Triggers

This topic describes trigger types and their parameters for automation workflows. It includes log, schedule, and webhook triggers with detailed parameter schemas and examples.

Triggers

Trigger steps define how and when an automation starts.

Log Trigger

Monitors log sources and triggers automation when specified conditions are met.

Parameters Schema


{
  "filter": string (required),
  "interval": TimeInterval (required),
  "log_type": string (required),
  "source": string (required),
  "conditions": LogTriggerCondition[] (optional)
}

Parameters Detail

  • filter (string, required): Log filter query using the log search syntax

  • interval (TimeInterval, required): How frequently to check for new logs (minimum 15 seconds)

    
{
"value": number,
"unit": "seconds" | "minutes" | "hours" | "days"
}

  • log_type (string, required): Type of logs to monitor

    • Valid values: "logs", "audit"

  • source (string, required): Log source to monitor

    • Valid values: Quantum Management, Endpoint Security, Quantum SD-WAN, CloudGuard WAF, Email Security, SASE

  • conditions (array, optional): Additional conditions to apply to the logs

Log Trigger Condition Types

  • Check List

    Verify if field values exist in predefined lists.

    
{
  "type": "Check List",
  "parameters": {
    "value_to_check": string (optional),
    "lists": string[] (optional)
  }
}

    Parameter Details:

    • value_to_check (string, optional): The log field name whose value should be checked against the selected lists

    • lists (array, optional): Names of predefined lists to check against

      • Valid lists values: Allowed Sources, Quarantined Sources, Blocked Sources, Blocked Destinations, Isolated Devices, Playblocks IOCs

  • value_to_check (string, optional): The log field name whose value should be checked against the selected lists

  • lists (array, optional): Names of predefined lists to check against

    • Valid lists values: Allowed Sources, Quarantined Sources, Blocked Sources, Blocked Destinations, Isolated Devices, Playblocks IOCs

  • Valid lists values: Allowed Sources, Quarantined Sources, Blocked Sources, Blocked Destinations, Isolated Devices, Playblocks IOCs

  • Check Fields Values

    Match, contains, or exclude field values.

    
{
  "type": "Check Fields Values",
  "parameters": {
    "match_check": [{"field": string, "value": string}],
    "contains_match_check": [{"field": string, "value": string}],
    "not_match_check": [{"field": string, "value": string}]
  }
}

    Parameter Details:

    • match_check (string, optional): Array of field-value pairs that must match exactly. The log will only trigger if all specified fields have exactly the specified values.

    • contains_match_check (array, optional): Array of field-value pairs where the field must contain the specified value as a substring. Useful for partial text matching.

    • not_match_check (array, optional): Array of field-value pairs that must not match. The log will only trigger if none of the specified fields have the specified values.

  • match_check (string, optional): Array of field-value pairs that must match exactly. The log will only trigger if all specified fields have exactly the specified values.

  • contains_match_check (array, optional): Array of field-value pairs where the field must contain the specified value as a substring. Useful for partial text matching.

  • not_match_check (array, optional): Array of field-value pairs that must not match. The log will only trigger if none of the specified fields have the specified values.

  • Check Fields Exist

    Verify that specific fields exist in the log.

    
{
 "type": "Check Fields Exist",
 "parameters": {
 "fields": string[]
 }
}

    Parameter Details:

    fields (array, required): Array of log field names that must be present in the log entry. The condition will only be satisfied if all specified fields exist in the log, regardless of their values.

  • Count Logs

    Count logs based on criteria.

    
{
 "type": "Count Logs",
 "parameters": {
 "expression_1": {
 "function": "CountDistinct" | "CountOccurrences",
 "value": string | ParamRef
 },
 "operator": "Equal to" | "Not equal to" | "Greater than" | "Greater than or equal to" | "Less than" | "Less than o",
 "expression_2": number | AutoParamRef,
 "time_frame": TimeInterval | ParamRef,
 "enrich_logs_with_fields": string[] | ParamRef (optional)
 }
}

    Parameter Details:

    • expression_1 (object, required): Defines what to count in the logs

      • function: CountDistinct counts unique values, CountOccurrences counts total occurrences

      • value: The log field name to count (example, source_ip to count unique IP addresses)

    • operator (string, required): Comparison operator for the count condition

    • expression_2 (number/AutoParamRef, required): The threshold number to compare against

    • time_frame (TimeInterval/ParamRef, required): Time window for counting logs (for example, count logs in the last 5 minutes)

    • enrich_logs_with_fields (array, optional): Additional log fields to include in the trigger output for context

  • expression_1 (object, required): Defines what to count in the logs

    • function: CountDistinct counts unique values, CountOccurrences counts total occurrences

    • value: The log field name to count (example, source_ip to count unique IP addresses)

  • function: CountDistinct counts unique values, CountOccurrences counts total occurrences

  • value: The log field name to count (example, source_ip to count unique IP addresses)

  • operator (string, required): Comparison operator for the count condition

  • expression_2 (number/AutoParamRef, required): The threshold number to compare against

  • time_frame (TimeInterval/ParamRef, required): Time window for counting logs (for example, count logs in the last 5 minutes)

  • enrich_logs_with_fields (array, optional): Additional log fields to include in the trigger output for context

  • Alert Again

    Control re-alerting behavior.

    
{
 "type": "Alert Again",
 "parameters": {
 "alert_again_time": TimeInterval | ParamRef,
 "log_fields_for_key": string[] (optional),
 "log_fields_for_value": string[] (optional)
 }
}

    Parameter Details:

    • alert_again_time (TimeInterval/ParamRef, required): Time interval that must pass before the same alert can be triggered again

    • log_fields_for_key (array, optional): Log field names used to create a unique identifier (key)

    • log_fields_for_value (array, optional): Log field names used to create a unique identifier value