "url": string | ParamRef* (required),
  "method": "GET" | "POST" | "PUT" | "PATCH" | "DELETE" (required),
  "headers": object (optional),
  "body": object (optional),
  "authentication_id": string (optional)
}

ParamRef is a reference to the Example Output of a previous step.

Example: To reference the src field from a previous step with ID 0540c6d7-456c-411b-a87e-3576c304d80e, use:
```
{{step[0540c6d7-456c-411b-a87e-3576c304d80e][src]}}
```
authentication_id is the ID of a pre-defined authentication.

For API details to retrieve authentications, see Appendix H - Webhooks and Authentications.

Step Schema Example

{
    "type": "API Request",
    "name": "My API Request",
    "parameters": {
        "url": "https://secure.myServerAPI/post",
        "method": "POST",
        "headers": {
            "x-Request-ID": 544
        },
        "body": {
            "Comment": "my post request"
        },
        "authentication_id": null,
    },
     "outputExample": {
          "my_post_request_output": {
              "name": " my_post_request_output",
              "output": {"success": true},
              "comment": ""
          }
      }
}

Create IOC Management Indicators

Creates multiple Indicators of Compromise (IOCs) in the threat intelligence system

Parameters Schema

{
  "indicators": IocIndicator[] | ParamRef (required),
  "expiration_in_days": number | ParamRef (required)
}

IoC Indicator Object

{
  "indicator_value": string | ParamRef (required),
  "indicator_type": string | ParamRef (required),
  "name": string | ParamRef (required),
  "description": string | ParamRef (optional),
  "confidence": "Low" | "Medium" | "High" (required),
  "severity": "Low" | "Medium" | "High" | "Critical" (required)
}

Parameters Detail

indicators (array/ParamRef, required): Array of IOC indicator objects
expiration_in_days (number/ParamRef, required): Days until indicators expire
indicator_type valid values: url, ip, domain, md5, sha256, sha1, ipv4

Example

{
  "type": "Create IOC Management Indicators",
  "name": "Create threat indicators",
  "parameters": {
    "indicators": [
      {
        "indicator_value": "{{step['Log Trigger']['malicious_ip']}}",
        "indicator_type": "ip",
        "name": "Suspicious IP from logs",
        "description": "IP detected in security logs",
        "confidence": "High",
        "severity": "Medium"
      }
    ],
    "expiration_in_days": 30
  }
}

Run Automation

Executes predefined automation templates with custom parameters.

Parameters Schema

{
  "automation_name": string (required),
  "automation_params": object (required),
  "input": object (required),
  "event_details": EventDetails (optional)
}

Parameters Detail

automation_name (string, required): Name of the automation to run
- Valid values: Block external IP, Quarantine internal IP, Open ticket and notify, Isolate Endpoint device
automation_params: Parameters specific to the chosen automation
input: Input data specific to the chosen automation
event_details (object, optional): Structured information to include with the automation execution. This allows you to pass additional context data that may be used by the target automation or included in its notifications.

Automation-Specific Schema

Block external IP

{
  "automation_params": {
    "Block reason": string (required),
    "IP block duration": TimeInterval | ParamRef (required),
    "Notification message": string (required),
    "Notification message (not added)": string (required),
    "Notification profile (IP was blocked)": string (required),
    "Notification profile (IP was not blocked)": string (required),
    "Notification subject": string (required),
    "Notification subject (not added)": string (required)
  },
  "input": {
    "Block IP": string | ParamRef (required)
  }
}

Quarantine internal IP

{
  "automation_params": {
    "Quarantine reason": string (required, max length: 300 characters),
    "IP quarantine duration": TimeInterval | ParamRef (required),
    "Notification message": string (required, max length: 600 characters),
    "Notification message (not added)": string (required, max length: 600 characters),
    "Notification profile (Device IP was quarantined)": string (required),
    "Notification profile (Device IP was not quarantined)": string (required),
    "Notification subject": string (required, max length: 300 characters),
    "Notification subject (not added)": string (required, max length: 300 characters),
    "Open ticket if device IP was quarantined": boolean | ParamRef (required)
  },
  "input": {
    "Quarantine IP": string | ParamRef (required)
  }
}

Open ticket and notify

{
  "automation_params": {
    "Open ticket": boolean | ParamRef (required),
    "Notification profile": string (required),
    "ServiceNow ticket type": string (required),
    "Jira ticket type": string (required)
  },
  "input": {
    "Notification subject": string | ParamRef (required, max length: 300 characters),
    "Notification message": string | ParamRef (required, max length: 600 characters),
    "Ticket subject": string | ParamRef (required, max length: 300 characters),
    "Ticket description": string | ParamRef (required, max length: 600 characters)
  }
}

Isolate Endpoint device

{
  "automation_params": {
    "Device isolation duration": TimeInterval | ParamRef (required),
    "Notification subject": string | ParamRef (required, max length: 300 characters),
    "Notification message": string (required, max length: 600 characters),
    "Open ticket if device was isolated": boolean | ParamRef (required),
    "Notification profile": string (required)
  },
  "input": {
    "type": "Endpoint Security" (required),
    "deviceName": string | ParamRef (required),
    "deviceIp": string | ParamRef (required),
    "machineId": string | ParamRef (required),
    "comment": string (required)
  }
}

Example

{
  "type": "Run Automation",
  "name": "Block external threat",
  "parameters": {
    "automation_name": "Block external IP",
    "automation_params": {
      "Block reason": "Automated blocking from threat detection",
      "IP block duration": {
        "value": 24,
        "unit": "hours"
      },
      "Notification message": "IP has been blocked due to suspicious activity",
      "Notification message (not added)": "IP could not be blocked",
      "Notification profile (IP was blocked)": "Immediate attention",
      "Notification profile (IP was not blocked)": "Immediate attention",
      "Notification subject": "External IP Blocked",
      "Notification subject (not added)": "External IP Block Failed"
    },
    "input": {
      "Block IP": "{{step['Log Trigger']['external_ip']}}"
    }
  }
}