Events trigger

You can trigger the execution of workflows from an internal Zercurity event. Below is a list of all the events you can hook to trigger a workflow.

Event enum

Description

API_KEY_CREATE

A new API key has been added to the company account.

API_KEY_UPDATE

The API key’s name has been updated.

API_KEY_REMOVE

The API key has been removed.

ASSET_CREATE

A new asset has been enrolled.

ASSET_UPDATE

The asset’s name has been changed.

ASSET_REMOVE

The asset has been removed.

ASSET_RISK

The asset’s risk score has changed.

ASSET_LOGIN

New remove login event for a given asset

ASSET_APPLICATION

A new application not previously seen on the asset

ASSET_DEVICE

A new device not previously seen on the asset

ASSET_PACKAGE

A new package not previously seen on the asset

ASSET_VULNERABILITY

A new vulnerability not previously seen on the asset

ASSET_PROCESS

A newly executed process with either a risk > 10. Or triggering a quarantine event.

ASSET_UPGRADE

Asset has a new update available

ASSET_COMPLIANCE

The state of a given compliance rule has changed.

ASSET_POLICY

The state of a given compliance policy has changed.

ASSET_LEGAL

The state of a given compliance legal check has changed.

ASSET_DISCOVERED_CREATE

A new asset has been added to the asset discovery list.

ASSET_DISCOVERED_UPDATE

A discovered asset has been updated.

ASSET_DISCOVERED_REMOVE

A discovered asset has been removed by a user.

COMPANY_CREATE

A new company has been create by a user. Usually only seen upon registration.

COMPANY_UPDATE

The company name has been updated.

COMPANY_REMOVE

The company and its resources have been deleted.

COMPANY_SUBSCRIPTION_CREATE

A subscription has been created for billing.

COMPANY_SUBSCRIPTION_UPDATE

The number of assets licensed has changed.

COMPANY_SUBSCRIPTION_REMOVE

Billing has been removed for a given company.

COMPLIANCE_CREATE

A new compliance framework has been created.

COMPLIANCE_UPDATE

A compliance framework has been updated.

COMPLIANCE_REMOVE

A compliance framework has been removed.

COMPLIANCE_RULE_CREATE

A compliance rule has been added to a framework.

COMPLIANCE_RULE_UPDATE

A compliance rule for a given framework has been updated.

COMPLIANCE_RULE_REMOVE

A compliance rule has been removed from a framework.

INTEGRATION_CREATE

A new system integration to a 3rd party provider has been added by a user.

INTEGRATION_UPDATE

The integration has been updated.

INTEGRATION_REMOVE

The integration has been removed.

ISSUE_CREATE

A new issue has been raised.

ISSUE_UPDATE

The issue has been updated.

ISSUE_REMOVE

The issue has been removed.

ISSUE_COMPONENT_CREATE

A new component has been added to an issue.

ISSUE_COMPONENT_UPDATE

A component has been updated on an issue.

ISSUE_COMPONENT_REMOVE

A component has been removed from an issue.

ISSUE_COMMENT_CREATE

A new comment has been added to an issue.

ISSUE_COMMENT_UPDATE

A comment has been updated for an issue.

ISSUE_COMMENT_REMOVE

A comment has been removed from an issue

OSQUERY_CREATE

A new Osquery job has been started. Either live or scheduled.

OSQUERY_UPDATE

The Osquery job has been either paused or un-paused.

OSQUERY_REMOVE

The Osquery job and its results have been deleted.

TEAM_CREATE

A new team has been added to the company.

TEAM_UPDATE

The team name has been updated.

TEAM_REMOVE

The team has been removed.

USER_CREATE

A new user has been added to the company.

USER_UPDATE

The user’s name has been updated.

USER_REMOVE

The user has been removed.

USER_REGISTER

A new user has registered.

USER_LOGIN

A user has logged on to the platform. If this event carries a WARNING then the login attempt failed.

USER_LOGOUT

A user has logged-out from the platform.

USER_PASSWORD_RESET

A user’s password has been successfully reset.

USER_CONFIGURATION_CREATE

The user has added a new preference to their account.

USER_CONFIGURATION_UPDATE

The user has updated a preference.

USER_CONFIGURATION_REMOVE

The user has removed a preference, which will restore it to its default.

SANTA_CREATE

A new santa ruleset has been created.

SANTA_UPDATE

The Santa ruleset has been updated.

SANTA_REMOVE

The Santa ruleset and its rules have been removed.

SANTA_RULE_CREATE

A new rule has been added to a Santa ruleset.

SANTA_RULE_UPDATE

The rule has been updated.

SANTA_RULE_REMOVE

The rule has been removed.

FIM_CREATE

A new FIM rule has been created.

FIM_UPDATE

The FIM rule has been updated.

FIM_REMOVE

The FIM rule has been removed.

WORKFLOW_CREATE

A new Workflow has been created.

WORKFLOW_UPDATE

The workflow configuration has changed.

WORKFLOW_REMOVE

The workflow has been removed.

WORKFLOW_CONFIGURATION_CREATE

The workflow has had a new configuration change added to the workflow.

WORKFLOW_CONFIGURATION_UPDATE

The workflow’s configuration has been updated.

WORKFLOW_CONFIGURATION_REMOVE

The workflow configuration has been removed and reset to its default.

WORKFLOW_EXECUTION_CREATE

A new workflow execution has started.

WORKFLOW_EXECUTION_UPDATE

The state of the workflow execution has been updated.

WORKFLOW_EXECUTION_REMOVE

The workflow execution has been removed.