WEBVTT

1
00:00.000 --> 00:03.600
In this video, I'd like to chat with you about the four triggers that we can

2
00:03.600 --> 00:04.240
use

3
00:04.240 --> 00:07.440
in combination with automation and playbooks on the 40 Analyzer.

4
00:07.440 --> 00:10.000
Now, I mentioned these in the overview and it's going to briefly mention them

5
00:10.000 --> 00:10.160
here,

6
00:10.160 --> 00:12.800
and then we'll take a look at them in the interface on the 40 Analyzer.

7
00:12.800 --> 00:14.720
And the four triggers are event trigger.

8
00:14.720 --> 00:18.730
And what that means is that the playbook is run when an event is created that

9
00:18.730 --> 00:20.400
matches the configured filters.

10
00:20.400 --> 00:24.000
So based on the rules that are set up, if an event shows up, it matches the

11
00:24.000 --> 00:24.320
filter,

12
00:24.320 --> 00:26.160
it'll go ahead and trigger the playbook.

13
00:26.160 --> 00:28.560
Another trigger is the incident trigger.

14
00:28.560 --> 00:30.160
And that's where an incident is created.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.560 --> 00:30.160
And that's where an incident is created.

15
00:30.160 --> 00:34.160
Now, that incident could be created by an event handler or it could be manually

16
00:34.160 --> 00:34.480
created,

17
00:34.480 --> 00:38.720
but based on the rules for the instant trigger, if they match those rules, that

18
00:38.720 --> 00:40.080
would launch a playbook.

19
00:40.080 --> 00:43.570
Another trigger would be on schedule, where the playbook is run during the

20
00:43.570 --> 00:44.480
configured schedule.

21
00:44.480 --> 00:48.160
And that would include detail like the start time, end time, interval, and the

22
00:48.160 --> 00:49.280
interval frequency

23
00:49.280 --> 00:50.400
for that schedule.

24
00:50.400 --> 00:52.720
And then the last one is on demand.

25
00:52.720 --> 00:55.920
And with an on demand trigger as part of a playbook, that means that an

26
00:55.920 --> 00:56.640
administrator

27
00:56.640 --> 00:59.600
actually clicked a button to make that playbook run.

28
00:59.600 --> 01:03.480
It didn't happen automatically based on an event or an incident or based on a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.600 --> 01:03.480
It didn't happen automatically based on an event or an incident or based on a

29
01:03.480 --> 01:04.000
schedule.

30
01:04.000 --> 01:07.120
It's just because the administrator wanted that playbook to run.

31
01:07.120 --> 01:08.080
And that's what caused it.

32
01:08.080 --> 01:11.440
So let's take a look at some playbooks that are using some of these triggers.

33
01:11.440 --> 01:14.880
So back at the 40 Analyzer to go to the automation section,

34
01:14.880 --> 01:18.800
we're going to go down to incidents and events, go down to automation,

35
01:18.800 --> 01:20.640
and then we'll go to playbook.

36
01:20.640 --> 01:22.560
So let's look at a few examples.

37
01:22.560 --> 01:24.000
How about this one right here?

38
01:24.000 --> 01:25.360
I was playing with this earlier.

39
01:25.360 --> 01:28.160
So for this one, the trigger is the event trigger.

40
01:28.160 --> 01:32.080
So if we click on the pencil to edit it, effectively, this trigger says,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:28.160 --> 01:32.080
So if we click on the pencil to edit it, effectively, this trigger says,

41
01:32.080 --> 01:36.540
if we have an event that comes in where the severity is greater than or equal

42
01:36.540 --> 01:37.040
to high,

43
01:37.040 --> 01:39.120
boom, this playbook is going to launch.

44
01:39.120 --> 01:41.840
So at the moment, I have this playbook disabled.

45
01:41.840 --> 01:44.800
We'll enable it a little bit later and see it in action.

46
01:44.800 --> 01:47.120
But that's an example of an event trigger.

47
01:47.120 --> 01:48.160
So we'll cancel that.

48
01:48.160 --> 01:49.600
Let's go back to automation.

49
01:49.600 --> 01:53.120
So most of these, not all of them, but most of them are on demand trigger.

50
01:53.120 --> 01:57.600
So if we do a create new, that'll give us the option from scratch to specify

51
01:57.600 --> 01:58.640
the trigger that we want to use.

52
01:58.640 --> 02:03.440
So here are the four different triggers, event, incident, schedule, or on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.640 --> 02:03.440
So here are the four different triggers, event, incident, schedule, or on

53
02:03.440 --> 02:04.000
demand.

54
02:04.000 --> 02:07.210
Then here for incident trigger, we can specify, for example, when an incident

55
02:07.210 --> 02:09.360
is created, a new incident,

56
02:09.360 --> 02:10.320
click OK there.

57
02:10.320 --> 02:12.000
And we can also specify conditions.

58
02:12.000 --> 02:15.680
So we could add a condition of if there's a new incident and the status is

59
02:15.680 --> 02:16.240
equal to

60
02:16.240 --> 02:20.250
closed, remediated, that would then be the trigger for the rest of the action

61
02:20.250 --> 02:20.640
steps.

62
02:20.640 --> 02:24.720
Maybe the action steps would be things like creating a new report, emailing

63
02:24.720 --> 02:26.400
that to a particular individual.

64
02:26.400 --> 02:30.640
In fact, I think of it, if we have the action of closed, remediated, that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:26.400 --> 02:30.640
In fact, I think of it, if we have the action of closed, remediated, that

65
02:30.640 --> 02:32.000
wouldn't be with a new

66
02:32.000 --> 02:35.840
incident. So let's go ahead and specify for the type and update.

67
02:35.840 --> 02:36.480
There we go.

68
02:36.480 --> 02:38.080
And we'll click on OK there.

69
02:38.080 --> 02:42.820
And if that update is that that incident has now been closed, we can set it up

70
02:42.820 --> 02:43.440
as a trigger.

71
02:43.440 --> 02:47.280
So for this incident, if it's updated and it's set to close slash remediated,

72
02:47.280 --> 02:51.430
maybe we want to have a report automatically run that includes that information

73
02:51.430 --> 02:51.680
.

74
02:51.680 --> 02:53.360
So we'll go ahead and save this.

75
02:53.360 --> 02:56.480
So then based on this trigger, we can specify an action.

76
02:56.480 --> 02:59.790
So let's go ahead and specify in a local host that we want to generate a report

77
02:59.790 --> 02:59.920
.

78
02:59.920 --> 03:03.600
So using the local connector and then the action would be to run a report and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:59.920 --> 03:03.600
So using the local connector and then the action would be to run a report and

79
03:03.600 --> 03:04.080
then we'll go ahead

80
03:04.080 --> 03:05.840
and specify the report we want to run.

81
03:05.840 --> 03:09.480
And as far as the reports that show up here, it's reports from the report

82
03:09.480 --> 03:10.320
section that have

83
03:10.320 --> 03:13.570
caching enabled. So if you want a report to be able to run as part of a

84
03:13.570 --> 03:14.080
playbook,

85
03:14.080 --> 03:16.880
just make sure you hit the little checkbox for cached.

86
03:16.880 --> 03:20.480
So let's run this IPS report or more likely a report that says, hey,

87
03:20.480 --> 03:23.720
just or whatever report you want that's going to be generated automatically

88
03:23.720 --> 03:24.640
based on this playbook.

89
03:24.640 --> 03:28.320
So then we can add filters matching any condition or all conditions.

90
03:28.320 --> 03:30.640
So let me add one filter criteria here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:28.320 --> 03:30.640
So let me add one filter criteria here.

91
03:30.640 --> 03:35.580
So do a plus and then for action, there's a section for 40 gate, a section for

92
03:35.580 --> 03:36.400
40 mail,

93
03:36.400 --> 03:38.640
a section for 40 analyzer, fantastic.

94
03:38.640 --> 03:42.720
And here from the 40 analyzer list, we could specify the filters we want to use

95
03:42.720 --> 03:42.960
.

96
03:42.960 --> 03:47.680
So say client IP address equal to, let's say 10 dot 20 dot 0 dot 50.

97
03:47.680 --> 03:51.280
And then for devices, we'll include all our 40 gates as part of that.

98
03:51.280 --> 03:53.040
And we also do variables for that as well.

99
03:53.040 --> 03:59.040
So for time period, let's go and do the previous seven days and click on, okay.

100
03:59.040 --> 04:02.700
And for the connector, we're using the local connector and we'll click on, okay
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:59.040 --> 04:02.700
And for the connector, we're using the local connector and we'll click on, okay

101
04:02.700 --> 04:02.880
.

102
04:02.880 --> 04:05.600
So that was a lot of squeezing for a little juice.

103
04:05.600 --> 04:08.720
That's why a lot of the prebuilt templates we can use for the playbook.

104
04:08.720 --> 04:12.960
So this will actually trigger based on those conditions from an incident.

105
04:12.960 --> 04:16.240
And as a result, it'll run this report and then going back to triggers.

106
04:16.240 --> 04:20.560
If we edit that and click back here, these are the four different trigger types

107
04:20.560 --> 04:21.280
that we can use

108
04:21.280 --> 04:24.000
that will launch effectively a playbook.