.. include:: /includes.txt ============== Events trigger ============== You can trigger the execution of workflows from an internal Zercurity event. Below is a list of all the events you can hook to trigger a workflow. ============================= ================================== Event enum Description ============================= ================================== API_KEY_CREATE A new API key has been added to the company account. API_KEY_UPDATE The API key's name has been updated. API_KEY_REMOVE The API key has been removed. ASSET_CREATE A new asset has been enrolled. ASSET_UPDATE The asset's name has been changed. ASSET_REMOVE The asset has been removed. ASSET_RISK The asset's risk score has changed. ASSET_LOGIN New remove login event for a given asset ASSET_APPLICATION A new application not previously seen on the asset ASSET_DEVICE A new device not previously seen on the asset ASSET_PACKAGE A new package not previously seen on the asset ASSET_VULNERABILITY A new vulnerability not previously seen on the asset ASSET_PROCESS A newly executed process with either a risk > 10. Or triggering a quarantine event. ASSET_UPGRADE Asset has a new update available ASSET_COMPLIANCE The state of a given compliance rule has changed. ASSET_POLICY The state of a given compliance policy has changed. ASSET_LEGAL The state of a given compliance legal check has changed. ASSET_DISCOVERED_CREATE A new asset has been added to the asset discovery list. ASSET_DISCOVERED_UPDATE A discovered asset has been updated. ASSET_DISCOVERED_REMOVE A discovered asset has been removed by a user. COMPANY_CREATE A new company has been create by a user. Usually only seen upon registration. COMPANY_UPDATE The company name has been updated. COMPANY_REMOVE The company and its resources have been deleted. COMPANY_SUBSCRIPTION_CREATE A subscription has been created for billing. COMPANY_SUBSCRIPTION_UPDATE The number of assets licensed has changed. COMPANY_SUBSCRIPTION_REMOVE Billing has been removed for a given company. COMPLIANCE_CREATE A new compliance framework has been created. COMPLIANCE_UPDATE A compliance framework has been updated. COMPLIANCE_REMOVE A compliance framework has been removed. COMPLIANCE_RULE_CREATE A compliance rule has been added to a framework. COMPLIANCE_RULE_UPDATE A compliance rule for a given framework has been updated. COMPLIANCE_RULE_REMOVE A compliance rule has been removed from a framework. INTEGRATION_CREATE A new system integration to a 3rd party provider has been added by a user. INTEGRATION_UPDATE The integration has been updated. INTEGRATION_REMOVE The integration has been removed. ISSUE_CREATE A new issue has been raised. ISSUE_UPDATE The issue has been updated. ISSUE_REMOVE The issue has been removed. ISSUE_COMPONENT_CREATE A new component has been added to an issue. ISSUE_COMPONENT_UPDATE A component has been updated on an issue. ISSUE_COMPONENT_REMOVE A component has been removed from an issue. ISSUE_COMMENT_CREATE A new comment has been added to an issue. ISSUE_COMMENT_UPDATE A comment has been updated for an issue. ISSUE_COMMENT_REMOVE A comment has been removed from an issue OSQUERY_CREATE A new Osquery job has been started. Either live or scheduled. OSQUERY_UPDATE The Osquery job has been either paused or un-paused. OSQUERY_REMOVE The Osquery job and its results have been deleted. TEAM_CREATE A new team has been added to the company. TEAM_UPDATE The team name has been updated. TEAM_REMOVE The team has been removed. USER_CREATE A new user has been added to the company. USER_UPDATE The user's name has been updated. USER_REMOVE The user has been removed. USER_REGISTER A new user has registered. USER_LOGIN A user has logged on to the platform. If this event carries a WARNING then the login attempt failed. USER_LOGOUT A user has logged-out from the platform. USER_PASSWORD_RESET A user's password has been successfully reset. USER_CONFIGURATION_CREATE The user has added a new preference to their account. USER_CONFIGURATION_UPDATE The user has updated a preference. USER_CONFIGURATION_REMOVE The user has removed a preference, which will restore it to its default. SANTA_CREATE A new santa ruleset has been created. SANTA_UPDATE The Santa ruleset has been updated. SANTA_REMOVE The Santa ruleset and its rules have been removed. SANTA_RULE_CREATE A new rule has been added to a Santa ruleset. SANTA_RULE_UPDATE The rule has been updated. SANTA_RULE_REMOVE The rule has been removed. FIM_CREATE A new FIM rule has been created. FIM_UPDATE The FIM rule has been updated. FIM_REMOVE The FIM rule has been removed. WORKFLOW_CREATE A new Workflow has been created. WORKFLOW_UPDATE The workflow configuration has changed. WORKFLOW_REMOVE The workflow has been removed. WORKFLOW_CONFIGURATION_CREATE The workflow has had a new configuration change added to the workflow. WORKFLOW_CONFIGURATION_UPDATE The workflow's configuration has been updated. WORKFLOW_CONFIGURATION_REMOVE The workflow configuration has been removed and reset to its default. WORKFLOW_EXECUTION_CREATE A new workflow execution has started. WORKFLOW_EXECUTION_UPDATE The state of the workflow execution has been updated. WORKFLOW_EXECUTION_REMOVE The workflow execution has been removed. ============================= ==================================