Predefined Automations

This topic lists predefined automations available in the system. It provides links to automation actions triggered by various security detections and events.

Playblocks has these predefined automations:

• Block attackers upon IPS detection of popular attacks

• Block common scanner identified by IPS

• Block attacking IP with malicious reputation identified by IPS

• Block attacking IP with malicious reputation identified by WAF Application Security Application Security

• Quarantine compromised Endpoint Security device (enforced by Firewall)

• Quarantine potentially infected Endpoint Security device (enforced by Firewall)

• Notify on Firewall Traffic Blocked by Check Point SASE

• Notify on URL filtering blocked by Check Point SASE

• Notify on URL Reputation Identification by Check Point SASE

• Notify on Tunnel Up by Check Point SASE

• Notify on Tunnel Down by Check Point SASE

• Notify on Malicious File Detection by Check Point SASE

• Block malicious file indicator identified by Threat Extraction Endpoint Security

• Block malicious file indicator identified by Threat Emulation Endpoint Security

• Block malicious file indicator identified by Anti-Bot Endpoint Security

• Block malicious URL indicator identified by Anti-Bot Endpoint Security

• Block malicious indicator identified by Anti-Bot

• Block malicious indicator identified by Anti-Virus

• Block malicious indicator identified by Zero Phishing Endpoint Security

• Block malicious indicator identified by Zero Phishing

• Isolate compromised Endpoint Security device (enforced by Endpoint)

• Isolate potentially Infected Endpoint Security device (enforced by Endpoint)

• Isolate potentially infected SentinelOne device (enforced by Endpoint)

• Isolate potentially infected CrowdStrike device (enforced by Endpoint)

• Quarantine potentially infected SentinelOne device (enforced by Firewall)

• AI Agent - Management health report

• Isolate potentially infected Microsoft Defender device (enforced by Endpoint)

• Quarantine potentially infected Microsoft Defender device (enforced by Firewall)

• Credentials leakage detected by External Risk Management triggering reset password

• Quantum Cloud Log Ingestion Health Monitor

• Repeated Remote Access login failures using password-only

• Repeated Remote Access login to expired accounts

• Remote Access user login using password-only Authentication

• Block DDoS attack detected by DDoS Protector

• Quarantine potentially infected CrowdStrike device (enforced by Firewall)

• De-isolate potentially clean Microsoft Defender machine

• Notify on Failed GAIA Portal Login

• Notify on Expert Shell Login

• Notify on Run Script execution

• Notify on failure of Policy Installation on Check Point Firewall

• Notify on degradation in Check Point Firewall Compliance status

• Notify on successful Policy Installation on Check Point Firewall

• Notify on changes in administrators

• Alert on MTA email bypass

• Notify on Management validations

• Notify on Management High Availability Change-Over

• Notify on repeated login failures to Management

• Notify on high rate of blocked connections

• Notify on failure of installation of blades updates on Check Point Firewalls

• Notify on successful installation of blade updates on Check Point Firewalls

• Alert on licenses expiration on Quantum device

• Alert on VPN certificates expiration on Check Point Firewall

• Alert if VPN Tunnel is down

• Alert if no communication with Check Point Firewall

• Notify on non-compliant devices blocked by Identity and Trust

• Block external IP

• Isolate Endpoint device

• Quarantine internal IP

• Enforce Policy on newly discovered IoT Zone

• IoT Device is at risk

• Notify on Endpoint Security client uninstall password change

• Notify on bulk uninstallation of Endpoint Security clients

• Notify on repeated login failures to user Windows device

• Reset User Password in Identity Provider

• Delete file on Endpoint Security device

• Terminate process on Endpoint Security device

• Scan Endpoint Security Device

• IoC Management - New indicator

• IoC Management - Delete indicator

• Stop and quarantine file via Microsoft Defender

• Scan machine via Microsoft Defender

• Isolate machine via Microsoft Defender (by XDR)

• Release machine from isolation via Microsoft Defender (by XDR)

• Stop and quarantine file via Microsoft Defender (by XDR)

• Handle SD-WAN Link Swap ISP Down

• Open ticket

• Close ticket

• Get ticket

• Open ticket and notify

• Spark Management event

• Alert on ransomware attack detected by Endpoint Security

• Alert on Generative AI Risky Session

• Alert on a phishing attempt detected by Endpoint Security

• Alert on malicious file detected by Endpoint Security

• Alert on access to malicious site detected by Endpoint Security

• Alert on password reuse attempt detected by Endpoint Security

• Alert on exploit attempt detected by Endpoint Security

• Alert on the outdated Endpoint Security Static Analysis capability

• Alert on the outdated Endpoint Security Offline Reputation capability

• Alert on outdated Endpoint Security Behavioral Guard capability

• Alert on disconnected Endpoint Security clients

• Alert on Endpoint Security Compliance warnings

• Alert on device restrictions by Endpoint Security

• Alert on outdated Endpoint Security Anti-Malware

• Alert if the device is not scanned by the Endpoint Security Anti-Malware capability

• Alert on Endpoint Security Anti-Malware license expiration

• Alert on Endpoint Security deployment failure

• Alert if Endpoint Security client capabilities stop running

• Add malicious file indicator Identified by CrowdStrike to IoC feed

• Add malicious file indicator Identified by SentinelOne to IoC feed

• Add malicious file indicator Identified by Microsoft Defender to IoC feed

• Notify on AIOps alert