Home
Automations
This topic describes the Automations page and its interface elements. It provides details about automation categories, views, filtering options, and automation card components.
Customization in Playblocks
Playblocks provides flexible customization options to tailor automations according to your organization's needs.
Alert Steps
Alert steps let an automation drive an incident through its full on-call lifecycle in PagerDuty and other alerting platforms behind the same vendor-neutral steps.

Important Information
Introduction to Playblocks
This topic introduces the automated response capabilities of PlayBlocks and its integration with collaborative tools. It provides an overview of how PlayBlocks helps protect organizations from cyber attacks.
Getting Started
This topic describes the initial steps required to begin working with PlayBlocks. It provides links to create an account, access the portal, license the product, and onboard services.
Video Tutorials
Overview
This topic describes the Overview page, which displays key information and statistics about Playblocks. It explains how to access the Overview page and view its data.
Automations
This topic describes the Automations page and its interface elements. It provides details about automation categories, views, filtering options, and automation card components.
- Automation Parameters and Flowchart
  This topic describes the Automation Parameters and Flowchart page and outlines the items displayed in the interface. It also provides steps to access the automation details.
- Predefined Automations
  This topic lists predefined automations available in the system. It provides links to automation actions triggered by various security detections and events.
- Configuring the Automation Parameters
  This topic describes how to configure automation parameters in Playblocks and how to reset them to default values.
- Running the Automation
  This topic describes how to manually run an automation for evaluation and verification purposes. It provides step-by-step instructions for accessing, configuring, and executing an automation.
- Enabling the Automation
  This topic describes how to enable an automation in Playblocks. Automations are enabled by default but can be manually activated.
- Approving, Rejecting or Reverting an Automation Execution
  This task explains how to approve, reject, or revert an automation execution through communication channels or the Pending Actions page.
- Customization in Playblocks
  Playblocks provides flexible customization options to tailor automations according to your organization's needs.
  - Creating Automation from Blank
    Creating an automation from blank allows you to build fully customized flows from scratch and tailor every step to your specific use case.
  - Log Trigger
    Configure a Log Trigger to monitor logs, define conditions, and create example outputs for automation workflows.
  - Schedule Trigger
    Configure a schedule trigger to run automation at recurring intervals. The task explains how to select the repetition frequency and create the trigger.
  - Managing Trigger
    Learn how to manage a trigger by adding notifications, enrichments, conditions, or actions.
  - Notifications
    Configure notification actions including Notify, Ask, and Open Ticket options. This task explains how to create and customize notification messages and ticket actions.
  - Alert Steps
    Alert steps let an automation drive an incident through its full on-call lifecycle in PagerDuty and other alerting platforms behind the same vendor-neutral steps.
    - Trigger Alert
      The Trigger Alert step opens a new incident in PagerDuty. If an open incident with the same Alert ID already exists, PagerDuty returns the existing incident and does not create a duplicate.
    - Get Alert
      The Get Alert step reads the current state of an existing incident in PagerDuty.
    - Acknowledge Alert
      The Acknowledge Alert step pauses escalation on an open incident in PagerDuty.
    - Add Note to Alert
      The Add Note to Alert step posts a free-text note to an existing incident in PagerDuty.
    - Resolve Alert
      The Resolve Alert step closes an incident in PagerDuty.
  - Enrichments
    Use enrichment steps to query the Reputation Service for IP addresses, URLs, or file hashes from previous step outputs. The enrichments provide threat intelligence data about the selected value.
  - Conditions
    Use conditions to create branches in the automation flow based on logical evaluations. This task explains how to configure condition expressions and operations.
  - Actions
    Action steps perform operational tasks such as running automations, managing indicators, and sending external API requests.
  - Run Automation
    Run an automation action and configure automation parameters and inputs for supported automation types.
  - Add to List
    Use the Add to List procedure to add IPs, URLs, domains, or hashes to a list with optional conditions and duration settings.
  - Create IoC Management Indicators
    Create IoC Management indicators by specifying indicator values and expiration settings in the Create IoC Management Indicators window.
  - API Request
    Configure an API Request action in an automation and define the example output structure for API responses.
  - AI Request
    Use the AI Request step to send a prompt to a connected AI provider and use the model's response in subsequent steps.
  - Isolate Endpoint Device
    Configure and create an isolation action for an endpoint device. Specify the endpoint product, device details, isolation duration, and reason for isolation.
  - Scan Endpoint Security Device
    Scan an Endpoint Security device by configuring target identification, scan options, and scheduling parameters.
  - Terminate Process on Endpoint Security Device
    Terminate a process on an Endpoint Security device by configuring target details and action settings.
  - Delete File on Endpoint Security Device
    Delete a file on an Endpoint Security device by configuring the target device and file path settings. This task explains how to create the delete file action.
  - Exporting/Importing Automation
    You can export and import an automation in JSON format. This task explains how to export an automation and import an automation file.
  - Cloning Existing Automation
    You can clone an existing automation for editing and customization. This task explains how to clone an automation from the card view and table view.
  - Automation Capabilities
    This topic describes the different automation capability types, their use cases, abilities, and editing restrictions.
  - Replace Trigger
    Replace Trigger allows you to change the current trigger type in your automation to a different one. This topic explains how to replace a trigger, configure the new trigger, and resolve validation errors.
  - Adding a Step to the Middle of an Automation
    You can add new steps between existing steps in an automation to extend the flow without creating a new automation. When you add a Condition or Ask step, you must specify how the automation continues to the next step.
- Webhooks
  This topic describes how webhooks enable third-party systems to trigger automations. It outlines common uses for out-of-the-box, custom, and cloned automations.
- Authentications
Monitor
This topic describes the Monitor page, which displays statistics and visual widgets showing automation activity and prevention data. It summarizes the available monitoring views and their functions.
Executions
This topic describes the Executions page and how to access it. It provides an overview of the information shown for executed automations.
Pending Actions
This topic describes the Pending Actions page, which lists automation executions awaiting approval. It also explains how to access this page in Playblocks.
Lists
This topic describes the Lists page, which shows various types of destinations, sources, devices, and identities managed by the system. It explains the purpose of each list category.
Connectors
This topic describes connectors used in Playblocks and explains how they support automatic incident response and collaboration. It also shows how to access the Connectors page and identifies automatically connected products.
Notifications
The Notifications page provides options to manage who receives notifications and how they are delivered. It also displays legends describing available actions and views.
Appendix
This appendix provides links to supporting procedures for integrating various external services with Check Point Playblocks. It lists additional configuration resources for multiple platforms.

Alert Steps

Alert steps let an automation drive an incident through its full on-call lifecycle in PagerDuty and other alerting platforms behind the same vendor-neutral steps.

The Alert steps let an automation drive an incident through its full on-call lifecycle in PagerDuty (and, in the future, in other alerting platforms behind the same vendor-neutral steps). The Alert steps appear under the Alerting tab in the step picker and are available after you configure the PagerDuty connector.

There are five Alert steps:

Trigger Alert - Open a new incident.
Get Alert - Read the current state of an incident.
Acknowledge Alert - Pause escalation on an open incident.
Add Note to Alert - Attach a free-text note to an incident.
Resolve Alert - Close an incident.

Common Fields

Two fields appear across all five Alert steps and behave the same way.

Provider

Every Alert step has a Provider dropdown at the top of its side panel. The Provider field determines which alerting platform receives the request.

Alert ID

The Alert ID is a vendor-neutral identifier that ties Trigger, Acknowledge, Resolve, Get, and Add Note events to the same logical incident.

Note:

Alert IDs are capped at 255 characters.

03 July 2026

© 2023 - 2026 Check Point Software Technologies Ltd.